[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Installing applications from Cloud Marketplace > Installing Kyverno & Kyverno Policies

# Installing Kyverno & Kyverno Policies

[Kyverno](https://kyverno.io) is an application to manage Kubernetes security policies. Security policies appear in Kyverno as Kubernetes resources. Kyverno supports `kubectl`, `git`, and `kustomize`. You can use the Kyverno command line interface to test policies and validate resources as part of the CI/CD pipeline.

[Kyverno policies](https://github.com/kyverno/kyverno/tree/main/charts/kyverno-policies) is a Kyverno extension. Kyverno policies includes an implementation of the Kubernetes [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/). The original policies are stored in a separate [Kyverno-policies](https://github.com/kyverno/policies/tree/main/pod-security) repository.

{% note tip %}

To find vulnerabilities in Kubernetes clusters, use [Chaos Mesh](chaos-mesh.md). Vulnerability detection will help you configure security policies.

{% endnote %}

## Getting started {#before-you-begin}

[Make sure](../connect/security-groups.md) the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If a rule is missing, [add it](../../../vpc/operations/security-group-add-rule.md).

{% note warning %}

The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.

{% endnote %}

## Installation from Yandex Cloud Marketplace {#marketplace-install}

1. In the [management console](https://console.yandex.cloud), select a folder.
1. Navigate to **Managed Service for Kubernetes**.
1. Click the name of the [Managed Service for Kubernetes cluster](../../concepts/index.md#kubernetes-cluster) you need and select the ![image](../../../_assets/console-icons/shopping-cart.svg) **Marketplace** tab.
1. Under **Application available for installation**, select [Kyverno & Kyverno Policies](https://yandex.cloud/en/marketplace/products/yc/kyverno) and click **Go to install**.
1. Configure the application:
   * **Namespace**: Create a new [namespace](../../concepts/index.md#namespace), e.g., `kyverno-space`. If you leave the default namespace, Kyverno may work incorrectly.
   * **Application name**: Specify the application name.
   * **Activating Kyverno Policies**: Select to install the Kyverno Policies extension.
   * **Pod Security Standard profile**: Select the [Pod Security Standard profile](https://kubernetes.io/docs/concepts/security/pod-security-standards/):
     * `baseline`: Policy with minimum restrictions that prevents known risks of privilege abuse.
     * `restricted`: Policy with severe restrictions aligned with the latest pod security practices.
     * `privileged`: Unrestricted policy granting maximum privileges.
   * **Validation failure action**: Select a response to Kyverno triggering:
     * `audit`: Notify.
     * `enforce`: Block.
1. Click **Install**.
1. Wait for the application status to change to `Deployed`.

## Installation using a Helm chart {#helm-install}

1. [Install Helm](https://helm.sh/docs/intro/install/) v3.8.0 or higher.

1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).

1. To install a [Helm chart](https://helm.sh/docs/topics/charts/) with Kyverno, run this command:

   ```bash
   helm pull oci://cr.yandex/yc-marketplace/multi-kyverno \
     --version 1.0.0 \
     --untar && \
   helm install \
     --namespace <namespace> \
     --create-namespace \
     multi-kyverno ./multi-kyverno/
   ```

   If you set `namespace` to the default namespace, Kyverno may work incorrectly. We recommend specifying a value different from all the existing namespaces, e.g., `kyverno-space`.

   {% note info %}
   
   If you are using a Helm version below 3.8.0, add the `export HELM_EXPERIMENTAL_OCI=1 && \` string at the beginning of the command to enable [Open Container Initiative](https://opencontainers.org/) (OCI) support in the Helm client.
   
   {% endnote %}

## Application versions {#versions}

Each Kubernetes version supports a certain Kyverno version. The required Kyverno version is installed by default depending on your Kubernetes version.

|   Kubernetes version  | Kyverno version |       Guides       |
| -------------------- | -------------- | ------------------------ |
| 1.21 or older |       1.6      | [Kyverno 1.6 documentation](https://release-1-6-0.kyverno.io/docs/) |
|         1.22         |       1.7      | [Kyverno 1.7 documentation](https://release-1-7-0.kyverno.io/docs/) |
|         1.23         |       1.8      | [Kyverno 1.8 documentation](https://release-1-8-0.kyverno.io/docs/) |
|      1.24 and higher     |       1.9      | [Kyverno 1.9 documentation](https://release-1-9-0.kyverno.io/docs/) |

## Uninstalling the application {#uninstall}

If you no longer need Kyverno, uninstall it:

{% list tabs group=instructions %}

- Yandex Cloud Marketplace {#marketplace}

   1. In the [management console](https://console.yandex.cloud), select a folder.
   1. Navigate to **Managed Service for&nbsp;Kubernetes**.
   1. Click the name of the [Kubernetes cluster](../../concepts/index.md#kubernetes-cluster) you need and select the ![image](../../../_assets/console-icons/shopping-cart.svg) **Marketplace** tab.
   1. Under **Installed applications**, in the row of the [Kyverno & Kyverno Policies](https://yandex.cloud/en/marketplace/products/yc/kyverno) application, first click ![image](../../../_assets/marketplace/three_dots.png =22x13) and then **Uninstall**.
   1. [Connect to the cluster](../connect/index.md#kubectl-connect) using kubectl.
   1. [Clean up the application's webhook configurations](https://release-1-8-0.kyverno.io/docs/installation/#clean-up-webhook-configurations); otherwise, the cluster will not run properly.

- Helm {#helm}

   1. [Connect to the cluster](../connect/index.md#kubectl-connect) using kubectl.
   1. Delete the application:

      ```bash
      helm uninstall --namespace <namespace> multi-kyverno ./multi-kyverno/
      ```

   1. [Clean up the application's webhook configurations](https://release-1-8-0.kyverno.io/docs/installation/#clean-up-webhook-configurations); otherwise, the cluster will not run properly.

{% endlist %}

## Use cases {#examples}

* [Setting up Kyverno & Kyverno Policies](../../tutorials/marketplace/kyverno.md).

## See also {#see-also}

* [Kyverno documentation](https://kyverno.io/docs/)