WIP: kyverno-0.2.0-alpha draft release notes #1359

First full release notes for this plugin. Kyverno support has been part of Headlamp since kyverno-0.1.0, this release gathers everything added since then into one place: policy impact visibility, CEL policy support, and engine health monitoring.

About

Kyverno is a policy engine built for Kubernetes. Policies are written as Kubernetes resources, no new language to learn, and can validate, mutate, generate, or clean up other resources to enforce best practices and security rules across a cluster.

Headlamp is an open-source, extensible Kubernetes web UI. Its plugin system lets Kubernetes projects add sidebar navigation, routes, resource models, list views, detail views, and actions that feel native to the rest of the interface.

Without this plugin, understanding what your cluster's Kyverno policies are actually doing means switching between kubectl, raw policy YAML, and PolicyReport objects to piece together which resources were evaluated, why, and what happened. This release brings that visibility into Headlamp directly, alongside CEL policy support and engine health monitoring.

Demo

Highlights

• Policy Impact Map on every policy's detail page, showing which live resources it actually affects, grouped by kind, with pass, fail, and warning counts.
• Plain-language match explanations for every result, drawn from the policy's own rules, honest about results reached through autogenerated rules or background scans.
• List and detail views for all 5 namespaced CEL policy kinds: ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, and ImageValidatingPolicy.
• A clear, version-aware message instead of a broken page when a namespaced CEL kind isn't available yet on your Kyverno version.
• A new Policy Engine Health section on the Dashboard: live admission rate, denied requests, circuit breaker trips, and P95 admission review latency, sourced directly from Kyverno's own Prometheus metrics.
• Visibility into rules that exist but never became ready, a correctness gap the existing report-based Dashboard view can't see on its own.
• Fix: every translated string with a variable (counts, percentages, error messages) rendered raw, unprocessed template text to every user since the plugin shipped.
• Fix: table and list headers could render blank and stay blank after a locale switch, now fixed with stable column ids across every list and table in the plugin.

Policy Impact Map

Every policy's detail page now has a Policy Impact Map: open any ClusterPolicy or Policy to see which live resources it actually affects, grouped by kind, with pass, fail, and warning counts.

• Resources grouped by kind, each with its own pass, fail, and warning counts.
• A plain-language reason for each kind, drawn directly from the policy's own match rules.
• An honest fallback when a resource was reached through an autogenerated rule or a background scan rather than an explicit match block, instead of a guess.
• The same panel for both cluster-wide ClusterPolicy and namespace-scoped Policy resources, correctly resolving Kyverno's internal <namespace>/<name>-qualified identity for the latter.

This reads directly from Kyverno's own PolicyReport and ClusterPolicyReport objects, so it reflects exactly what Kyverno itself decided, not a second, client-side guess at its match logic.

Namespaced CEL Policy Views

Kyverno's 5 CEL policy kinds now have namespaced counterparts in the sidebar too: open Kyverno, then any "Namespaced ..." entry, to browse namespace-scoped ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, and ImageValidatingPolicy resources, the same way the existing cluster-scoped views already work.

• List and detail views for all 5 namespaced CEL policy kinds, matching the existing cluster-scoped pages.
• A Namespace column on every namespaced list, so the same policy name used in two different namespaces is never ambiguous.
• Distinct tabs for two policies that share a name across different namespaces, instead of one colliding tab.

A namespaced CEL kind not yet available on your cluster shows a clear, specific message instead of a broken page, each kind's version support is checked individually rather than assuming all 5 were promoted together, since Kyverno doesn't always do that in the same release.

Policy Engine Health

Kyverno's Overview page now has a Policy Engine Health section, answering "is the policy engine healthy right now" using Kyverno's own live Prometheus metrics, without needing to leave Headlamp or open Grafana.

• Admission request rate and denied-request count over the last 5 minutes.
• Circuit breaker trips in the last hour, Kyverno tripping its own overload protection.
• Policies Not Ready, a correctness gap the existing report-based Dashboard can't see on its own, counted across every policy kind this plugin supports.
• Controller requeue count over the last hour.
• P95 admission review latency over the last hour, the one chart in the section.

A policy with a rule that never became ready produces no reports at all, so nothing else in the plugin could ever have surfaced it before this. Legacy and CEL policy kinds are both covered, even though Kyverno's own Prometheus metric only ever tracks rule readiness for the legacy ones.

If no Prometheus server is reachable, the section shows a clear "not detected" message instead of crashing or going blank, the same discovery approach the official Prometheus plugin already uses.

Stable Translations & Tables

Every string that includes a count, percentage, or error message now actually shows its real value, and every table and list view across the plugin updates reliably when the interface language changes. No action needed, this just works correctly now.

• Every {{variable}} placeholder across the plugin, 21 of them, now substitutes its real value: section counts, compliance percentages, pass/fail chips, and error messages all render correctly instead of literal unprocessed template text.
• Table and list headers across every view in the plugin update cleanly when translations load or the language changes, instead of risking staying blank.

The plugin never actually had working translations before this: it never declared its own locale support to Headlamp, so every translated string call just returned its raw, unprocessed input, to every user, in any language, since the plugin first shipped. Fixing that meant text could legitimately change from untranslated to translated for the first time ever, which exposed a second bug: headers are keyed by column id for performance, and with no id ever declared, a header could render once while empty and then never update again.

Why This Matters

Kyverno operators need to know not just what policies exist, but what they're actually doing: which resources they touch, whether the engine itself is healthy, and whether a cluster's CEL-based policies behave correctly across every scope they support.

Without this plugin, answering those questions means switching between kubectl, raw PolicyReport objects, and a separate Prometheus or Grafana setup, piecing together information Headlamp already has the context to show in one place.

This helps operators:

• See which live resources a policy actually affects, not just that it exists.
• Trust that policy impact data reflects what Kyverno itself decided, not a second guess at its match logic.
• Browse and manage namespace-scoped CEL policies the same way they already work with cluster-scoped ones.
• Check whether the policy engine itself is healthy, without leaving Headlamp for Grafana.
• Catch a policy that's silently not ready before it becomes a real gap in enforcement.
• Rely on tables and translations that behave correctly, instead of working around known UI bugs.

Contributors

This alpha's work was developed as part of the Linux Foundation Mentorship program, with review and guidance from the Headlamp community.

Installation

Build the plugin from source:

git clone https://github.com/headlamp-k8s/plugins
cd plugins/kyverno
npm install
npm run build

Requirements

• Headlamp Desktop or an in-cluster Headlamp installation.
• A recent Node.js LTS version, required to build from source.
• A Kubernetes cluster reachable from Headlamp.
• Kyverno installed in the cluster.
• Kubernetes permissions to get, list, and watch Kyverno policy and report resources.
• Prometheus, optional, only needed for the Policy Engine Health section. Auto-discovered the same way the official Prometheus plugin does.

Compatibility

Changelog

Major features

• Added a Policy Impact Map to the policy detail page, showing which live resources a policy actually affects, grouped by kind, with a plain-language match explanation.
• Added list and detail views for all 5 namespaced CEL policy kinds.
• Added a Policy Engine Health section to the Dashboard, backed by live Prometheus metrics.

Fixes

• Fixed every {{variable}} placeholder across the plugin rendering raw, unprocessed template text instead of real values.
• Fixed table and list headers that could render blank and stay blank after a locale switch.

Pull requests

• Namespaced CEL policy views: #1306 (merged)
• Policy impact aggregation module: #1294
• Policy Impact panel: #1351
• Prometheus-backed policy engine health: #1310
• Translation and table stability fix: #1281 (merged)

Known Limitations

• The Policy Impact Map does not yet link from a specific failing resource to the exact report detail that explains it, that drill-down view is planned but not built yet.
• The Policy Impact Map covers the legacy kyverno.io/v1 Policy and ClusterPolicy kinds only, not the CEL policy kinds.
• The Policy Engine Health section is deliberately not a full observability dashboard. Grafana already does that well, this just answers whether the policy engine is healthy right now.
• Long sidebar entries, including the namespaced CEL policy kind names, can truncate visually at the default sidebar width.

What's Next

Possible next areas for this plugin include:

• A drill-down view linking directly from the Policy Impact Map to the specific report result behind a failure.
• Policy impact visibility extended to CEL policy kinds, not just the legacy ones.
• A Map view source for visualizing policy relationships.
• Continued usability improvements based on feedback from Headlamp and Kyverno users.

Feedback

Feedback, bug reports, and feature ideas are welcome.

Bug reports: Open an issue

Feature requests: Start a discussion

Contributing: Pull requests are welcome.

Plugin source: headlamp-k8s/plugins/kyverno

License: Apache 2.0