Timeweb Cloud adds Kyverno and updates managed Kubernetes versions

Timeweb Cloud has added the Kyverno add-on to its managed Kubernetes service and refreshed three supported k0s patch lines. Kyverno expresses cluster-resource rules declaratively without requiring teams to build a separate admission webhook.

What policy as code changes

A policy can validate an object before admission, mutate it to apply a standard, or generate a related resource. Common examples include requiring CPU and memory limits, rejecting privileged containers, restricting image registries, and adding mandatory labels.

The main benefit is reproducibility. Rules can live in version control, pass through review, and be applied consistently across clusters. Violations become visible before an undocumented manual setting turns into persistent configuration drift.

Supported patch releases

The provider lists Kubernetes 1.36.4+k0s.0, 1.35.8+k0s.0, and 1.34.11+k0s.0. A patch upgrade is not an automatic compatibility guarantee. Teams still need to test API behaviour, admission ordering, networking, CSI drivers, operators, and in-house controllers.

A controlled adoption path

Start in audit mode with a small set of low-noise checks. Measure existing violations, give developers actionable failure messages, remediate deployed workloads, and only then switch an individual policy to enforcement.

Emergency changes need a documented break-glass path. An exception should never become invisible permanent state: assign an owner, an expiry, and a follow-up review.

The changelog confirms the add-on and cluster versions but does not state the Kyverno version, its high-availability topology, or the add-on upgrade policy in this entry. Those details need verification before production adoption.

Source: the official Timeweb Cloud changelog dated 10 September 2026.