Beyond Match & Pattern: Mastering Kyverno with CEL
summary
Kyverno ships CEL as a GA-capable expression engine that evaluates expressions, queries the Kubernetes API, and returns booleans at admission time; about half of users report migration underway. Examples: list ingresses via CEL to deny reused hostnames (demo blocks creation), read ConfigMap per-namespace to supply allowed registries (demo denies non‑GCR/docker images). Mutations inject securityContext/env for nginx images. New CRD kinds replace old cluster/cleanup policies and older types are slated for removal.
AI-written summary · about
chapters (13)
- 0:00Kyverno and CEL intro
- 1:10CEL evolution in Kubernetes
- 3:19What is CEL
- 6:37Kyverno policy enforcement
- 9:27New Kyverno policy types
- 11:58Live demo: Kyverno policies
- 13:25Unique hostnames in Ingress
- 15:52Dynamic registry validation
- 18:26Context-aware policy decisions
- 20:58Mutating policies with CEL
- 21:42CEL vs pattern matching
- 22:49Conclusion
- 23:14Q&A
related talks
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
27mUnderstanding Kyverno in a Visual Way
35mShift-Left Policy Validation in Kubernetes With Kyvern...
49mKubernetes Policy as Code with Kyverno
46mKyverno: Compliance Inside Your Kubernetes Cluster
33mA Field Guide To Integrating CEL in the Kubernetes Codebase
04mWelcome & Opening Remarks
31mKubernetes Native Policy Management with Kyverno!