Kyverno Mutating Policies: Shifting Platform Logic Into the Control Plane
summary
Kyverno mutating policies move environment-specific logic into the control plane, using CEL expressions, the Kyverno CLI, and Chainsaw tests to implement and validate real changes. Examples include injecting regional image registry hosts to cut egress costs, resolving Prometheus endpoints into 50 KEDA ScaledObjects without 50 PRs, and mutating existing objects in the background to keep clusters in sync. Works with FluxCD server-side apply and requires Argo CD annotations to avoid reconciliation loops.
AI-written summary · about
chapters (12)
- 0:00Kyverno mutating policies intro
- 1:04Why mutating policies matter
- 2:47Extending Kubernetes API server
- 5:59Prevent GitOps conflicts
- 7:48CEL native policies in 1.15+
- 10:59Quick wins with mutating policies
- 12:23Centralize Prometheus URLs for KEDA
- 16:21Registry replication with mutating policies
- 17:23Secure service discovery with policies
- 18:50Infrastructure as code for policies
- 20:38Live demo of Kyverno policies
- 24:13Closing remarks
related talks
49mKubernetes Policy as Code with Kyverno
33mKubernetes Policy as Code for Platform Engineers
27mUnderstanding Kyverno in a Visual Way
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
35mShift-Left Policy Validation in Kubernetes With Kyvern...
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
31mKubernetes Native Policy Management with Kyverno!
05mBeyond Guardrails: Resource Lifecycle Automation With Kyverno