From YAML to CEL: Understanding Kyverno’s New Policy Model
summary
Kyverno replaces YAML patterns and JMESPath with CEL expressions, switching from “describe a shape” to “evaluate true/false or return an object.” Policies split into validate (deny if containers lack limits), mutate (auto-add labels or defaults), generate (create/recreate a NetworkPolicy when a namespace appears), delete (cron job that removes completed Jobs, irreversible) and image-validate (cosign-signed images from GitHub Actions only). Typical flow is mutate then validate and CEL mutation returns the object applied.
AI-written summary · about
chapters (11)
- 0:00Kyverno introduction
- 0:42Kyverno policy engine
- 1:47Shift from YAML to CEL
- 2:50YAML vs CEL expressions
- 3:55Policy types separation
- 5:00Validating policy example
- 6:02Mutating policy auto-correct
- 7:02Generating policy
- 8:06Deleting policy
- 9:09Image validating policy
- 10:14Conclusion
related talks
34mKyverno Gets Smarter: Writing Dynamic Policies with CEL
06mProject Lightning Talk: Kyverno Lightning Update: CEL & Policy Types in Action
06mProject Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle
37mKyverno Introduction And Overview
27mUnderstanding Kyverno in a Visual Way
32mCloud Native Policy as Code: Principles and Best Practices
35mShift-Left Policy Validation in Kubernetes With Kyvern...
31mKubernetes Native Policy Management with Kyverno!