Kyverno Gets Smarter: Writing Dynamic Policies with CEL
summary
Kyverno now embeds CEL expressions (Kyverno v1.15+; feature alpha) to write dynamic policies that actually run: examples include deny latest tag using map/all instead of repeated patterns, unique ingress host that queries cluster ingresses and rejects duplicates, and a use configmap to set maxReplicas pattern that enforces per-environment replica limits. Mutations are supported in v1.15, CEL is small and fast (simple checks are faster; queries add an API call), and the demo policies block or allow resources as expected.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:06Common Expression Language
- 3:17CEL basics and examples
- 7:59CEL playgrounds and testing
- 10:10Kyverno policies with CEL
- 12:35Dynamic policies with cluster references
- 15:45Demo: Prevent duplicate ingress hosts
- 19:01CEL extensions in Kyverno
- 24:50Advantages of CEL for policies
- 27:22Q&A
related talks
11mFrom YAML to CEL: Understanding Kyverno’s New Policy Model
06mProject Lightning Talk: Kyverno Lightning Update: CEL & Policy Types in Action
37mKyverno Introduction And Overview
31mKubernetes Native Policy Management with Kyverno!
27mUnderstanding Kyverno in a Visual Way
39mKyverno Playground: Make Policy Testing a Breeze and Enjoy the Process!
35mShift-Left Policy Validation in Kubernetes With Kyvern...
46mKyverno: Compliance Inside Your Kubernetes Cluster