Tag: Kyverno

All the articles with the tag "Kyverno".

• 

  ValidatingAdmissionPolicy: moving admission control into the API server with CEL

  21 Aug, 2026

  Kyverno 1.17 deprecates classic ClusterPolicy in favor of CEL-native ValidatingPolicy, with removal planned for v1.20. ValidatingAdmissionPolicy has been stable since Kubernetes 1.30 and runs CEL directly inside kube-apiserver — no webhook, no network hop, no separate pod. We break down the CEL expression model, migrate a real policy, and measure the latency before/after.

• 

  Kyverno vs OPA Gatekeeper: when to pick which

  30 Jun, 2026

  Kyverno 1.17 promoted CEL to v1, Gatekeeper v3.22 integrated ValidatingAdmissionPolicy from upstream. Both projects are now stable — the choice depends on where your Kubernetes ends. A practical matrix: YAML vs Rego, validation/mutation/generation, and the hybrid option with full code examples.