Overview
Kyverno uses Common Expression Language (CEL) to validate, mutate, generate, and delete resources, and to verify container images. Policies can be applied in Kubernetes clusters and, where supported, to JSON payloads outside Kubernetes.
Policy Types
Section titled “Policy Types”All policy types below use policies.kyverno.io/v1.
| Policy Type | Description |
|---|---|
| ValidatingPolicy | Validate Kubernetes resources or JSON payloads |
| MutatingPolicy | Mutate new or existing resources |
| GeneratingPolicy | Create or clone resources based on flexible triggers |
| DeletingPolicy | Delete matching resources based on a schedule |
| ImageValidatingPolicy | Verify container image signatures and attestations |
Each policy type also has a namespaced variant: NamespacedValidatingPolicy, NamespacedMutatingPolicy, NamespacedGeneratingPolicy, NamespacedDeletingPolicy, and NamespacedImageValidatingPolicy. These apply only to resources in the namespace in which the policy is created.
For existing installations using earlier policy APIs, see Migrating to CEL Policies. Use the version selector to access reference documentation for older Kyverno releases.
Supporting Resource Types
Section titled “Supporting Resource Types”| Resource Type | Description | API Version |
|---|---|---|
| PolicyException | Exempt resources from policies using CEL match conditions | policies.kyverno.io/v1 |
| GlobalContextEntry | Cache Kubernetes resources or external API data for policies | kyverno.io/v2 |
| UpdateRequest | Internal type used for background generate and mutate processing | kyverno.io/v2 |
| PolicyReport / ClusterPolicyReport | Policy results reporting | wgpolicyk8s.io/v1alpha2 |
| EphemeralReport / ClusterEphemeralReport | Internal intermediary report types | reports.kyverno.io/v1 |
API Versions
Section titled “API Versions”Use policies.kyverno.io/v1 in policy and exception manifests, and kyverno.io/v2 for GlobalContextEntry. Consult the upgrade guide before changing Kyverno versions. The kyverno migrate command rewrites stored objects to their current storage version; it does not translate policy logic between policy types.