--- title: Kyverno Explained: Why Modern Platforms Need Policy-as-Code description: Kyverno is a CNCF-graduated, Kubernetes-native policy engine that lets platform teams enforce security and operational standards using YAML and CEL policies —... canonical: https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kyverno Explained: Why Modern Platforms Need Policy-as-Code | daily.dev og:description: Kyverno is a CNCF-graduated, Kubernetes-native policy engine that lets platform teams enforce security and operational standards using YAML and CEL policies —... og:url: https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy og:image: https://api.daily.dev/og/posts/WUk8rOAOY.png og:image:alt: Kyverno Explained: Why Modern Platforms Need Policy-as-Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kyverno Explained: Why Modern Platforms Need Policy-as-Code **[Medium](https://daily.dev/sources/medium_js)** · 7 min read · 1 upvotes · 0 comments ## Summary Kyverno is a CNCF-graduated, Kubernetes-native policy engine that lets platform teams enforce security and operational standards using YAML and CEL policies — no new language required. It supports five CEL-native policy types: ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy, and DeletingPolicy, each with namespaced variants for multi-tenancy. Policies are evaluated at admission time, during background reconciliation, and via scheduled scans. The post covers practical rollout advice (start in audit mode, avoid immediate deny policies), explains when Kubernetes' built-in ValidatingAdmissionPolicy suffices, and notes that the older ClusterPolicy and CleanupPolicy types are deprecated as of Kyverno 1.17 and will be removed in 2026. For teams evaluating policy engines without a strong OPA/Gatekeeper commitment, Kyverno is recommended as the first pilot. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Are ClusterPolicy and CleanupPolicy deprecated in Kyverno 1.17? Yes, Kyverno 1.17 marked the older ClusterPolicy and CleanupPolicy CRDs as deprecated, and they will be removed later in 2026. New policies should be written using the CEL-native CRDs such as ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy, and DeletingPolicy instead, unless there is a specific reason to keep using the legacy types. _Teams planning a Kyverno policy migration can track deprecation timelines like this one on daily.dev._ ### When should I use Kubernetes ValidatingAdmissionPolicy instead of Kyverno? ValidatingAdmissionPolicy, built into Kubernetes 1.30 and later, is the right choice when you only need to validate resources at admission time without a separate controller. Kyverno is the better fit when you need additional capabilities like mutation, resource generation, image signature verification, scheduled cleanup, or background scanning of existing resources against current policies. _Comparing admission-control options for Kubernetes is easier when developers gather trade-offs like these on daily.dev._ ### How many CEL-native policy CRDs does Kyverno provide and what are they for? Kyverno's CEL-native policies span eleven CRDs under the policies.kyverno.io group: five cluster-scoped types, five namespaced equivalents, plus PolicyException. The core types are ValidatingPolicy for validation, MutatingPolicy for admission-time mutation, GeneratingPolicy for creating downstream resources, ImageValidatingPolicy for verifying container image signatures and attestations, and DeletingPolicy for scheduled cleanup of stale resources. _Engineers designing multi-tenant Kubernetes policy setups can keep up with CRD changes like these via daily.dev._ ## Similar posts on daily.dev - [Policy-as-Code: Flexible Kubernetes governance with Kyverno](https://daily.dev/posts/policy-as-code-flexible-kubernetes-governance-with-kyverno-wvztjd4cj) · CNCF · 0 upvotes · 0 comments - [Vetting Kubernetes configuration with Kyverno prior to deployment](https://daily.dev/posts/vetting-kubernetes-configuration-with-kyverno-prior-to-deployment-m3cfjuial) · ITNEXT · 1 upvotes · 0 comments - [Kyverno vs Kubernetes policies: How Kyverno complements and completes Kubernetes policy types](https://daily.dev/posts/kyverno-vs-kubernetes-policies-how-kyverno-complements-and-completes-kubernetes-policy-types-9timunzg1) · CNCF · 1 upvotes · 0 comments - [CNCF Announces Kyverno Graduation as Policy-as-Code Adoption Grows](https://daily.dev/posts/cncf-announces-kyverno-graduation-as-policy-as-code-adoption-grows-leqekfz9g) · Cloud Native Now · 0 upvotes · 0 comments - [CNCF Announces Kyverno’s Graduation](https://daily.dev/posts/cncf-announces-kyverno-s-graduation-2t2tcym88) · CNCF · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#policy-as-code](https://daily.dev/tags/policy-as-code), [#kyverno](https://daily.dev/tags/kyverno) [View this post on daily.dev](https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kyverno Explained: Why Modern Platforms Need Policy-as-Code","url":"https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy"},"datePublished":"2026-07-27T19:34:29.750Z","dateModified":"2026-09-13T20:31:06.821Z","description":"Kyverno is a CNCF-graduated, Kubernetes-native policy engine that lets platform teams enforce security and operational standards using YAML and CEL policies —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9233d6bd798bc88b8c683caee7252b0d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9233d6bd798bc88b8c683caee7252b0d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,policy-as-code,kyverno","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Kyverno Explained: Why Modern Platforms Need Policy-as-Code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy#faq","mainEntity":[{"@type":"Question","name":"Are ClusterPolicy and CleanupPolicy deprecated in Kyverno 1.17?","acceptedAnswer":{"@type":"Answer","text":"Yes, Kyverno 1.17 marked the older ClusterPolicy and CleanupPolicy CRDs as deprecated, and they will be removed later in 2026. New policies should be written using the CEL-native CRDs such as ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy, and DeletingPolicy instead, unless there is a specific reason to keep using the legacy types. Teams planning a Kyverno policy migration can track deprecation timelines like this one on daily.dev."}},{"@type":"Question","name":"When should I use Kubernetes ValidatingAdmissionPolicy instead of Kyverno?","acceptedAnswer":{"@type":"Answer","text":"ValidatingAdmissionPolicy, built into Kubernetes 1.30 and later, is the right choice when you only need to validate resources at admission time without a separate controller. Kyverno is the better fit when you need additional capabilities like mutation, resource generation, image signature verification, scheduled cleanup, or background scanning of existing resources against current policies. Comparing admission-control options for Kubernetes is easier when developers gather trade-offs like these on daily.dev."}},{"@type":"Question","name":"How many CEL-native policy CRDs does Kyverno provide and what are they for?","acceptedAnswer":{"@type":"Answer","text":"Kyverno's CEL-native policies span eleven CRDs under the policies.kyverno.io group: five cluster-scoped types, five namespaced equivalents, plus PolicyException. The core types are ValidatingPolicy for validation, MutatingPolicy for admission-time mutation, GeneratingPolicy for creating downstream resources, ImageValidatingPolicy for verifying container image signatures and attestations, and DeletingPolicy for scheduled cleanup of stale resources. Engineers designing multi-tenant Kubernetes policy setups can keep up with CRD changes like these via daily.dev."}}]} ```