Kyverno 1.17 is a landmark release that marks the stabilization of our next-generation Common Expression Language (CEL) policy engine. While 1.16…

CNCF's platform is a leading organization driving cloud-native technologies and standards, offering insights into container orchestration, microservices architecture, and cloud-native infrastructure. Through whitepapers, case studies, and community events, CNCF provides insights into adopting cloud-native practices and technologies. Developers and DevOps teams can learn about Kubernetes, Prometheus, and other CNCF projects to build and operate scalable and resilient cloud-native applications.

CNCF

Kyverno 1.17 promotes its CEL-based policy engine to v1 (GA), marking a major milestone for the project. Key changes include: CEL policy types (ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy, DeletingPolicy, and their namespaced variants) are now stable and production-ready; new namespaced mutation and generation policies enable true multi-tenancy; and a range of new CEL functions are added (hashing, math, X.509 decoding, JSON/YAML parsing, time utilities). Legacy ClusterPolicy and CleanupPolicy (JMESPath-based) are officially deprecated with removal planned for v1.20 (Oct 2026). The release also includes Cosign v3 support, improved observability with a new `--allowedResults` flag, a decoupled API repository and SDK for integrators, and a fully redesigned kyverno.io website built on Starlight.

Announcing Kyverno 1.17!

Namespaced mutating and generating policies

Getting started and backward compatibility