Graduating within the CNCF marks a major milestone for an open source project, signaling not just technical maturity but strong governance, security practices, and widespread adoption. Kyverno, a Kubernetes policy engine, reached this stage after five years — becoming only the 35th project to progress from sandbox to graduation. As co-founder Jim Bugwadia explains, incubation reflects production readiness and adoption, while graduation validates the project’s long-term sustainability and governance rigor.

Originally built to help teams manage Kubernetes complexity through declarative policies, Kyverno has evolved alongside the ecosystem. Its shift to the Kubernetes-native Common Expression Language (CEL) and rising demand driven by AI workloads have expanded its user base beyond regulated industries to mainstream enterprises. With over three billion downloads, it underscores the growing need for automated policy enforcement across development, security, and operations teams.

Commercially, Nirmata maintains a clear boundary between open source and enterprise offerings, focusing on remediation and advanced management. While only 2–5% of users convert, that small percentage becomes meaningful at Kyverno’s scale.

Learn more from The New Stack around the latest about Kyverno:

Simplify Kubernetes Security With Kyverno and OPA Gatekeeper

Using the Kyverno CLI to Write Policy Test Cases

Join our community of newsletter subscribers to stay on top of the news and at the top of your game.

As Kyverno graduates from the CNCF, founder reflects on the careful balance of an open source business

The New Stack Podcast