Google Kubernetes Engine: Policy Controller end of support

Policy Controller reaches end of support on 31 Dec 2027. On that date, technical support, security patching on GKE version 1.38 and earlier, and the Google Cloud console dashboard for Policy Controller end. From 31 Jan 2027, you cannot enable Policy Controller in fleet host projects that do not already have it enabled. Google Kubernetes Engine (GKE) blocks upgrades to version 1.39 and later for clusters that have Policy Controller installed. Clusters that run GKE version 1.39 and later do not support Policy Controller. Google deprecated Policy Controller on 12 Nov 2026. Google states that migrating does not affect workloads that are already running.

1. Identify the clusters in your fleet that run Policy Controller, and list the constraints on each cluster.
2. Back up your ConstraintTemplates and constraints to separate files. If you enabled referential rules in Policy Controller, also back up your sync configuration. If you enabled mutation in Policy Controller, also back up your mutators. Removing Policy Controller deletes every ConstraintTemplate, constraint, sync configuration, and mutator on the cluster.
3. Choose a replacement for each admission policy. Google recommends ValidatingAdmissionPolicy for policies that check a single resource when it is created or updated, and Pod Security Admission for the Pod security bundles. Self-managed OPA Gatekeeper is for policies that ValidatingAdmissionPolicies cannot express, such as referential policies that read other resources in the cluster.
4. To replace a constraint without a gap in enforcement, run the ValidatingAdmissionPolicy next to the constraint with the Warn and Audit actions. After the results match, change the binding to the Deny action and delete the Policy Controller constraint.
5. Before you upgrade a cluster to GKE version 1.39, migrate your policies and remove Policy Controller from that cluster. Do not remove Policy Controller only to unblock the upgrade before you migrate your policies, because that leaves the cluster without policy enforcement.
6. Uninstall Policy Controller with the gcloud container fleet policycontroller disable command, and wait until the state of each membership is NOT_INSTALLED. That command removes Policy Controller only from clusters that the fleet manages. For other clusters, see Remove Policy Controller from clusters outside a fleet.

Google's steps are in Migrate from Policy Controller.