A deep look at the two dominant Kubernetes policy engines: Kyverno's YAML-native approach with validate, mutate, generate, and image-verification capabilities versus Gatekeeper's Rego-powered ConstraintTemplate model and its reach beyond Kubernetes — plus an honest reckoning with whether Kubernetes' built-in CEL admission policies are making both redundant.
Gatekeeper
-
Kyverno vs OPA Gatekeeper -
Open Policy Agent and Gatekeeper: Policy as Code for Kubernetes and Beyond A deep dive into OPA, Rego, and Gatekeeper — covering admission webhooks, ConstraintTemplates, external data providers, mutations, conftest testing, and policy-as-code patterns beyond Kubernetes.