Kubernetes Policy Engines

Kubernetes Policy Engines An architecture diagram generated by Archify. API Server · kube-apiserver · Kubernetes API API Server kube-apiserver Admission Webhook · Dynamic Admission Control · Kubernetes API Admission Webhook Dynamic Admission Control OPA Gatekeeper · supports Validate · Mutate · Policy engines · Open Policy Agent OPA Gatekeeper supports Validate · Mutate Open Policy Agent Kyverno · supports Validate · Mutate · Generate · Policy engines · Kubernetes-native Kyverno supports Validate · Mutate · Generate Kubernetes-native Kubewarden · supports Validate · Mutate · Policy engines · WebAssembly-based Kubewarden supports Validate · Mutate WebAssembly-based ConstraintTemplate · Rego language · Policy definitions ConstraintTemplate Rego language Constraint · policy instance · Policy definitions Constraint policy instance ClusterPolicy / Policy · YAML-based · Policy definitions ClusterPolicy / Policy YAML-based ClusterAdmissionPolicy · WebAssembly · Policy definitions ClusterAdmissionPolicy WebAssembly calls processes processes processes uses uses uses uses Kubernetes API Policy engines Policy definitions Legend Kubernetes API Policy definition Policy engine

OPA Gatekeeper

  • • ConstraintTemplate: a template that defines the policy logic (Rego)
  • • Constraint: an instance of a ConstraintTemplate that applies the policy to specific resources
  • • Runs as an admission controller, intercepting requests sent to the API server and applying policies

Kyverno · Kubewarden

  • • Kyverno: YAML-based ClusterPolicy/Policy — no need to learn Rego
  • • Kyverno additionally supports Verify Images and Clean Up policy types
  • • Kubewarden: policies written in various languages are compiled to Wasm modules and run on its policy server

Policy types

  • • Validate: checks that resources meet specific conditions — all three engines
  • • Mutate: automatically modifies resources — all three engines
  • • Generate: automatically creates other resources when a resource is created — Kyverno only