Post

Kapil Agrawal
@netops2devops.net

After struggling with embedding Rego inside YAML on top of having to write constraint template, then a constraint file just to create 1 basic admission policy, I am switching teams from #Gatekeeper to #Kyverno and as it turns out ..

Kapil Agrawal
@netops2devops.net

the policy I was trying to write already comes ready made in #Kyverno policy library and it's less than 20 lines of YAML!! kyverno.io/policies/oth... As much as I love #OPA the developer experience around using it with gatekeeper is a bit rough (IMO).

kyverno.ioNamespace ProtectionCases where RBAC may be applied at a higher level and where Namespace-level protections may be necessary can be accomplished with a separate policy. For example, one may want to protect creates, updat...

0 reposts1 like

Kapil Agrawal
@netops2devops.net

#Kyverno also has this super awesome feature to generate new objects (like NetworkPolicy) during admission review which is definitely not a thing in Gatekeeper from what I can tell.