Cloud Custodian vs Open Policy Agent Gatekeeper
Cloud Custodian
cloudcustodian.io
Open Policy Agent Gatekeeper
open-policy-agent.github.ioSide by side
| Figure | Cloud Custodian | Open Policy Agent Gatekeeper |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Cloud Governance Software | 8.1 (#8) | 8.2 (#7) |
| Spec score · Infrastructure Policy as Code Tools | 8.1 (#10) | 8.2 (#9) |
| Community support | The project points users to Slack, a mailing list, GitHub discussions, and community meetings that are open to users and developers of every skill level. | The project site links to a Gatekeeper Slack channel and community meetings. |
| Purpose | Cloud Custodian manages cloud resources by filtering and tagging them, then applying actions through policies written in a YAML domain specific language. | Gatekeeper is a validating and mutating Kubernetes webhook that enforces CRD-based policies evaluated by Open Policy Agent. |
| Security reporting | The project asks people to report security vulnerabilities to its security team at [email protected] and says it will acknowledge reports by email. | Security reports are requested by email, with acknowledgement and follow-up after investigation. |
Plans
Open Policy Agent Gatekeeper
- GatekeeperFree
- Open-source GatekeeperFree
In their own words
Cloud Custodian
Cloud Custodian manages cloud resources through policies written in YAML. Each policy names a resource type, filters for selecting resources, and actions to apply to matches. It supports security policy enforcement, compliance, tag policies, cleanup of unused resources, and cost management for AWS, Azure, and Google Cloud Platform resources. Policies can respond to provider events through serverless features or run on a cron schedule. Users can validate policies and preview matching resources in dry-run mode before actions execute. Runs can produce policy metrics, structured resource records, and logs for cloud metrics, storage, and logging services. Documented event connections include AWS CloudWatch Events and Config Rules, Azure EventGrid, and GCP AuditLog and Pub/Sub. Installation is documented for Linux, macOS, and Windows, with Docker and Kubernetes operation also described. Kubernetes, Tencent Cloud, and OpenStack support are in beta; Terraform integration is in alpha. Cloud Custodian is free at free and open source under Apache 2.0. An AWS constraint is that event-triggered policies run only in the same region and account, while periodic policies may run elsewhere.
Open Policy Agent Gatekeeper
Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.