KubeArmor vs Open Policy Agent Gatekeeper
KubeArmor
kubearmor.io
Open Policy Agent Gatekeeper
open-policy-agent.github.ioSide by side
| Figure | KubeArmor | Open Policy Agent Gatekeeper |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Kubernetes Security Software | 8.6 (#3) | 8.3 (#5) |
| Spec score · Container Security Software | 8.6 (#4) | 8.4 (#5) |
| Cloud integrations | The support matrix lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, and DigitalOcean Kubernetes. | The official site lists Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud Kubernetes as integrations or backed services. |
| Community support | Project-level questions can be directed to the maintainer group by email, and the project provides Slack, GitHub Discussions, and GitHub Issues channels. | The project site links to a Gatekeeper Slack channel and community meetings. |
| Installation | The getting-started guide installs KubeArmor on a Kubernetes cluster using Helm and kubectl. | Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment. |
| Purpose | KubeArmor is an open-source, cloud-native runtime security system that hardens workloads and enforces security policies. | Gatekeeper is a validating and mutating Kubernetes webhook that enforces CRD-based policies evaluated by Open Policy Agent. |
| Security reporting | The project asks users to report security vulnerabilities through its security process rather than as public GitHub issues. | Security reports are requested by email, with acknowledgement and follow-up after investigation. |
| What it does | KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking operations for pods, containers, and nodes. | Gatekeeper is a Kubernetes policy controller that enforces policy during admission and can audit running resources. |
Plans
Open Policy Agent Gatekeeper
- GatekeeperFree
- Open-source GatekeeperFree
In their own words
KubeArmor
KubeArmor is an open-source runtime security system for enforcing policies on cloud-native workloads. It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM, with eBPF for alerts, telemetry, and container-process tracking. Policies can restrict process execution, file access, networking operations, and resource use. Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring is audit-only. Kubernetes policies can target pods through labels and label expressions, and rules can match paths, network protocols, capabilities, and system calls. The deployment matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts. It lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, and DigitalOcean Kubernetes, but support varies by operating system, architecture, and enforcement mode. Some environments are observability-only, and VMware Tanzu entries are under construction. KubeArmor is a community-governed CNCF Sandbox project. The free plan is free; installation guidance uses Helm and kubectl.
Open Policy Agent Gatekeeper
Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.