Kyverno vs Open Policy Agent Gatekeeper
Kyverno
kyverno.io
Open Policy Agent Gatekeeper
open-policy-agent.github.ioSide by side
| Figure | Kyverno | Open Policy Agent Gatekeeper |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 2 |
| Spec score · Container Security Software | 8.7 (#3) | 8.4 (#5) |
| Spec score · Kubernetes Security Software | 8.6 (#4) | 8.3 (#5) |
| Spec score · Cloud Governance Software | 8.6 (#5) | 8.2 (#7) |
| Spec score · Infrastructure Policy as Code Tools | 8.5 (#7) | 8.2 (#9) |
| CLI | The Kyverno CLI validates and tests policies against manifests before deployment and runs standalone or as a kubectl plugin. | The project documents the gator command-line interface for validating workload resources and policies. |
| Installation | Kyverno supports Helm and YAML installation, with Helm recommended for production customization and upgrades. | Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment. |
| Licence | The project is open source under the Apache License 2.0. | The Gatekeeper repository is licensed under Apache-2.0. |
| Mutation | Mutation rules modify matching resources using strategic-merge patches or RFC 6902 JSON patches. | Mutation resources can change matching Kubernetes objects during admission before validation evaluates the final object. |
| Purpose | Kyverno is a Kubernetes-native policy engine for defining and enforcing policy as code. | Gatekeeper is a validating and mutating Kubernetes webhook that enforces CRD-based policies evaluated by Open Policy Agent. |
| Rating on TrustRadius | No overall score because there are not enough ratings, from 1 review | 8.7 out of 10 from 6 reviews, but the page identifies this as a contract and vendor-management SaaS product rather than OPA Gatekeeper. |
| Validation | Validation rules can block noncompliant resources in Enforce mode or record violations in Audit mode. | Validation policies can deny, warn, dry-run, audit, or report violations without modifying resources. |
| What it does | Kyverno is a cloud-native policy engine for automating Kubernetes security, compliance, governance and best-practice checks. | Gatekeeper is a Kubernetes policy controller that enforces policy during admission and can audit running resources. |
Plans
Open Policy Agent Gatekeeper
- GatekeeperFree
- Open-source GatekeeperFree
In their own words
Kyverno
Kyverno is a free, open-source policy engine for defining and enforcing policy as code in Kubernetes. Its stable policy types can validate, mutate, generate or delete resources, and verify container image signatures and attestations. The Kyverno CLI can test policies against Kubernetes resource manifests in CI before they are applied to a live cluster. Documentation describes use with Helm, YAML manifests, GitHub Actions and GitOps tools such as ArgoCD. Kyverno is installed in a Kubernetes cluster; Helm is recommended for production, and YAML manifests are also available. A standard installation requires an admission controller, while background, reports and cleanup controllers are optional. Production installations should use high availability mode. The project supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission. Its webhooks default to fail-closed, so matching requests can fail if the API server cannot reach Kyverno. The project documents Cosign signatures for images and manifests, and lists CLI binaries for Linux, macOS and Windows.
Open Policy Agent Gatekeeper
Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.