What is Kyverno and how does it differ from OPA Gatekeeper?

Question

Accepted Answer

**Kyverno** — policy engine for Kubernetes, written in Go (not Rego like OPA).

**Comparison with OPA Gatekeeper:**
| Criterion | Kyverno | OPA Gatekeeper |
|---------|---------|----------------|
| Language | YAML | Rego |
| Simplicity | Simpler | More complex |
| Mutate | Yes | No |
| Verify Images | Yes | No |
| Generate | Yes | No |

**Example (require labels):**
```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-team-label
      match:
        any:
          - resources:
              kinds: ["Deployment", "StatefulSet"]
      validate:
        message: "Label "team" is required"
        pattern:
          metadata:
            labels:
              team: "?*"
```

**Mutate (automatic label addition):**
```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-labels
spec:
  rules:
    - name: add-team
      match:
        any:
          - resources:
              kinds: ["Deployment"]
      mutate:
        patchStrategicMerge:
          metadata:
            labels:
              environment: production
```

**Verify Images (Cosign):**
```yaml
verifyImages:
  - imageReferences: ["ghcr.io/myorg/*"]
    attestors:
      - entries:
          - keys:
              publicKeys: "-----BEGIN PUBLIC KEY-----..."
```

**Choice:** Kyverno for Kubernetes-centric policies. OPA for multi-platform (API, infra, K8s).

DevOps: What is Kyverno and how does it differ from OPA Gatekeeper?