Creating policies without Rego
Rego is a very powerful way to build complex policies that are then implemented by the GateKeeper project. That power comes with a steep learning curve and complexity. It may not be the right choice for you or your clusters. It isn’t the only way to implement an admission controller. We’re not going to go into too many details, as these other projects all have their own capabilities that are worth exploring and I won’t be able to do them justice in one section.
The two most common alternatives to GateKeeper are:
- Kyverno: Kverno is a specialized policy engine for Kubernetes. It’s not designed as a generic authorization engine the way OPA is so it can make assumptions that provide a simpler experience for building Kubernetes policies (https://kyverno.io/).
- jsPolicy: The jsPolicy project allows you to build your policies in JavaScript or TypeScript instead of a domain-specific language (DSL) like Rego. The...
