helm-datree VS kubectl-datree

This plugin is used to check charts against Datree policy. The mentioned plugin can be installed using the command:

$ helm plugin install https://github.com/datreeio/helm-datree Installing helm-datree... https://github.com/datreeio/datree/releases/download/1.0.6/datree-cli_1.0.6_Darwin_x86_64.zip % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 673 100 673 0 0 1439 0 --:--:-- --:--:-- --:--:-- 1469 100 6901k 100 6901k 0 0 1852k 0 0:00:03 0:00:03 --:--:-- 2865k helm-datree is installed. See https://hub.datree.io for help getting started. Installed plugin: datree

In this post, I will show you how to use Datree step by step, starting with installing the tool and then verifying the Kubernetes manifest file. (If you need to check your helm charts instead, this can easily be done with the Datree Helm plugin.)

helm plugin install https://github.com/datreeio/helm-datree

steps: - name: Checkout 🛎️ uses: actions/checkout@v2 - name: Install Datree 🔨 run: | helm plugin install https://github.com/datreeio/helm-datree - name: Datree test 🔥 env: DATREE_TOKEN: ${{ secrets.DATREE_TOKEN }} run: | helm datree test ./helm/app -- --values ./helm/adminer.yaml

$ kubectl krew install datree Updated the local copy of plugin index. Installing plugin: datree Installed plugin: datree \ | Use this plugin: | kubectl datree | Documentation: | https://github.com/datreeio/kubectl-datree | Caveats: | \ | | Before using this plugin, the Datree CLI needs to be installed. | | See https://hub.datree.io/ for quick and easy installation. | / /

I worked with both of them and from my experience Gatekeeper is more solid and accountable, I even wrote an article about Gatekeeper. Both Gatekeeper and Kyverno require a lot of heavy lifting work. On the one hand, Gatekeeper will probably require more configuration work however the community and the tool itself are more stable than Kyverno. On the other hand, Kyverno policy-as-code capabilities are much easier to use/understand. This way or another, for me using Kyverno’s policy language or Rego for my policies, wasn’t such a pleasant experience. I personally believe in GitOps and shifting left so if you’re looking for tools I would highly recommend you to review Datree, which is an open-source CLI (Disclaimer: I’m one of the developers at Datree). Datree is a more centralized policy management solution rather than a policy engine. Unlike Kyverno/Gatekeeper Datree was built to help DevOps teams to shift left and practice GitOps by delegating more responsibilities to the developers more efficiently. In practice, Datree already comes with built-in rules and policies along with YAML and schema validation for K8s resources and CRDs such as Argo CRDs. Datree’s policies are written in JSONScheme which is a common solid policy language supported by the community for many years. Additionally, Datree’s CLI also comes with a dashboard app where you can monitor the policies in your organization. You can modify and update your policies, review which policies are being used in practice, and control who can create/delete/update your policies. The major difference is that at the moment, unlike Kyverno/Gatekeeper Datree doesn’t provide native policy enforcement in the Kubernetes cluster at the moment but we expect to release this support very soon. At the moment, we provide a way to scan the cluster using a kubectl plugin. Feel free to check it out :)