jspolicy VS datree

I struggled with understanding OPA too! I have not seen this mentioned, but one straightforward alternative is JSPolicy (https://www.jspolicy.com/), which allows you to write policies in Javascript or Typescript. It is really easy to understand and get started.

You will likely want to implement certain restrictions, limits, quotas, or security policies for your Kubernetes clusters. This could help with auditing or monitoring tasks, or with standardizing a quota for certain resources. Tools like the Open Policy Agent (OPA), jsPolicy, or Kyverno can be used based on your needs. Many developers are more comfortable with YAML or JavaScript, so Kyverno or jsPolicy might be preferred.

In 2021 we also released two new open source projects: vcluster, a tool for creating and using virtual Kubernetes clusters, and jsPolicy, a tool for writing policies for Kubernetes clusters in JavaScript or TypeScript. vcluster especially gained a lot of traction and our CEO Lukas Gentele gave a talk about it at KubeCon Los Angeles.

Either engine could be a good choice for your business. Consider which factors are most relevant to your project and your use case before you make a decision. You can learn more about jsPolicy here and about OPA here.

Loft Labs is the creator of several popular open-source projects in the cloud-native technology space, including the Kubernetes developer tool DevSpace, the certified Kubernetes distribution vcluster, and the policy engine jsPolicy. The company’s commercial product, Loft, enables any organization to scale self-service access to Kubernetes to hundreds or even thousands of engineers. Loft's customers span from fast-growing startups Gusto, Urbint, and HqO to well-established Fortune 500 companies that include one of the largest U.S. financial institutions and one of the world’s largest car manufacturers.

Loft Labs also recently released vcluster, a first-of-its-kind virtual cluster technology for Kubernetes. jsPolicy now available at www.jspolicy.com and on Github.

Would you mind explaining why is it hard for admission controllers to check container definitions of the pod? I've never used OPA or Kyverno, but I want to start contributing to a competitor project, so I am really curious to find out. Thank you! :)

This makes sense and I made the assumption that someone thought about the root-ability thing after I saw loft-sh/jspolicy.

Hi HN, I’m Shimon, the co-founder of Datree: A policy management solution for Kubernetes. We help DevOps engineers prevent misconfigurations in their Kubernetes by enforcing an organizational policy on their clusters. Engineers can define a custom policy or use one of Datree’s built-in policies, such as NIST/NSA Hardening Guide, EKS Security Best Practices, CIS Benchmark, and more.

Our website is at https://datree.io and our GitHub is here: https://github.com/datreeio/datree

This is not the first time I have shown Datree to the HN community: A little over a year ago, I posted here an earlier version of Datree (https://news.ycombinator.com/item?id=28918850). At that time, Datree consisted of a CLI tool to detect Kubernetes misconfigurations during the development process (locally or in the CI/CD), unlike the version I present today in which the enforcement happens in production.

We built the CLI tool because we detected a big problem among Kubernetes operators: Misconfigurations. Kubernetes is extremely complex and flexible, which makes it very easy to poorly configure it in ways that are not secure. And indeed, we talked to dozens of Kubernetes operators who suffered from various problems, starting with failed audits, all the way to downtime in production, all because of misconfigurations.

Our solution was simple: Give the developers the means to shift-left security testing during the development process with a CLI tool that can be integrated into the CI/CD. We thought this was the best way to approach the problem: It is easiest to fix misconfigurations in the development process before they are deployed to production, it prevents context-switching and relieves resources from the DevOps team.

While the CLI tool was very popular among the open-source community (it got over 6000 stars on GitHub), we soon realized that CI/CD enforcement is not enough. As we talked with Datree’s users, we realized we had made a fundamental mistake: We thought of misconfiguration prevention in technical terms rather than organizational terms.

Indeed, from a technical point of view, it makes sense to shift-left Kubernetes security. But when considering the organizational structure in which it takes place, it simply isn’t enough. DevOps engineers told us that they love the shift-left concept, but they simply cannot rely on the goodwill of the engineers to run a CLI tool locally or to monitor all the pipelines leading to production. They need governance, something to help them stay in control of the state of their clusters.

Moreover, we realized that many companies who use Kubernetes are heavily regulated, and cannot take any chances with their security. Sure, these companies want the engineers to fix misconfigurations during development, but they also want something to make sure that no matter what, their clusters remain misconfiguration-free.

Based on this understanding, we developed a new version of Datree that sits on the cluster itself (rather than in the CI/CD) and protects the production environment by blocking misconfigured resources with an admission webhook. It has a centralized policy management solution to enable governance, and native monitoring to get real-time insights into the state of your Kubernetes.

I look forward to hearing your feedback and answering any questions you may have.

Go is a statically typed, compiled programming language designed at Google, it is syntactically similar to C, but with memory safety, garbage collection, structural typing, and CSP-style concurrency. In my case, I needed to run Go for JSON schema validations, in other cases, you might want to perform a CPU-intensive task or use a CLI tool written in Go.

I worked with both of them and from my experience Gatekeeper is more solid and accountable, I even wrote an article about Gatekeeper. Both Gatekeeper and Kyverno require a lot of heavy lifting work. On the one hand, Gatekeeper will probably require more configuration work however the community and the tool itself are more stable than Kyverno. On the other hand, Kyverno policy-as-code capabilities are much easier to use/understand. This way or another, for me using Kyverno’s policy language or Rego for my policies, wasn’t such a pleasant experience. I personally believe in GitOps and shifting left so if you’re looking for tools I would highly recommend you to review Datree, which is an open-source CLI (Disclaimer: I’m one of the developers at Datree). Datree is a more centralized policy management solution rather than a policy engine. Unlike Kyverno/Gatekeeper Datree was built to help DevOps teams to shift left and practice GitOps by delegating more responsibilities to the developers more efficiently. In practice, Datree already comes with built-in rules and policies along with YAML and schema validation for K8s resources and CRDs such as Argo CRDs. Datree’s policies are written in JSONScheme which is a common solid policy language supported by the community for many years. Additionally, Datree’s CLI also comes with a dashboard app where you can monitor the policies in your organization. You can modify and update your policies, review which policies are being used in practice, and control who can create/delete/update your policies. The major difference is that at the moment, unlike Kyverno/Gatekeeper Datree doesn’t provide native policy enforcement in the Kubernetes cluster at the moment but we expect to release this support very soon. At the moment, we provide a way to scan the cluster using a kubectl plugin. Feel free to check it out :)

$ helm plugin install https://github.com/datreeio/helm-datree Installing helm-datree... https://github.com/datreeio/datree/releases/download/1.0.6/datree-cli_1.0.6_Darwin_x86_64.zip % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 673 100 673 0 0 1439 0 --:--:-- --:--:-- --:--:-- 1469 100 6901k 100 6901k 0 0 1852k 0 0:00:03 0:00:03 --:--:-- 2865k helm-datree is installed. See https://hub.datree.io for help getting started. Installed plugin: datree

GitHub