kiosk VS jspolicy

Kiosk

Have a look at https://github.com/loft-sh/kiosk and maybe the paid version https://loft.sh/

As for the open source projects, maybe you would find Kiosk for allowing self-service namespace creation, namespace templates and cross-namespace resource limits and quotas.

# Install kiosk with helm v3 ❯ kubectl create namespace kiosk helm install kiosk --repo https://charts.devspace.sh/ kiosk --namespace kiosk --atomic namespace/kiosk created NAME: kiosk ... Learn more about using kiosk here: https://github.com/loft-sh/kiosk#getting-started #verify ❯ kubectl get pod -n kiosk NAME READY STATUS RESTARTS AGE kiosk-66dbfcf6db-5rfx2 1/1 Running 0 2m18s

Kubernetes was designed as a single-tenant platform. Sharing clusters, though, offers greater flexibility, simplifies infrastructure, and improves cost-efficiency. Therefore, it makes sense to use a multi-tenant system. To keep tenants separate and prevent compromised tenants from affecting others, you can use role-based access control (RBAC) or namespaces. Tools that assist with multi-tenancy in Kubernetes include kiosk and loft.

For simple environments I'm using klum, for bigger environments I'm using OIDC with Keycloak. Beside that kiosk also looks interesting.

https://github.com/loft-sh/kiosk (from makers of loft)

I struggled with understanding OPA too! I have not seen this mentioned, but one straightforward alternative is JSPolicy (https://www.jspolicy.com/), which allows you to write policies in Javascript or Typescript. It is really easy to understand and get started.

You will likely want to implement certain restrictions, limits, quotas, or security policies for your Kubernetes clusters. This could help with auditing or monitoring tasks, or with standardizing a quota for certain resources. Tools like the Open Policy Agent (OPA), jsPolicy, or Kyverno can be used based on your needs. Many developers are more comfortable with YAML or JavaScript, so Kyverno or jsPolicy might be preferred.

In 2021 we also released two new open source projects: vcluster, a tool for creating and using virtual Kubernetes clusters, and jsPolicy, a tool for writing policies for Kubernetes clusters in JavaScript or TypeScript. vcluster especially gained a lot of traction and our CEO Lukas Gentele gave a talk about it at KubeCon Los Angeles.

Either engine could be a good choice for your business. Consider which factors are most relevant to your project and your use case before you make a decision. You can learn more about jsPolicy here and about OPA here.

Loft Labs is the creator of several popular open-source projects in the cloud-native technology space, including the Kubernetes developer tool DevSpace, the certified Kubernetes distribution vcluster, and the policy engine jsPolicy. The company’s commercial product, Loft, enables any organization to scale self-service access to Kubernetes to hundreds or even thousands of engineers. Loft's customers span from fast-growing startups Gusto, Urbint, and HqO to well-established Fortune 500 companies that include one of the largest U.S. financial institutions and one of the world’s largest car manufacturers.

Loft Labs also recently released vcluster, a first-of-its-kind virtual cluster technology for Kubernetes. jsPolicy now available at www.jspolicy.com and on Github.

Would you mind explaining why is it hard for admission controllers to check container definitions of the pod? I've never used OPA or Kyverno, but I want to start contributing to a competitor project, so I am really curious to find out. Thank you! :)

This makes sense and I made the assumption that someone thought about the root-ability thing after I saw loft-sh/jspolicy.