Side by side
Kyverno vs Open Policy Agent Gatekeeper
Both stand on cloud governance software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxMac+3
Kyverno combines in-cluster policy enforcement with CLI testing and several policy actions. Teams should account for its required admission controller, production availability guidance, and fail-closed webhook behavior.
Visit Kyverno
Free plan Open source APILinuxSelf-hosted
Gatekeeper combines admission policy controls with recurring audits and customizable policy examples. Installation permissions and audit reporting limits are important operational considerations.
Visit Open Policy Agent GatekeeperThe facts
| Kyverno | Open Policy Agent Gatekeeper | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 2 | 2 |
| Maker | Not published | Not published |
| Website | kyverno.io | open-policy-agent.github.io |
| On cloud governance software | #1 of 26 | #2 of 26 |
Kyverno: what it does well
- Validates, mutates, generates, and deletes resources
- Verifies container image signatures and attestations
- CLI tests policies against manifests in CI
- Works with Helm, GitHub Actions, and GitOps tools
- Free and open source
What to know first
- Requires installation in a Kubernetes cluster
- Production deployments should use high availability mode
- Fail-closed webhooks can block matching requests if unreachable
- Legacy policy types are scheduled for removal
Open Policy Agent Gatekeeper: what it does well
- Validation supports deny, warn, dry-run and report modes.
- Mutation policies change resources before validation.
- Periodic audits check existing cluster resources.
- Several installation options are documented.
What to know first
- Installation requires cluster-admin permissions.
- Kubernetes resources from version 1.16 are required.
- Audit reports at most 20 violations by default.
Alternatives to Kyverno Alternatives to Open Policy Agent Gatekeeper The whole list