How does GitOps handle Policy-as-Code for compliance and governance in 2024?

All answers to this question.

For a GitOps-native experience, Kyverno is usually the winner because its policies are written in standard Kubernetes YAML, whereas OPA requires learning the Rego language. To catch violations "pre-sync," you should integrate a policy-checking tool into your CI pipeline (the "Shift-Left" approach). Tools like Linter or Kyverno CLI can scan your Git repository every time a PR is opened. If a developer tries to commit a manifest that runs as root, the CI build fails and the PR can't be merged. This way, your GitOps controller only ever sees "clean" and compliant code, preventing sync loops.

   Answered 2024-11-13 by Nancy Harris

Are you more concerned about preventing the deployment of bad configs, or do you also need to audit the current state of the clusters for compliance?

   Answered 2024-11-15 by James Miller

• We need both. We need the "Prevention" at the PR stage, but we also need a report for our auditors showing that no non-compliant pods are currently running. Does Kyverno provide a dashboard or a way to export these "Policy Reports" into a format that a non-technical compliance officer can understand?

     Commented 2024-11-17 by Joseph Rodriguez

We use OPA Gatekeeper because of its "Admission Controller" capabilities. It physically blocks any API request that violates our rules, even if it comes from the GitOps agent.

   Answered 2024-11-19 by Karen Walker

• Gatekeeper is powerful, but be careful. If Gatekeeper blocks the GitOps agent, you end up with a permanent "Out of Sync" status in your dashboard.

     Commented 2024-11-20 by Elizabeth Clark