Datree is a policy enforcement framework for Kubernetes that validates configurations against rules written in Rego, JSON Schema, or CEL. It operates as both a command-line tool for pre-deployment scanning and as a cluster-side admission webhook for real-time enforcement, integrating with CI/CD pipelines and continuous delivery tools like ArgoCD and FluxCD.
The framework supports namespace-scoped policy mapping, allowing different policies to apply to different namespaces, and provides a skip annotation mechanism for selectively bypassing rules on individual resources or entire namespaces. It includes a management dashboard for monitoring policy compliance, tracking check history, and displaying resource violations with remediation steps, along with a cluster health scoring system.
Datree enforces a wide range of Kubernetes best practices, including container resource limits and requests, liveness and readiness probes, pinned image versions, security contexts, and minimum replica counts. It also validates CronJob schedules and deadlines, HorizontalPodAutoscaler configurations, and resource labels, while supporting custom rule authoring through Rego, JSON Schema, or CEL.