Kubernetes 策略执行引擎
For Kubernetes Policy-as-Code 引擎, the strongest matches are kyverno/kyverno (Kyverno is a Kubernetes-native policy engine that validates, mutates), datreeio/datree (Datree is a Kubernetes policy enforcement framework that validates) and open-policy-agent/gatekeeper (Gatekeeper is a policy controller for Kubernetes that enforces). kubescape/kubescape and sigstore/policy-controller round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
用于在 Kubernetes 集群资源中验证并强制执行安全或合规性策略的自动化工具。
Kubernetes 策略执行引擎
用 AI 发现最棒的仓库。我们将通过 AI 为您搜索最匹配的仓库。
- kyverno/kyverno
kyverno/kyverno
7,841在 GitHub 上查看Kyverno is a Kubernetes policy engine and cloud native governance tool. It functions as a policy-as-code framework that validates, mutates, and generates resources to enforce security and governance standards within a cluster. The project distinguishes itself through a declarative policy model that utilizes native Kubernetes custom resource definitions, allowing policies to be managed as standard cluster objects without custom code. It provides specific security capabilities for container image verification and signature validation to ensure only trusted images are deployed. Its broader capa
Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates resources via admission control, using declarative policy-as-code with Custom Resource Definitions — it directly meets the search for a Kubernetes policy engine with support for enforcement, mutation, and compliance features.
GoPolicy-As-Code Engines - datreeio/datree
datreeio/datree
6,339在 GitHub 上查看Datree is a policy enforcement framework for Kubernetes that validates configurations against rules written in Rego, JSON Schema, or CEL. It operates as both a command-line tool for pre-deployment scanning and as a cluster-side admission webhook for real-time enforcement, integrating with CI/CD pipelines and continuous delivery tools like ArgoCD and FluxCD. The framework supports namespace-scoped policy mapping, allowing different policies to apply to different namespaces, and provides a skip annotation mechanism for selectively bypassing rules on individual resources or entire namespaces. It
Datree is a Kubernetes policy enforcement framework that validates resource configurations via admission webhooks and CLI scanning using Rego, CEL, or JSON Schema, fitting the policy-engine category, though it lacks mutation support and explicit constraint template constructs.
GoPolicy-As-Code EnginesRego Rule AuthorsAdmission Webhooks - open-policy-agent/gatekeeper
open-policy-agent/gatekeeper
4,228在 GitHub 上查看Gatekeeper is a Kubernetes admission control and policy enforcement engine used to ensure cluster resources comply with organizational security and configuration standards. It intercepts API requests to validate or reject non-compliant resources before they are persisted in the cluster. The project uses a parameterized policy library and custom resource definitions to create reusable templates and enforcement rules. It distinguishes itself through a hub-and-spoke management model, allowing a controller in a management cluster to enforce policies across separate target clusters. Beyond admiss
Gatekeeper is a policy controller for Kubernetes that enforces OPA-based policies via admission control, supports constraint templates, audit, and mutation, making it a comprehensive solution for your search.
GoKubernetes Resource ValidationAdmission WebhooksKubernetes Admission Webhook Filters - kubescape/kubescape
kubescape/kubescape
11,489在 GitHub 上查看Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance risks. It functions as a comprehensive security suite incorporating a compliance scanner, a container image vulnerability scanner, an admission controller for policy enforcement, and a runtime security monitor. The platform distinguishes itself through runtime-aware vulnerability filtering, which maps libraries loaded in memory to determine if vulnerabilities are actually reachable. It also integrates with AI assistants via a Mo
Kubescape includes an admission controller for policy enforcement and compliance scanning, so it can define and enforce governance policies on Kubernetes, though its broader security‑posture scope goes beyond a dedicated policy engine.
GoAdmission Webhooks - sigstore/policy-controller
sigstore/policy-controller
175在 GitHub 上查看Sigstore Policy Controller - an admission controller that can be used to enforce policy on a Kubernetes cluster based on verifiable supply-chain metadata from cosign
Sigstore Policy Controller is an admission controller that enforces policy on Kubernetes clusters using verifiable supply-chain metadata from cosign, making it a valid but specialized Kubernetes policy engine focused on image supply-chain security rather than general governance.
GoImage Scanning and SBOM
