Policy Engines for Kubernetes: Picking One Without Losing Your Mind - Nabarun Pal, Broadcom

This talk covers the complexities of enforcing Kubernetes policies, highlighting the challenges that arise beyond initial implementation. The speaker, Nabarun Pal from Broadcom, explores prominent options including native Validating/Mutating Admission Policies, Kyverno, OPA/Gatekeeper, and Kubewarden, discussing their pros and cons along with the trade-offs involved. Key topics include the requirements for custom knowledge such as Common Expression Language (CEL) for native policies, the simplicity of using YAML in Kyverno, the flexibility of OPA with Rego, and the innovative use of WebAssembly in Kubewarden. The session also examines performance at scale, emphasizing the importance of managing overhead in large deployments, and shares real-world lessons from production environments to help attendees select the most suitable policy engine for their needs.