kube-mgmt | Sidecar for managing OPA on top of Kubernetes | Continuous Deployment library

In Open Policy Agent (https://www.openpolicyagent.org/)

regarding to Kubernetes, depending which engine is used:

• Gatekeeper: https://github.com/open-policy-agent/gatekeeper

OR

• Plain OPA with kube-mgmt: https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/#how-does-it-work-with-plain-opa-and-kube-mgmt

There are different ways to define validation rules:

• In Gatekeeper the violation is used. See sample rules here: https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/general

• In plain OPA samples, the deny rule, see sample here: https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/#how-does-it-work-with-plain-opa-and-kube-mgmt

It seems to be the OPA constraint framework defines it as violation: https://github.com/open-policy-agent/frameworks/tree/master/constraint#rule-schema

So what is the exact "story" behind this, why it is not consistent between the different engines?

Notes:

• This doc reflects on this: https://www.openshift.com/blog/better-kubernetes-security-with-open-policy-agent-opa-part-2

• Here is mentioned how to support interoperability in the script: https://github.com/open-policy-agent/gatekeeper/issues/1168#issuecomment-794759747

• https://github.com/open-policy-agent/gatekeeper/issues/168 In this issue is the migration mentioned, is just because of "dry run" support?.