Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production • Hacker News Board

Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production

#41

Post by mr_moose » Wed, Oct 20, 2021, 6:36 AM UTC

As someone who works in a similar space (K8s configuration management and IaC), I'm curious what drove you to develop a CLI tool for enforcing policies as opposed to something that is able to integrate with K8s more closely such as OPA Gatekeeper or Kyverno?

As I understand, the primary users of policy tools are platform teams, infrastructure teams, or some other entity who needs to able to create, manage, and enforce policies over domains that they're responsible for.

When I look at Datree from the POV of a platform team, I see a tool that I must trust dev teams to use to enforce policies.

Yes, I can hide my K8s cluster behind a CI/CD pipeline that runs Datree, but this is limiting for organizations that actually want to let its dev teams access its K8s clusters directly or run workloads that themselves can create K8s resources (e.g. operators).

By contrast, OPA Gatekeeper or Kyverno do not have such limitations because they allow policies to be enforced at the cluster itself.

Both also allow platform teams to create new policies and detect if there are any K8s resources _already_ in the cluster that are in violation of the new policies (i.e. Day 2 operations).

Lastly, both even offer CLI tools for dev teams to use to detect issues earlier during development.

I would argue though that dev teams are actually secondary to platform teams in terms of who to focus on when building policy tools since platform teams usually have more of an interest/responsibility in enforcing policies and therefore more of a say in what policy tools to adopt for an organization.

Hence, I was curious why you started with a CLI tool which seems to be more of a dev-centric approach rather than platform-centric.

Also, more specifically, what makes Datree a better option over OPA Gatekeeper or Kyverno?

Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production

#42

Post by shimont » Wed, Oct 20, 2021, 9:42 AM UTC

mr_moose wrote: post #41

As someone who works in a similar space (K8s configuration management and IaC), I'm curious what drove you to develop a CLI tool for enforcing policies as opposed to something that is able to integrate with K8s more closely such as OPA Gatekeeper or Kyverno? As I understand, the primary users of policy tools are platform teams, infrastructure teams, or some other entity who needs to able to create, manage, and enforc…

Hey, this is a great question.

We are big believers in "shift-left" and trying to fix/avoid issues as early as possible. We started with a CLI tool as it is agnostic and can be run in the devs IDE like VSCODE, in the terminal and finally in the CI/CD process.

We love OPA and think that GateKeeper is a good solution, but we want to provide feedback as early as possible. While Gatekeeper will block a deployment to the Kubernetes cluster at the end of the development process.

As a developer myself I would rather be notified for an issue as early as possible and not find our about it in the very last second before it goes live to production.

We might add support similar to GateKeeper in the future, but we wanted to be shift-left first :)

I hope this answers your question Thank you

Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production

#43

Post by shimont » Wed, Oct 20, 2021, 9:46 AM UTC

bobbiechen wrote: post #38

Looks like this is a policy-as-code tool in the vein of Terraform Cloud's Sentinel Policies, or more generally Open Policy Agent, but specifically targeted at k8s use cases. From the custom rules overview https://hub.datree.io/custom-rules-overview , though it is docs WIP, I noticed these are defined as YAML/JSON somehow. That's a contrast to HashiCorp's Sentinel https://docs.hashicorp.com/sentinel/concepts/language…

We just released support for custom rules :) from interviewing our users, we decided to start with [0] JSON Schema as it is very easy to write rules using it and you do not have to learn rego.

Having said that, we might add OPA .rego support in the near future :)

What is the desired way for you to write custom policy rules?

[0] - https://json-schema.org/

Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production

#44

Post by shimont » Wed, Oct 20, 2021, 9:48 AM UTC

verchol wrote: post #33

K8s manifest are yamls that translated to tens of K8s actions that change production environment .Misconfigurtions that can be prevented by integrating datree cli into CI/CD cycle can save hours of production unreliability. For me it's must have phase in K8s release flow.

Thank you Varchol :) Also you can use Helm which might help on top of Kubernetes manifests