Two more names worth knowing: Kyverno and kube-bench.

One is an alternative to the OPA/Gatekeeper admission control from the last slide. The other audits your cluster the same way this module's Trivy scan did — against a named standard.

Kyverno — policy in plain YAML

Gatekeeper needs a separate Rego language and a ConstraintTemplate CRD. Kyverno's ClusterPolicy reads like the Kubernetes resources it checks — no new language.

Its real edge: validate, mutate, and generate live in one resource — it can auto-inject a missing resource limit instead of only rejecting the deploy.

kube-bench — the CIS Kubernetes Benchmark

Audits the control plane, nodes, and cluster policy against a named industry standard — the same discipline as Docker Bench, one module ago, applied to Kubernetes itself.

On a self-managed cluster: you own every control-plane finding. On EKS/GKE/AKS: the cloud provider runs that control plane — those specific checks are the provider's job (back to Module 1's shared responsibility model).

Pick Kyverno when the job is fast, YAML-native Kubernetes policy; keep Gatekeeper/Rego when the same policy logic needs to reach Terraform or a raw API too (Module 1's "security as code").