# Kyverno To Gatekeeper Translator

> Translates Kyverno policies to OPA Gatekeeper ConstraintTemplates and Constraints with RHACM PolicyGenerator output.

- Skill: `redhat-et/kyverno-to-gatekeeper-translator` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add redhat-et/kyverno-to-gatekeeper-translator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/redhat-et/kyverno-to-gatekeeper-translator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: redhat-et (https://skillmd.com/u/redhat-et)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/redhat-et/kyverno-to-gatekeeper-translator

---


# Kyverno to Gatekeeper Translator

## Workflow

```
INPUT → Parse → Feasibility Check → Generate Rego → Validate → Output Files
```

### Step 1: Receive Policy
Accept via: paste YAML, file path, or URL (use WebFetch).

### Step 2: Check Feasibility

| Kyverno Type | Gatekeeper Support | Action |
|--------------|-------------------|--------|
| `validate.pattern` | Full | Translate |
| `validate.deny` | Full | Translate |
| `validate.foreach` | Full | Translate |
| `validate.anyPattern` | Full | Translate |
| `validate.cel` | Partial | Recommend VAP |
| `mutate.*` | Alpha | Keep Kyverno |
| `generate` | None | Cannot translate |
| `verifyImages` | None | Use Sigstore |

If unsupported features exist, inform user and ask to proceed with supported parts.

See: `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` for translation patterns.

### Step 3: Generate & Validate Rego

```bash
mkdir -p /tmp/claude
# Write policy.rego and input.json
opa eval -d /tmp/claude/policy.rego -i /tmp/claude/input.json "data.{package}.violation" --format pretty
```

Fix errors and re-validate until passing. Show user the translated Rego.

### Step 4: Create Output

```bash
TRACE_ID=$(python3 skills/kyverno-to-gatekeeper-translator/scripts/get_trace_id.py 2>/dev/null || echo "no-trace")
OUTPUT_DIR="skills/kyverno-to-gatekeeper-translator/assets/${TRACE_ID}"
mkdir -p ${OUTPUT_DIR}/{constraint-templates,constraints,original-kyverno}
```

Generate files using templates from `references/TEMPLATES.md`:
- `original-kyverno/{name}.yaml`
- `constraint-templates/{name}-template.yaml`
- `constraints/{name}.yaml`
- `policyGenerator.yaml`
- `kustomization.yaml`
- `TRANSLATION_REPORT.md`

### Step 5: Summary

```
Output: skills/kyverno-to-gatekeeper-translator/assets/{TRACE_ID}/

Deploy directly:
  kubectl apply -f constraint-templates/ && kubectl apply -f constraints/

Deploy via RHACM:
  kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f -
```

## Key Mappings

| Kyverno | Gatekeeper |
|---------|------------|
| `validationFailureAction: Audit` | `enforcementAction: dryrun` |
| `validationFailureAction: Enforce` | `enforcementAction: deny` |
| `{{request.object.*}}` | `input.review.object.*` |
| `exclude.namespaces` | `spec.match.excludedNamespaces` |

## References

- `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` - Translation patterns & operators
- `references/TEMPLATES.md` - Output file templates
- `references/COMMON_POLICY_TRANSLATIONS.md` - Complete examples