OPA vs Kyverno in 2026: Kubernetes Ships Policy Now

Kubernetes now enforces policy in-process: ValidatingAdmissionPolicy went stable in 1.30, MutatingAdmissionPolicy in 1.36. So the real question is no longer OPA or Kyverno — it's what you still need a controller for.