description Open Policy Agent Gatekeeper Overview
Open Policy Agent Gatekeeper is a Kubernetes admission controller that secures container deployments. It uses Open Policy Agent (OPA), a general-purpose policy engine, to evaluate requests against Rego rules. This ensures infrastructure configurations align with organizational security and operational standards. Gatekeeper is valuable for teams managing complex Kubernetes environments needing automated policy enforcement and compliance verification.
help Open Policy Agent Gatekeeper FAQ
What is the difference between a Gatekeeper ConstraintTemplate and a Constraint?
A ConstraintTemplate defines the policy logic and creates a new Kubernetes constraint kind. A Constraint instantiates that template with parameters and selects which cluster resources the rule applies to.
Can Gatekeeper check resources that already exist in a Kubernetes cluster?
Yes, its audit process evaluates existing resources and reports policy violations even when they were admitted before a constraint was installed. Admission enforcement separately evaluates new create and update requests.
Can a Gatekeeper policy warn users without rejecting a deployment?
Yes, enforcement actions can be configured to report or warn about violations instead of denying the request. This supports a staged rollout before a policy begins blocking Kubernetes changes.
How does Gatekeeper differ from using OPA directly?
OPA is a general-purpose policy engine used across many kinds of software. Gatekeeper packages OPA for Kubernetes admission and audit, adding Kubernetes custom resources such as ConstraintTemplates and Constraints.
explore Explore More
Similar to Open Policy Agent Gatekeeper
See all arrow_forward
Reviews & Comments
Write a Review
Be the first to review
Share your thoughts with the community and help others make better decisions.
