- Home
- Kubernetes Security Software
- Open Policy Agent Gatekeeper
Open Policy Agent Gatekeeper
What it is
Open Policy Agent Gatekeeper is a free, self-hosted Kubernetes webhook for enforcing policies defined through custom resources and evaluated by Open Policy Agent. It can validate incoming resources by denying them, issuing warnings, running checks in dry-run mode, or reporting violations without changing the resources. Mutation policies can modify matching resources during admission, before validation checks the final object. Gatekeeper also periodically checks resources already in a cluster against constraints to identify earlier misconfigurations. Its policy library includes parameterized examples that users can extend, and provider-based connections can bring in external data from sources such as image registries and directory services. The project names integrations or backed services including Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud. Installation options include prebuilt, development, or locally built images, as well as Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. It is free under the Apache-2.0 license.
For and against
For
- Validation can deny, warn, dry-run, or report violations.
- Mutation policies can change resources before validation.
- Audits check existing cluster resources periodically.
- Parameterized sample policies can be extended.
- Free under the Apache-2.0 license.
Against
- Installation requires cluster-admin permissions.
- Requires Kubernetes resources introduced in version 1.16.
- gator CLI is documented as beta from version 3.11.
- Audit reports at most 20 violations by default.
The verdict
Gatekeeper combines admission-time policy enforcement with periodic checks of resources already in a cluster. Consider the Kubernetes version and installation permissions before adopting it.
Who it suits
Gatekeeper suits teams managing Kubernetes clusters that need policy checks during admission and periodic audits of existing resources. Its self-hosted deployment requires cluster-admin installation permissions.
Plans and prices
Open-source Gatekeeper
Kubernetes policy controller · self-hosted deployment · Apache-2.0 licence
Read 15 Oct 2026 · github.com
Gatekeeper
Open source Kubernetes policy controller · Apache-2.0 license
Read 8 Oct 2026 · github.com
On the record
- API and extensibility
- The documentation exposes an API reference and describes Kubernetes CRDs, runtime flags, mutators, external-data providers, and generated ValidatingAdmissionPolicies as extension points.open-policy-agent.github.io · read 15 Oct 2026
- Audit
- The audit operation periodically scans existing cluster objects and writes discovered violations to constraint status.open-policy-agent.github.io · read 15 Oct 2026
- Audit limit
- Constraint status reports at most 20 individual violations by default, configurable with a runtime flag; the documentation notes Kubernetes object-size and memory limits.open-policy-agent.github.io · read 8 Oct 2026
- Build security
- Each image has build attestations, an SBOM, and SLSA provenance; attestations are available for releases starting with v3.12.0.open-policy-agent.github.io · read 15 Oct 2026
- CLI
- The project documents the gator command-line interface for validating workload resources and policies.open-policy-agent.github.io · read 15 Oct 2026
- Cloud integrations
- The official site lists Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud Kubernetes as integrations or backed services.open-policy-agent.github.io · read 15 Oct 2026
- Community support
- The project site links to a Gatekeeper Slack channel and community meetings.open-policy-agent.github.io · read 8 Oct 2026
- Constraints
- Constraint resources instantiate templates with matching rules and parameters for selected Kubernetes objects.open-policy-agent.github.io · read 15 Oct 2026
- Constraint templates
- ConstraintTemplate resources contain Rego logic and schemas that define reusable policy types.open-policy-agent.github.io · read 15 Oct 2026
- Documentation depth
- The documentation includes installation, examples, audit, mutation, external data, debugging, metrics, performance, architecture, runtime flags, API reference, and contribution material.open-policy-agent.github.io · read 15 Oct 2026
- External data
- Gatekeeper supports external-data providers that let admission policies query data outside the Kubernetes object.open-policy-agent.github.io · read 15 Oct 2026
- Independent limitation: scope
- HackingNote characterizes Gatekeeper as Kubernetes-only, unlike general-purpose OPA deployments.hackingnote.com · read 15 Oct 2026
- Independent summary
- Hysen Labs describes Gatekeeper as a self-hosted Kubernetes service written mainly in Go with Apache-2.0 licensing.hysenlabs.com · read 15 Oct 2026
- Independent use cases
- A Kubernetes project article gives examples including approved image repositories, globally unique ingress hostnames, pod resource limits, and namespace ownership labels.kubernetes.io · read 15 Oct 2026
- Installation
- Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment.open-policy-agent.github.io · read 15 Oct 2026
- Install options
- The documentation describes deployment using a prebuilt image, a development image, a locally built image, or Helm.open-policy-agent.github.io · read 8 Oct 2026
- Kubernetes requirement
- Gatekeeper requires Kubernetes resources introduced in version 1.16 and requires cluster-admin permissions for installation.open-policy-agent.github.io · read 8 Oct 2026
- Licence
- The Gatekeeper repository is licensed under Apache-2.0.github.com · read 15 Oct 2026
