Gatekeeper
By the Open Policy Agent project (CNCF)
Gatekeeper is a Kubernetes policy enforcement controller built on the Open Policy Agent project that validates and constrains cluster resources at admission time using policies written in the Rego language. It defines reusable policy…
Definition
Gatekeeper is a Kubernetes policy enforcement controller built on the Open Policy Agent project that validates and constrains cluster resources at admission time using policies written in the Rego language. It defines reusable policy templates called Constraint Templates, which cluster operators instantiate as Constraints with specific parameters, allowing rules such as required labels or disallowed image registries to be enforced consistently, audited, and versioned like any other Kubernetes object.
Overview
Kubernetes' default admission behavior accepts most syntactically valid resources, leaving organizational rules such as mandatory labels, restricted image sources, or required security contexts to be enforced separately. Gatekeeper addresses this by plugging into the Kubernetes admission webhook chain and evaluating every incoming resource against policies defined using the Open Policy Agent engine before the API server persists it. Gatekeeper's architecture separates policy logic from policy parameters through two custom resource types. A Constraint Template defines the underlying logic in Rego, Open Policy Agent's declarative query language, and exposes a schema for configurable parameters. A Constraint then instantiates that template with specific values, for example applying a 'required labels' template with the actual list of labels a given cluster requires. This separation lets a platform team publish reusable templates while application teams or namespace owners configure the specific parameters relevant to them. Gatekeeper's closest comparison is Kyverno, which enforces similar admission-time rules but expresses them in Kubernetes-native YAML rather than Rego. Rego is a purpose-built policy language capable of expressing more complex logic and is also used outside Kubernetes for authorization decisions in other systems, which gives Gatekeeper policies more portability across an organization's broader Open Policy Agent usage, at the cost of a steeper learning curve than YAML-based alternatives. Organizations use Gatekeeper to enforce security baselines like disallowing privileged containers, requiring specific resource quotas, and restricting which container registries are trusted, typically maintaining a library of shared Constraint Templates across multiple clusters. Because Constraints are ordinary Kubernetes objects, they integrate with GitOps pipelines and can be reviewed and versioned the same way as application manifests, and Gatekeeper also supports an audit mode that reports violations on existing resources without blocking them. Writing and maintaining Rego policies requires a real investment in learning a language most Kubernetes operators do not otherwise use day to day, which is the main trade-off against YAML-native tools like Kyverno. As with any synchronous admission webhook, a Gatekeeper outage or a slow policy evaluation can affect the cluster's ability to create new resources, so production deployments need to plan for webhook availability and failure behavior carefully. Gatekeeper also emits Kubernetes events and metrics for every constraint decision, which lets platform teams build dashboards tracking how often specific rules are triggered across a fleet of clusters. Gatekeeper also supports mutation policies in addition to validation, so it can automatically set default values on incoming resources, such as adding a required label, rather than only rejecting resources that omit one.
Key Features
- Enforces Kubernetes admission policy using the Rego language via Open Policy Agent
- Separates reusable Constraint Templates from parameterized Constraints
- Supports an audit mode that reports violations without blocking resources
- Integrates with GitOps workflows since policies are Kubernetes objects
- Shares policy logic portability with other Open Policy Agent deployments
- Provides library templates for common baselines like required labels or registries
- Runs as a validating and mutating admission webhook