OPA Gatekeeper

Visit Website

Introduction

Gatekeeper is the Kubernetes policy controller from the Open Policy Agent project. It runs as a validating (and optionally mutating) admission webhook and uses OPA to decide whether resources entering the cluster comply with policy.

Policies are packaged as two kinds of resources. A ConstraintTemplate holds the Rego logic and declares parameters; a Constraint instantiates that template with specific values and a scope, such as ‘all Deployments in production namespaces must have an owner label’. This split lets a platform team publish reusable templates while application teams or admins configure them.

Gatekeeper also audits. It periodically checks existing resources against constraints and records violations on the constraint status, which helps when you introduce a rule to a cluster that already has non-compliant workloads. A community-maintained Gatekeeper Library provides common templates, including many Pod Security policies.

For CI, the gator CLI evaluates templates and constraints against manifests offline and runs policy test suites, so rules can be verified before they are applied. In the quality loop, Gatekeeper is a production guardrail and a release check for cluster configuration.

The source code is at open-policy-agent/gatekeeper on GitHub under the Apache-2.0 licence, with about 4,300 stars; the most recent commit was on 6 November 2026.

Features

1. Admission control: Rejects non-compliant resources at the API server.
2. ConstraintTemplates: Reusable Rego policies with typed parameters.
3. Audit: Reports violations in resources that already exist.
4. Mutation: Optional mutation policies to set defaults.
5. gator CLI: Test and evaluate policies offline in CI.
6. Policy library: Community templates for common security and best-practice rules.

Pros

1. Reuses OPA: Teams with Rego skills can share logic across systems.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 6 November 2026.
4. Community: About 4,300 GitHub stars.

Cons

1. Rego required: Writing templates needs Rego knowledge.
2. Kubernetes only: Enforcement is limited to clusters.
3. Two-resource model: Templates plus constraints add a layer of indirection for newcomers.

Usage and Links (Example)

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper/gatekeeper --name-template=gatekeeper --namespace gatekeeper-system --create-namespace

# test policies offline
gator verify ./policy-tests/...

Use enforcementAction: dryrun on new Constraints until audit results are clean.

Resources:

• OPA Gatekeeper website
• GitHub repository

Pricing

OPA Gatekeeper is free and open source under the Apache-2.0 licence.

Recommended for?

1. Clusters standardising on OPA and Rego for policy.
2. Security teams that need audit of existing resources.
3. Platform teams publishing reusable policy templates.

Conclusion

Gatekeeper brings OPA to Kubernetes admission with a clean template-and-constraint model and useful audit.

Pick it when Rego is already your policy language; otherwise compare it with Kyverno’s YAML-based approach.

On CheckOps, OPA Gatekeeper is filed under the Security testing, Production monitoring & observability and Release & CI gates stages. Related tools listed here include Open Policy Agent, Kyverno, Conftest, Kubescape, kube-bench and KubeLinter. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.