Freedom251 › Cloud Governance Software
Open Policy Agent Gatekeeper
What Open Policy Agent Gatekeeper is
Open Policy Agent Gatekeeper is a free Kubernetes policy controller that enforces policies defined through custom resource definitions and evaluated by Open Policy Agent. It works as a validating and mutating webhook: validation rules can deny, warn, run in dry-run mode or report violations, while mutation policies can change matching resources before validation evaluates the final object. Its audit function periodically checks existing cluster resources against constraints to find earlier misconfigurations. Gatekeeper includes an extensible library of parameterized sample policies and supports provider-based connections to external sources such as image registries and directory services. The project names Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud among its integrations or backed services. Installation options include prebuilt, development and locally built images, or Helm. It requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. Audit status reports at most 20 individual violations by default, a limit configurable with a runtime flag; Kubernetes object-size and memory limits also apply.
Who it suits
Gatekeeper suits teams managing Kubernetes clusters that need admission-time policy enforcement and recurring audits. It is self-hosted and listed for Linux.
What it does well
- Validation supports deny, warn, dry-run and report modes.
- Mutation policies change resources before validation.
- Periodic audits check existing cluster resources.
- Several installation options are documented.
What to know first
- Installation requires cluster-admin permissions.
- Kubernetes resources from version 1.16 are required.
- Audit reports at most 20 violations by default.
Limits
Audit constraint status reports show up to 20 individual violations by default. The limit can be changed with a runtime flag; the documentation also notes Kubernetes object-size and memory limits.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Gatekeeper | Open source Kubernetes policy controller · Apache-2.0 license | Free |
| Open-source Gatekeeper | Free to use; no paid tier is listed · Kubernetes policy controller · self-hosted deployment · Apache-2.0 licence | Free |
As open-policy-agent.github.io lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Gatekeeper documentation website.
- Choose an installation route: prebuilt image, development image, locally built image, or Helm.
- Confirm the cluster has the Kubernetes resources introduced in version 1.16.
- Install Gatekeeper with cluster-admin permissions.
- Configure constraints and policies, using or adapting the sample policy library.
Verdict
Gatekeeper combines admission policy controls with recurring audits and customizable policy examples. Installation permissions and audit reporting limits are important operational considerations.
Questions
Is Gatekeeper free?
Yes. The listed plan is free, and the plan describes it as open source under the Apache-2.0 license.
What does Gatekeeper enforce?
It enforces CRD-based policies evaluated by Open Policy Agent through a validating and mutating Kubernetes webhook. Validation can deny, warn, run in dry-run mode, or report violations.
Can Gatekeeper change resources?
Yes. Mutation policies can change matching Kubernetes resources during admission before validation evaluates the final object.
What does Gatekeeper require to install?
It requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation.
How can Gatekeeper be deployed?
The documentation describes installation using a prebuilt image, a development image, a locally built image, or Helm.
Does Gatekeeper include a command-line tool?
The gator CLI is documented as a beta feature beginning with Gatekeeper version 3.11.
Facts from Open Policy Agent Gatekeeper's own pages
- API and extensibility
- The documentation exposes an API reference and describes Kubernetes CRDs, runtime flags, mutators, external-data providers, and generated ValidatingAdmissionPolicies as extension points. · open-policy-agent.github.io, 15 Oct 2026
- Audit
- The audit operation periodically scans existing cluster objects and writes discovered violations to constraint status. · open-policy-agent.github.io, 15 Oct 2026
- Audit limit
- Constraint status reports at most 20 individual violations by default, configurable with a runtime flag; the documentation notes Kubernetes object-size and memory limits. · open-policy-agent.github.io, 8 Oct 2026
- Build security
- Each image has build attestations, an SBOM, and SLSA provenance; attestations are available for releases starting with v3.12.0. · open-policy-agent.github.io, 15 Oct 2026
- CLI
- The project documents the gator command-line interface for validating workload resources and policies. · open-policy-agent.github.io, 15 Oct 2026
- Cloud integrations
- The official site lists Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud Kubernetes as integrations or backed services. · open-policy-agent.github.io, 15 Oct 2026
- Community support
- The project site links to a Gatekeeper Slack channel and community meetings. · open-policy-agent.github.io, 8 Oct 2026
- Constraints
- Constraint resources instantiate templates with matching rules and parameters for selected Kubernetes objects. · open-policy-agent.github.io, 15 Oct 2026
- Constraint templates
- ConstraintTemplate resources contain Rego logic and schemas that define reusable policy types. · open-policy-agent.github.io, 15 Oct 2026
- Documentation depth
- The documentation includes installation, examples, audit, mutation, external data, debugging, metrics, performance, architecture, runtime flags, API reference, and contribution material. · open-policy-agent.github.io, 15 Oct 2026
- External data
- Gatekeeper supports external-data providers that let admission policies query data outside the Kubernetes object. · open-policy-agent.github.io, 15 Oct 2026
- Independent limitation: scope
- HackingNote characterizes Gatekeeper as Kubernetes-only, unlike general-purpose OPA deployments. · hackingnote.com, 15 Oct 2026
- Independent summary
- Hysen Labs describes Gatekeeper as a self-hosted Kubernetes service written mainly in Go with Apache-2.0 licensing. · hysenlabs.com, 15 Oct 2026
- Independent use cases
- A Kubernetes project article gives examples including approved image repositories, globally unique ingress hostnames, pod resource limits, and namespace ownership labels. · kubernetes.io, 15 Oct 2026
- Installation
- Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment. · open-policy-agent.github.io, 15 Oct 2026
- Install options
- The documentation describes deployment using a prebuilt image, a development image, a locally built image, or Helm. · open-policy-agent.github.io, 8 Oct 2026
- Kubernetes requirement
- Gatekeeper requires Kubernetes resources introduced in version 1.16 and requires cluster-admin permissions for installation. · open-policy-agent.github.io, 8 Oct 2026
- Licence
- The Gatekeeper repository is licensed under Apache-2.0. · github.com, 15 Oct 2026
- Limit: complexity
- The 2025 survey reports that some users find Gatekeeper overcomplicated for simple policies and find constraint-template debugging difficult. · openpolicyagent.org, 15 Oct 2026
- Limit: learning curve
- A production user reports that implementation can be difficult for unprepared organizations because Gatekeeper adds components and requires learning Rego. · bpietraga.me, 15 Oct 2026
- Limit: missing capabilities
- Survey respondents cite lack of shared-library and hierarchical-policy support and difficulty embedding Rego at scale while keeping tests separate. · openpolicyagent.org, 15 Oct 2026
- Maker facts
- LinkedIn lists Open Policy Agent as a nonprofit computer and network security organization founded in 2016, headquartered in Redwood City, with 5,001–10,000 employees. · linkedin.com, 15 Oct 2026
- Mutation
- Mutation resources can change matching Kubernetes objects during admission before validation evaluates the final object. · open-policy-agent.github.io, 15 Oct 2026
- Observability
- Gatekeeper provides metrics and observability documentation plus separate status and audit operations. · open-policy-agent.github.io, 15 Oct 2026
Where Open Policy Agent Gatekeeper stands on Freedom251
- Cloud Governance Software#2 of 26
- Infrastructure Policy as Code Tools#2 of 25
- Kubernetes Security Software#3 of 27
- Container Security Software#4 of 26