Skip to content
SPECIFICTION
Get listed

Open Policy Agent Gatekeeper

open-policy-agent.github.io

Free plan Open source LinuxAPISelf-hosted
Visit open-policy-agent.github.io
Spec score 8.3 #5 of 27 in Kubernetes Security Software

What it is

Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.

Spec sheet

What it does
Gatekeeper is a Kubernetes policy controller that enforces policy during admission and can audit running resources.Read 15 Oct 2026 · open-policy-agent.github.io
Purpose
Gatekeeper is a validating and mutating Kubernetes webhook that enforces CRD-based policies evaluated by Open Policy Agent.Read 8 Oct 2026 · open-policy-agent.github.io
API and extensibility
The documentation exposes an API reference and describes Kubernetes CRDs, runtime flags, mutators, external-data providers, and generated ValidatingAdmissionPolicies as extension points.Read 15 Oct 2026 · open-policy-agent.github.io
Audit
The audit operation periodically scans existing cluster objects and writes discovered violations to constraint status.Read 15 Oct 2026 · open-policy-agent.github.io
Audit limit
Constraint status reports at most 20 individual violations by default, configurable with a runtime flag; the documentation notes Kubernetes object-size and memory limits.Read 8 Oct 2026 · open-policy-agent.github.io
Build security
Each image has build attestations, an SBOM, and SLSA provenance; attestations are available for releases starting with v3.12.0.Read 15 Oct 2026 · open-policy-agent.github.io
CLI
The project documents the gator command-line interface for validating workload resources and policies.Read 15 Oct 2026 · open-policy-agent.github.io
Cloud integrations
The official site lists Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud Kubernetes as integrations or backed services.Read 15 Oct 2026 · open-policy-agent.github.io
Community support
The project site links to a Gatekeeper Slack channel and community meetings.Read 8 Oct 2026 · open-policy-agent.github.io
Constraint templates
ConstraintTemplate resources contain Rego logic and schemas that define reusable policy types.Read 15 Oct 2026 · open-policy-agent.github.io
Constraints
Constraint resources instantiate templates with matching rules and parameters for selected Kubernetes objects.Read 15 Oct 2026 · open-policy-agent.github.io
Documentation depth
The documentation includes installation, examples, audit, mutation, external data, debugging, metrics, performance, architecture, runtime flags, API reference, and contribution material.Read 15 Oct 2026 · open-policy-agent.github.io
External data
Gatekeeper supports external-data providers that let admission policies query data outside the Kubernetes object.Read 15 Oct 2026 · open-policy-agent.github.io
Independent limitation: scope
HackingNote characterizes Gatekeeper as Kubernetes-only, unlike general-purpose OPA deployments.Read 15 Oct 2026 · hackingnote.com
Independent summary
Hysen Labs describes Gatekeeper as a self-hosted Kubernetes service written mainly in Go with Apache-2.0 licensing.Read 15 Oct 2026 · hysenlabs.com
Independent use cases
A Kubernetes project article gives examples including approved image repositories, globally unique ingress hostnames, pod resource limits, and namespace ownership labels.Read 15 Oct 2026 · kubernetes.io
Install options
The documentation describes deployment using a prebuilt image, a development image, a locally built image, or Helm.Read 8 Oct 2026 · open-policy-agent.github.io
Installation
Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment.Read 15 Oct 2026 · open-policy-agent.github.io
Kubernetes requirement
Gatekeeper requires Kubernetes resources introduced in version 1.16 and requires cluster-admin permissions for installation.Read 8 Oct 2026 · open-policy-agent.github.io
Licence
The Gatekeeper repository is licensed under Apache-2.0.Read 15 Oct 2026 · github.com
Limit: complexity
The 2025 survey reports that some users find Gatekeeper overcomplicated for simple policies and find constraint-template debugging difficult.Read 15 Oct 2026 · openpolicyagent.org
Limit: learning curve
A production user reports that implementation can be difficult for unprepared organizations because Gatekeeper adds components and requires learning Rego.Read 15 Oct 2026 · bpietraga.me
Limit: missing capabilities
Survey respondents cite lack of shared-library and hierarchical-policy support and difficulty embedding Rego at scale while keeping tests separate.Read 15 Oct 2026 · openpolicyagent.org
Maker facts
LinkedIn lists Open Policy Agent as a nonprofit computer and network security organization founded in 2016, headquartered in Redwood City, with 5,001–10,000 employees.Read 15 Oct 2026 · linkedin.com
Mutation
Mutation resources can change matching Kubernetes objects during admission before validation evaluates the final object.Read 15 Oct 2026 · open-policy-agent.github.io
Observability
Gatekeeper provides metrics and observability documentation plus separate status and audit operations.Read 15 Oct 2026 · open-policy-agent.github.io
Policy engine
Gatekeeper uses Open Policy Agent and the Rego policy language for portable, flexible policy evaluation.Read 15 Oct 2026 · open-policy-agent.github.io
Policy library
The project publishes an extensible policy library containing reusable constraint templates and sample constraints.Read 15 Oct 2026 · open-policy-agent.github.io
Praise: adoption
The 2025 OPA community survey reports successful Gatekeeper use for fine-grained Kubernetes security policy and calls it a de-facto standard compared with alternatives.Read 15 Oct 2026 · openpolicyagent.org
Praise: capability
The same production report describes Gatekeeper as more capable and powerful than simpler Kubernetes policy approaches, while noting mutation-webhook support as an advantage.Read 15 Oct 2026 · bpietraga.me
Praise: Kubernetes workflow
HackingNote praises native kubectl and Helm workflows, built-in auditing, and automatic admission-webhook handling.Read 15 Oct 2026 · hackingnote.com
Rating on G2
4.5 out of 5 from 93 reviews, but the page identifies this as a vendor and contract lifecycle product rather than OPA Gatekeeper.Read 15 Oct 2026 · g2.com
Rating on TrustRadius
8.7 out of 10 from 6 reviews, but the page identifies this as a contract and vendor-management SaaS product rather than OPA Gatekeeper.Read 15 Oct 2026 · trustradius.com
Release status
The documentation currently identifies the v3.23.x documentation line, and GitHub lists a v3.23.1 release.Read 15 Oct 2026 · github.com
Security reporting
Security reports are requested by email, with acknowledgement and follow-up after investigation.Read 15 Oct 2026 · open-policy-agent.github.io
Supply-chain integrations
The site lists JFrog, GitHub Artifact Attestations OPA Provider, and Ratify external-data integrations for image and artifact verification.Read 15 Oct 2026 · open-policy-agent.github.io
Supply-chain security
Gatekeeper provides build attestations, a software bill of materials, and SLSA provenance for each image.Read 8 Oct 2026 · open-policy-agent.github.io
System requirement
Gatekeeper requires Kubernetes resources introduced in Kubernetes 1.16 or later and cluster-admin permissions for installation.Read 15 Oct 2026 · open-policy-agent.github.io
Validation
Validation policies can deny, warn, dry-run, audit, or report violations without modifying resources.Read 15 Oct 2026 · open-policy-agent.github.io
Vulnerability reporting
The project asks vulnerability reporters to email its security group and says it will acknowledge reports and follow up after investigation.Read 8 Oct 2026 · open-policy-agent.github.io

Plans and prices

Gatekeeper Free Open source Kubernetes policy controller · Apache-2.0 license Read 8 Oct 2026 · github.com
Open-source Gatekeeper Free Free to use; no paid tier is listed Kubernetes policy controller · self-hosted deployment · Apache-2.0 licence Read 15 Oct 2026 · github.com

Every Open Policy Agent Gatekeeper plan and price →

Strong points and limits

Strong points

  • Free Apache-2.0 open-source controller
  • Supports validation, mutation and audit
  • Offers parameterized policy examples
  • Connects to external data providers
  • Provides image attestations and SBOMs

Limits

  • Requires Kubernetes version 1.16 resources
  • Installation needs cluster-admin permissions
  • Audit reports at most 20 violations by default
  • gator CLI is beta

Who it suits

It suits Kubernetes operators who need admission controls, mutation and recurring audits in self-hosted Linux environments. Teams can adapt parameterized policies and connect external data sources.

Verdict

Gatekeeper provides configurable Kubernetes admission enforcement plus auditing and policy-library support at no license cost. Installation permissions, Kubernetes requirements and the audit-report limit are important deployment details.

Where Specifiction places it

Alternatives to Open Policy Agent GatekeeperAll alternatives →