OPA Gatekeeper.

OPA Gatekeeper is a CNCF policy controller that uses Open Policy Agent and the Rego language to enforce admission and audit policies on Kubernetes resources. It belongs to the Cloud Security category of cybersecurity.

OPA Gatekeeper is a CNCF policy controller that uses Open Policy Agent and the Rego language to enforce admission and audit policies on Kubernetes resources.

Gatekeeper is the Kubernetes-native packaging of the Open Policy Agent. Operators install ConstraintTemplates that contain Rego policies and ConstraintTemplate-typed CRDs whose instances are the actual Constraints (for example, K8sRequiredLabels). Gatekeeper runs as a validating and mutating admission webhook and also audits existing cluster state against Constraints. Policies can target any resource and are decoupled from the schemas they protect, so the same engine governs Pods, Ingresses, Custom Resources, and cloud-managed objects. Gatekeeper integrates with the wider OPA ecosystem (Conftest, Styra, Terraform), enabling shift-left checks in CI alongside cluster enforcement.

Defences for OPA Gatekeeper typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Gatekeeper, OPA.