Gatekeeper: policy as Kubernetes resources, judged by the OPA engine

Scroll or pinch to zoom, drag to move, double-click to zoom in 100% SVG PNG Back to the post

Gatekeeper architecture: users and CI send create and update requests to the Kubernetes API server, which sends an admission review to the Gatekeeper webhook; the webhook evaluates the request with the policy engine, which runs OPA Rego or CEL using constraint templates and constraints stored as Kubernetes resources; a policy repository applies those resources; the audit component evaluates existing resources with the same rules and writes violations to constraint status, logs and metrics.