EVERYTHING XIAOMI
Get listed
Open Policy Agent Gatekeeper logo

Open Policy Agent Gatekeeper

Open Policy Agent Gatekeeper is a free, open-source policy controller for Kubernetes.

Place
#3 of 27
Score
7.2
Open Policy Agent Gatekeeper's website

What Open Policy Agent Gatekeeper is

Open Policy Agent Gatekeeper is a free, open-source policy controller for Kubernetes. It works as a validating and mutating webhook, enforcing policies defined through custom resource definitions and evaluated by Open Policy Agent. Validation constraints can deny or warn about requests, operate in dry-run mode, or report violations without changing resources. Mutation policies can alter matching resources during admission, before validation checks the resulting object. Gatekeeper also periodically audits existing cluster resources against constraints to find misconfigurations already present. Its extensible policy library offers parameterized samples users can customize, and provider-based connections can bring in external data from sources such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Gatekeeper is self-hosted for Linux, with installation options including prebuilt, development or locally built images, and Helm. It requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.

Good

  • Validation can deny, warn, dry-run or report violations.
  • Mutation changes matching resources before validation.
  • Periodic audits identify existing misconfigurations.
  • Parameterized sample policies can be customized.

Watch out

  • Installation requires cluster-admin permissions.
  • Requires Kubernetes resources introduced in version 1.16.
  • The gator CLI is documented as beta.

Who it suits

Gatekeeper suits teams managing Kubernetes clusters that need policy enforcement, mutation or recurring audits of existing resources. It is self-hosted and requires cluster-admin permissions to install.

Verdict

Gatekeeper offers policy enforcement, resource mutation and auditing for Kubernetes clusters, with several deployment paths and external-data connections. Account for its Kubernetes and installation-permission requirements, and note that the gator CLI is beta.

Plans and prices

From Open Policy Agent Gatekeeper's own pricing page, checked 8 Oct 2026.

All about pricing
PlanPriceWhat it gives you
GatekeeperFreeOpen source Kubernetes policy controller · Apache-2.0 license
Open-source GatekeeperFreeKubernetes policy controller · self-hosted deployment · Apache-2.0 licence · Free to use; no paid tier is listed

The facts

Each one read from Open Policy Agent Gatekeeper's own pages, with the date it was checked.

What it does

API and extensibility
The documentation exposes an API reference and describes Kubernetes CRDs, runtime flags, mutators, external-data providers, and generated ValidatingAdmissionPolicies as extension points.checked 15 Oct 2026
Audit
The audit operation periodically scans existing cluster objects and writes discovered violations to constraint status.checked 15 Oct 2026
Audit limit
Constraint status reports at most 20 individual violations by default, configurable with a runtime flag; the documentation notes Kubernetes object-size and memory limits.checked 8 Oct 2026
Build security
Each image has build attestations, an SBOM, and SLSA provenance; attestations are available for releases starting with v3.12.0.checked 15 Oct 2026
CLI
The project documents the gator command-line interface for validating workload resources and policies.checked 15 Oct 2026
Cloud integrations
The official site lists Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints, and Alibaba Cloud Kubernetes as integrations or backed services.checked 15 Oct 2026
Community support
The project site links to a Gatekeeper Slack channel and community meetings.checked 8 Oct 2026
Constraints
Constraint resources instantiate templates with matching rules and parameters for selected Kubernetes objects.checked 15 Oct 2026
Constraint templates
ConstraintTemplate resources contain Rego logic and schemas that define reusable policy types.checked 15 Oct 2026
Documentation depth
The documentation includes installation, examples, audit, mutation, external data, debugging, metrics, performance, architecture, runtime flags, API reference, and contribution material.checked 15 Oct 2026
External data
Gatekeeper supports external-data providers that let admission policies query data outside the Kubernetes object.checked 15 Oct 2026
Independent limitation: scope
HackingNote characterizes Gatekeeper as Kubernetes-only, unlike general-purpose OPA deployments.checked 15 Oct 2026
Independent summary
Hysen Labs describes Gatekeeper as a self-hosted Kubernetes service written mainly in Go with Apache-2.0 licensing.checked 15 Oct 2026
Independent use cases
A Kubernetes project article gives examples including approved image repositories, globally unique ingress hostnames, pod resource limits, and namespace ownership labels.checked 15 Oct 2026
Installation
Installation supports prebuilt release images, development images, locally built images, and Helm-based deployment.checked 15 Oct 2026
Install options
The documentation describes deployment using a prebuilt image, a development image, a locally built image, or Helm.checked 8 Oct 2026
Kubernetes requirement
Gatekeeper requires Kubernetes resources introduced in version 1.16 and requires cluster-admin permissions for installation.checked 8 Oct 2026
Licence
The Gatekeeper repository is licensed under Apache-2.0.checked 15 Oct 2026
Limit: complexity
The 2025 survey reports that some users find Gatekeeper overcomplicated for simple policies and find constraint-template debugging difficult.checked 15 Oct 2026
Limit: learning curve
A production user reports that implementation can be difficult for unprepared organizations because Gatekeeper adds components and requires learning Rego.checked 15 Oct 2026
Limit: missing capabilities
Survey respondents cite lack of shared-library and hierarchical-policy support and difficulty embedding Rego at scale while keeping tests separate.checked 15 Oct 2026
Mutation
Mutation resources can change matching Kubernetes objects during admission before validation evaluates the final object.checked 15 Oct 2026
Observability
Gatekeeper provides metrics and observability documentation plus separate status and audit operations.checked 15 Oct 2026

The company

Maker facts
LinkedIn lists Open Policy Agent as a nonprofit computer and network security organization founded in 2016, headquartered in Redwood City, with 5,001–10,000 employees.checked 15 Oct 2026

Alternatives to Open Policy Agent Gatekeeper

All alternatives
  1. 1Kubescape logo

    Kubescape

    Free planOpen sourceAPILinuxmacOSSelf-hosted
    8.2From $30 a month
    Visit
  2. 2

    Kyverno

    Free planOpen sourceWebAPILinuxmacOS
    7.7Free plan
    Visit
  3. 3Sysdig Secure logo

    Sysdig Secure

    WebAPILinuxmacOS
    7.2From $20 a month
    Visit
  4. 4Fairwinds Polaris logo

    Fairwinds Polaris

    Free planWebLinuxmacOSSelf-hosted
    7.1Free plan
    Visit
  5. 5

    Trivy Operator

    Free planOpen sourceAPILinuxSelf-hosted
    6.9Free plan
    Visit
  6. 6

    KSPM Pro

    Free planWeb
    6.5From $100 a month
    Visit