Open Policy Agent
6.8#8 in infrastructure policy as code toolsFree planFree planWebAPILinuxmacOS
VisitOpen Policy Agent vs Open Policy Agent Gatekeeper
Open Policy Agent Gatekeeper
7.2#3 in kubernetes security softwareFree planFree planAPILinuxSelf-hosted
VisitWhat both publish
| Fact | Open Policy Agent | Open Policy Agent Gatekeeper |
|---|---|---|
| Community support | The official site links to an OPA Slack community for users to talk with other users and maintainers. | The project site links to a Gatekeeper Slack channel and community meetings. |
| Policy engine | OPA is an open source, general-purpose policy engine that separates policy decision-making from policy enforcement. | Gatekeeper uses Open Policy Agent and the Rego policy language for portable, flexible policy evaluation. |
| Purpose | OPA is an open-source, general-purpose policy engine that unifies policy enforcement across software systems. | Gatekeeper is a validating and mutating Kubernetes webhook that enforces CRD-based policies evaluated by Open Policy Agent. |
| Security reporting | The project asks security reporters to email its security team and says it aims to acknowledge reports and keep reporters informed about remediation. | Security reports are requested by email, with acknowledgement and follow-up after investigation. |
Open Policy Agent plans
- Open Policy AgentFree
Open Policy Agent Gatekeeper plans
- GatekeeperFree
- Open-source GatekeeperFree
Pick Open Policy Agent if…
OPA suits teams that need policy decisions across services, Kubernetes, CI/CD pipelines or API gateways, and can work with Rego and its evaluation interfaces. Those exposing its API should account for the fact that authentication and authorization are off by default.
Pick Open Policy Agent Gatekeeper if…
Gatekeeper suits teams managing Kubernetes clusters that need policy enforcement, mutation or recurring audits of existing resources. It is self-hosted and requires cluster-admin permissions to install.