Gatekeeper
Gatekeeper is an open-source Kubernetes admission controller that validates and enforces policies using Open Policy Agent.
Google Anthos in Action
Gatekeeper is an open-source Kubernetes admission-control system that uses Open Policy Agent policies to validate and enforce resource constraints.
- How it is used
- Validates Kubernetes API requests against cluster policies to prevent insecure or disruptive resources from being created.
- How deep it goes
- Explains webhook request flow, constraints, dry-run results, exemptions, and latency; defers detailed custom-policy creation.
- Examples
- Uses privileged-Pod constraints, dry-run violations, namespace exemptions, required labels, and image-digest policies.
- What you can do after
- Operate/configure it to test Pod constraints in dry-run mode and choose namespace exemptions before enforcement.
Effective Platform Engineering
Gatekeeper is an open-source Kubernetes admission controller that enforces policies through Open Policy Agent integration.
- How it is used
- Enforces Kubernetes compliance checks at the deployment admission point, supporting governance without relying solely on pipeline verification.
- How deep it goes
- Explains admission enforcement, required labels, and policy-format tradeoffs, but stops short of detailed Rego implementation.
- Examples
- Uses a deployment-label check that accepts or denies resources missing required metadata.
- What you can do after
- Operate Kubernetes admission checks that block deployments lacking required configuration.
Read how Effective Platform Engineering explains Gatekeeper →
Related concepts
- Regouses · Rego is a declarative query and policy language for expressing rules over structured data, commonly evaluated by Open Policy Agent and related systems.
- admission controllerkind of · A Kubernetes admission controller intercepts API requests after authentication and authorization, validating or mutating them before they are persisted.
- Open Policy Agentuses · Open Policy Agent is an open-source policy engine that evaluates declarative policies against structured input to make authorization and other policy decisions.
- PodSecurityPolicyalternative to · PodSecurityPolicy was a deprecated Kubernetes API resource for enforcing security constraints on pods before its removal.
- Anthos Config Managementpart of · Anthos Config Management is a Google Anthos component for centrally applying policy and configuration to clusters and services.
- Policy Controllerused by · Policy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.