domains / families / security / implementing-opa-gatekeeper-for-policy-enforcement

implementing-opa-gatekeeper-for-policy-enforcement

separate

Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.

When to use

• When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

When not to use

• standard pod security profiles that Pod Security Admission already covers

Skill page

Source