Gatekeeper: Flexible, Shareable Policy for Kubernetes

on YouTube ↗34m

" summary

Gatekeeper is an open-source controller that turns OPA policies into Kubernetes CRDs (templates + constraints), enforces them via a validating admission webhook, and adds an audit mode for cluster-wide dry runs. Microsoft uses it in AKS preview and the project is alpha but working. Current limits: no mutating webhooks, limited metrics/observability, and basic policy tooling. The demo shows label, image-tag, and duplicate-name constraints failing at admission with clear messages.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 2:55Who are you
3. 4:57The problem
4. 8:43Common tools
5. 10:23Kubernetes capabilities
6. 13:06Challenges
7. 14:49Solution Gatekeeper
8. 25:48Why Gatekeeper
9. 29:15Gatekeeper Lifecycle

" related talks

• 34mGatekeeper: Flexible, Shareable Policy for KubernetesCraig Peters · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 34mEmbracing Change, Policy as code for Kubernetes with OPA and GatekeeperAra Pulido · DevOpsDays Portugal 2022
• 28mEmbracing change: Policy-as-code for Kubernetes with OPA and GatekeeperAra Pulido · stackconf online 2021
• 27mEmbracing change: Policy-as-code with OPA and GatekeeperAra Pulido · Conf42 Cloud Native 2021
• 05mCommunity projects inform enterprise productsBridget Kromhout, Lachlan Evenson · O'Reilly Velocity Conference 2019
• 41mYou Shall Not Pass! Policy Compliance with OPA GatekeeperNiccolò Raspa · KCD Italy 2021
• 29mEVAPorating Kubernetes Security Risk: Adopting Validating Admission Policy at ScaleKaitlyn Lee, Jordan Conard · KubeCon + CloudNativeCon Europe 2025
• 10mThe Power of OPA Gatekeeper: Enforcing Kubernetes Access Control to secure your runtimeBatel Zohar Tova, Dana Rozen · KCD Israel 2023