Security with OPA Gatekeeper

OPA Gatekeeper enforces security policies through the use of the Admission Controller and Audit Functionality.

Kubernetes Admission Controller

Kubernetes Admission Controller is included in OPA Gatekeeper. It inspects and intercepts any Kubernetes resources added or updated to the cluster. Admission Controller ensures the required policies defined are met. It can either deny an admissions request with the option to provide an explanation or not. It can also accept an admission request while returning an explanation to the user, by setting the constraint’s enforcementAction to warn. Through the usage of Kubernetes Admission Controller a binary approach can be implemented to accept changes on API resources on a cluster.

Audit Functionality

OPA Gatekeeper’s built-in auditing functionality allows all violations to be stored in the status field of the failed Constraint.