OPA Gatekeeper

kubectl apply -f constraint.yaml

Applies OPA Gatekeeper policies to the Kubernetes cluster, controlling admission of resources against the organization's rules (Rego).

Run it when you want cluster admission control with policies: OPA Gatekeeper (the admission controller) evaluates each resource (deployment, pod, service) against ConstraintTemplates (the rules in Rego) and Constraints (the instances) — the resource that violates is rejected at apply. It is the reference K8s policy (from OPA/CNCF): admission controlled by the organization's rules. In K8s DevSecOps, Gatekeeper is the cluster policy layer: constraints (privileged containers, limits, mandatory labels) applied at admission — the misconfigured resource is blocked before entering.

Do not use it without deployment: Gatekeeper requires installation (the admission controller) in the cluster — without deployment, the constraint is not applied. Rego rules have a learning curve (OPA's language): writing and testing templates. And note: Gatekeeper controls admission — already running resources (those that entered before) are not evaluated; auditing (constraint status) and remediation of existing ones are part of the flow. Organization policies are defined with the team (constraints) — community generic ones are the starting point. For pipeline validation (before the cluster), use manifest validators (Datree, 053); Gatekeeper is policy at admission.