open-policy-agent/gatekeeper

Features

• Admission Webhooks - Implements Kubernetes admission webhooks to intercept and validate API requests before they are persisted in the cluster.
• Kubernetes Policy Enforcers - Enforces defined policies on Kubernetes resources to ensure cluster configurations comply with organizational standards.
• Request Validation and Mutation - Intercepts and evaluates Kubernetes API requests to reject non-compliant resources based on policy.
• Kubernetes Resource Validation - Checks resources against predefined templates and custom constraints to ensure compliance before admission.
• Admission Controllers - Intercepts and modifies Kubernetes resource requests to enforce compliance before persistence.
• Workload Resource Validations - Rejects higher-level resources if the pods they would generate violate defined policy constraints.
• Admission Request Validation - Evaluates resources against defined policies to deny, warn, or report violations without altering the original object.
• Admission Resource Mutation - Modifies incoming resource objects automatically to ensure they adhere to specific organizational standards.
• Cluster Compliance Scanning - Scans existing resources within a cluster to identify and report objects that violate defined policy constraints.
• Cluster State Caching - Replicates resources into a local data cache so policy templates can reference the current cluster state.
• Admission-Based Policy Enforcement - Uses the Common Expression Language (CEL) to define declarative admission control rules.
• Cache-Based Auditing - Uses a local replication cache as the source of truth to identify constraint violations.
• Policy-Based Resource Validation - Checks cluster resources against defined policy templates and custom constraints to prevent non-compliant configurations.
• Resource Definition Metadata - Automatically adds labels and annotations to resource metadata based on defined matching conditions.
• Admission Mutators - Implements mutating admission webhooks to modify incoming Kubernetes objects with custom defaults or transformations.
• Reusable Policy Templates - Uses templates to create reusable policy libraries that are instantiated with different parameters via custom resources.
• Admission Request Evaluation - Inspects request metadata and user information to determine compliance with organizational policies during admission.
• Compliance Security Audits - Scans resources against defined policies to report non-compliant objects created before policy enforcement was active.
• Parameterized Enforcement - Uses reusable policy templates and custom constraints to validate resources based on specific configuration values.
• Kubernetes Cluster Auditing - Scans existing Kubernetes cluster resources to identify non-compliant objects and policy violations.
• Policy Validators - Creates reusable logic to validate objects and defines the parameters required for policy instantiations.
• Workload Template Validations - Creates expanded versions of parent resources to evaluate constraints against child objects before deployment.
• Cluster Compliance Auditing - Periodically scans existing cluster resources against active policies to detect and report violations for pre-existing objects.
• Resource Specification Mutators - Changes values in resource specifications or updates list entries to ensure they meet organizational standards.
• Custom Resource Policy Definitions - Uses custom resource definitions to define reusable policy templates and specific constraint instances for deployment.
• Data Caching - Stores retrieved values from external data providers for a set duration to lower latency and source load.
• External Data Integrations - Integrates external data sources to enrich policy decisions with real-time environmental context.
• Kubernetes Admission Webhook Filters - Selects which API requests trigger a webhook based on matching rules for operations, resources, and namespaces.
• Registry Enforcement Mutations - Modifies the domain, path, or tag of container image strings to enforce the use of approved registries.
• CI/CD Policy Gates - Provides CI/CD policy gates to test resource manifests against policies before they are applied to a cluster.
• Cluster Management - Provides a remote cluster management model to enforce policies on separate target clusters.
• Image Integrity Verification - Verifies the contents and origin of container images using build attestations and software bills of materials.
• Custom Resource Definitions - Automatically creates custom resource definitions to facilitate policy configurations and enforcement.
• Hub-and-Spoke Control Planes - Employs a hub-and-spoke control plane model to manage policies from a central cluster across multiple target clusters.
• CEL Expression Filters - Uses Common Expression Language (CEL) to define high-performance, declarative admission control rules.
• External Data Providers - Fetches real-time context from external HTTP services to inform authorization and validation decisions.
• Workload Template Mutations - Modifies pod templates within workload resources to ensure child pods inherit required security settings.
• High Availability Deployments - Distributes the engine across multiple pods and nodes to ensure high availability and resilience.
• Image Path Rewriting - Updates the domain, path, or tag of container image strings to ensure the use of approved registries.
• Scheduled Policy Enforcement - Schedules the frequency and batch size of resource scans to detect violations without overloading the server.
• Kubernetes Policy Controllers - Manages policy-as-code using custom resource definitions for consistent enforcement across clusters.
• Local Resource Caches - Synchronizes cluster state into local resource caches to perform policy evaluations without querying the API server.
• List-Based Resource Expansion - Simulates the expansion of resource templates to verify the resulting manifests before deployment.
• Template-Based Kubernetes Generators - Generates child resource manifests from parent workload templates to validate the final state of deployed objects.
• Policy Library Management - Allows installing and upgrading constraint templates from a remote policy library.
• Remote Cluster Access - Operates a controller in a management cluster while enforcing policies on separate target clusters.
• Namespace Enforcement Exemptions - Allows excluding specific namespaces or wildcard patterns from auditing, admission, and data synchronization processes.
• Resource Deletion Validations - Inspects and restricts requests to delete cluster resources based on defined policy constraints.
• Resource Field Mutations - Provides the ability to change specific values within a resource specification based on customizable mutation policies.
• Build Provenance Attestors - Uses build attestations and provenance to verify the origin and integrity of container images.
• Fail-Closed Admission Enforcement - Rejects all resource requests when the policy engine is unavailable to prevent unvalidated changes.
• Cloud Policy Dry-Runs - Evaluates new policy rules against existing cluster resources using dry-run modes to identify potential violations.
• Object Constraint Validation Engines - Tests objects against templates and constraints to identify policy violations and validate resource expansion.
• Webhook Mutation Auditors - Records which mutating webhooks modified a resource and the specific patches applied during the admission process.
• External Policy Data Querying - Calls in-cluster HTTP services to retrieve real-time information from external registries or directories for policy decisions.
• Metrics Exporters - Sends performance and behavioral data to external monitoring systems using configurable endpoints.
• Resource Consumption Throttling - Adjusts concurrency limits and memory caps during evaluation to prevent CPU starvation and memory errors.
• Violation Metrics - Exposes aggregated data on audit timestamps and violation counts via integrated monitoring systems.
• Violation Logging - Records denied or warned policy failures to a log to assist in debugging cluster configuration issues.
• Configuration and Policy - Enforces admission control policies within Kubernetes clusters.
• Defending - Listed in the “Defending” section of the Awesome K8s Security awesome list.
• Kubernetes Security - Policy enforcement for Kubernetes clusters.
• Security and Compliance - Policy controller for enforcing admission control rules.

Star history