The safeguards map / 3.7 Admission and owner settings
OPA Gatekeeper
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Kubernetes admission webhook, built on Open Policy Agent, that enforces Rego-based constraint policies and also checks existing resources against them.
Where it sits
3.7 Admission and owner settings (primary): Runs as a Kubernetes validating and mutating admission webhook that denies, warns on or dry-runs requests against Rego constraint templates the cluster owner defines, and checks existing resources against them.
Gatekeeper is a validating and mutating webhook that enforces CRD-based policies executed by Open Policy Agent
captured
which describes both the Rego that enforces the constraint and the schema of the constraint
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
Handoffs
consumes Policy: Rego (ConstraintTemplate)
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.