OPA Gatekeeper Architecture

OPA Gatekeeper Architecture An architecture diagram generated by Archify. API Server · kube-apiserver · OPA Gatekeeper Architecture API Server kube-apiserver Webhook · Admission Webhook · OPA Gatekeeper Architecture Webhook Admission Webhook Webhook controller · controller-runtime · OPA Gatekeeper Architecture Webhook controller controller-runtime OPA Engine · Rego evaluation · OPA Gatekeeper Architecture OPA Engine Rego evaluation Audit controller · Separate Deployment · OPA Gatekeeper Architecture Audit controller Separate Deployment Constraint Templates · CRD schema · OPA Gatekeeper Architecture Constraint Templates CRD schema Constraints · CR instances · OPA Gatekeeper Architecture Constraints CR instances Rego Policy · Policy logic · Policy Components Rego Policy Policy logic Target Resources · K8s resources · Policy Components Target Resources K8s resources Defines Applies to OPA Gatekeeper Architecture Policy Components Legend Control plane Policy resources / audit Policy evaluation Target workloads

Invocation failure vs policy violation

  • • failurePolicy handles webhook invocation failures
  • • enforcementAction handles policy violations

Rego and inventory

  • • Select v1 with code.source.version
  • • Synced inventory is not atomic uniqueness