README
¶
Gatekeeper
How is Gatekeeper different from OPA?
Compared to using OPA with its sidecar kube-mgmt (aka Gatekeeper v1.0), Gatekeeper introduces the following functionality:
- An extensible, parameterized policy library
- Native Kubernetes CRDs for instantiating the policy library (aka "constraints")
- Native Kubernetes CRDs for extending the policy library (aka "constraint templates")
- Native Kubernetes CRDs for mutation support
- Audit functionality
- External data support
Getting started
Check out the installation instructions to deploy Gatekeeper components to your Kubernetes cluster.
Documentation
Please see the Gatekeeper website for more in-depth information.
Policy Library
See the Gatekeeper policy library for a collection of constraint templates and sample constraints that you can use with Gatekeeper.
Community & Contributing
Please refer to Gatekeeper's contribution guide to find out how you can help.
Code of conduct
This project is governed by the CNCF Code of conduct.
Security
For details on how to report vulnerabilities and security release process, please refer to Gatekeeper Security for more information.
Documentation
¶
There is no documentation for this package.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package apis contains Kubernetes API groups.
|
Package apis contains Kubernetes API groups. |
|
config/v1alpha1
Package v1alpha1 contains API Schema definitions for the config v1alpha1 API group +kubebuilder:object:generate=true +groupName=config.gatekeeper.sh
|
Package v1alpha1 contains API Schema definitions for the config v1alpha1 API group +kubebuilder:object:generate=true +groupName=config.gatekeeper.sh |
|
expansion/unversioned
Package unversioned contains the internal representation of expansion objects
|
Package unversioned contains the internal representation of expansion objects |
|
expansion/v1alpha1
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1alpha1
|
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1alpha1 |
|
expansion/v1beta1
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1beta1
|
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1beta1 |
|
gvkmanifest/v1alpha1
Package v1alpha1 contains API Schema definitions for the GVKManifest v1alpha1 API group +kubebuilder:object:generate=true +groupName=gvkmanifest.gatekeeper.sh
|
Package v1alpha1 contains API Schema definitions for the GVKManifest v1alpha1 API group +kubebuilder:object:generate=true +groupName=gvkmanifest.gatekeeper.sh |
|
mutations/unversioned
Package unversioned contains the internal representation of mutator objects
|
Package unversioned contains the internal representation of mutator objects |
|
mutations/v1
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1beta1
|
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1beta1 |
|
mutations/v1alpha1
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1alpha1
|
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1alpha1 |
|
mutations/v1beta1
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1beta1
|
+k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/unversioned -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/mutations/v1beta1 |
|
status/v1beta1
Package v1beta1 contains API Schema definitions for the status v1beta1 API group +kubebuilder:object:generate=true +groupName=status.gatekeeper.sh
|
Package v1beta1 contains API Schema definitions for the status v1beta1 API group +kubebuilder:object:generate=true +groupName=status.gatekeeper.sh |
|
syncset/v1alpha1
Package v1alpha1 contains API Schema definitions for the SyncSet v1alpha1 API group +kubebuilder:object:generate=true +groupName=syncset.gatekeeper.sh
|
Package v1alpha1 contains API Schema definitions for the SyncSet v1alpha1 API group +kubebuilder:object:generate=true +groupName=syncset.gatekeeper.sh |
|
cmd
|
|
|
pkg
|
|
|
fakes
Package fakes defines methods for instantiating objects which act like resources on a Kubernetes cluster, but are not intended to actually be instantiated on a real, production cluster.
|
Package fakes defines methods for instantiating objects which act like resources on a Kubernetes cluster, but are not intended to actually be instantiated on a real, production cluster. |
|
gator/fixtures
fixtures package contains commonly used ConstraintTemplates, Constraints, Objects and other k8s resources mostly used for testing.
|
fixtures package contains commonly used ConstraintTemplates, Constraints, Objects and other k8s resources mostly used for testing. |
|
metrics/registry
Package registry provides a dynamic registry of available exporters.
|
Package registry provides a dynamic registry of available exporters. |
|
mutation/match
+kubebuilder:object:generate=true +groupName=match.gatekeeper.sh
|
+kubebuilder:object:generate=true +groupName=match.gatekeeper.sh |
|
mutation/path/parser
Package parser provides a parser for a path specification language used in expressing Kubernetes object paths.
|
Package parser provides a parser for a path specification language used in expressing Kubernetes object paths. |
|
test
|
|
Click to show internal directories.
Click to hide internal directories.