LoginSign Up
← Back to all sparks
G

Gatekeeper

INFRA · APIS
Velocity2.5

Policy controller that enforces OPA policies on Kubernetes clusters

open-policy-agent.github.io/gatekeeper ↗

Gatekeeper grew a package manager for policies — and a benchmark to prove they are not too slow.

kubernetes policypolicy distributionvalidatingadmissionpolicycelbenchmarking
◆Current state
3.22.0-rc.0 in February introduced two CLI subcommands that change how policies are handled rather than what they express: gator policy, a brew-inspired tool for discovering, installing, upgrading and uninstalling policies from the gatekeeper-library, and gator bench, which benchmarks Rego and CEL engines with latency percentiles, throughput, memory profiling and baseline comparison for CI regression detection. The same release enabled sync-vap-enforcement-scope by default and gave both CEL and Rego access to namespace context during admission and audit. Since then, 3.23.0-rc.1 added status resource routing for remote cluster mode, and 3.24.0-beta.0 made generated ValidatingAdmissionPolicy output deterministic to stop a reconcile loop.
◆Where it's heading
The centre of gravity is moving from the admission controller to the tooling around it. Policies are becoming artefacts you install from a library at a version, benchmark against a baseline in CI, and test before they reach a cluster — which is the lifecycle application code already has and policy generally has not. Underneath, the ValidatingAdmissionPolicy path keeps maturing as Gatekeeper hands more enforcement to the Kubernetes-native mechanism it now generates.
◆Prediction
Remote cluster mode gained status routing but the entries describe only that piece, so how far multi-cluster enforcement extends is unclear from these notes. The releases in this window are all beta and release candidates, so a 3.24.0 stable is the near-term milestone.

◆Recent moves

  1. 24d ago

    Deterministic VAP generation stops a reconcile loop

    Makes generated ValidatingAdmissionPolicy output deterministic to stop a reconcile loop, surfaces the real error when namespace caching fails, and hardens disk exporter concurrency.

    View source ↗
  2. 1mo ago

    Status routing for remote cluster mode; mutation ApplyTo operations

    Adds status resource routing for remote cluster mode, an operations field on the mutation ApplyTo spec, and structured field marking on semantic log lines. Also migrates OCI pulls to oras-go v2.

    View source ↗
  3. 4mo ago

    CI and dependency updates only

    Continuous integration and dependency bumps only — test image publishing to GHCR and a round of dependabot updates.

    View source ↗
  4. 5mo ago

    gator policy and gator bench: policy as an installable, benchmarked artefact

    ⚡ SPARK

    Two new gator subcommands change how policy is distributed and validated: gator policy installs and upgrades policies from the gatekeeper-library like a package manager, and gator bench measures Rego and CEL performance against a baseline for CI regression detection. VAP enforcement-scope syncing also becomes the default, and both engines gain namespace context.

    View source ↗