How open-policy-agent/gatekeeper works
Gatekeeper extends Kubernetes admission control with constraint-template-defined policies and constraint instances, alongside mutation, audit, and external-data capabilities. Administrators configure these resources through the Kubernetes API; Gatekeeper controllers reconcile them, while admission webhooks evaluate and mutate incoming requests. Audit checks existing resources and reports violations. The gator CLI provides local verification and policy-library management. The graph reflects README capabilities and sampled controller, cache, audit, and webhook paths; some subsystem wiring is inferred from module names and is intentionally not shown where call ownership is uncertain.
Main entry points: cachemanager.go Resource cache · webhook.go Admission webhook · mutation.go Mutation webhook · client.go Policy management
Components 23
Policy configuration
- Gatekeeper CRDs
apis - Template controller
pkg/controller/constrainttemplate/constrainttemplate_controller.go - Constraint controller
pkg/controller/constraint/constraint_controller.go - Controller setup
pkg/controller/controller.go
Admission runtime
- Resource cache
pkg/cachemanager/cachemanager.go - Resource watches
pkg/watch/manager.go - Admission webhook
pkg/webhook/webhook.go - Policy evaluation
pkg/webhook/policy.go - Mutation webhook
pkg/webhook/mutation.go - Mutation engine
pkg/mutation/system.go - Resource targeting
pkg/target/target.go
Audit and integrations
- Audit manager
pkg/audit/manager.go - External-data controller
pkg/controller/externaldata/externaldata_controller.go - Expansion controller
pkg/controller/expansion/expansion_controller.go - Export controller
pkg/controller/export/export_connection_controller.go - Export system
pkg/export/system.go
Policy CLI
- gator CLI
cmd/gator/gator.go - Policy verification
pkg/gator/verify/runner.go - Policy management
pkg/gator/policy/client/client.go - Policy catalog
pkg/gator/policy/catalog/fetch.go
Other components
- Administrator
- Kubernetes API
- External provider
Connections 26
- Administrator → Kubernetes API: applies resources
- Kubernetes API → Template controller: sends events
- Kubernetes API → Constraint controller: sends events
- Template controller → Kubernetes API: reconciles templates
- Constraint controller → Kubernetes API: reconciles constraints
- Controller setup → Resource cache: starts
- Resource cache → Resource watches: manages watches
- Resource watches → Resource cache: replays changes
- Kubernetes API → Admission webhook: sends admission requests
- Admission webhook → Policy evaluation: dispatches evaluation
- Admission webhook → Mutation webhook: dispatches mutation
- Policy evaluation → Resource cache: reads policy data
- Mutation webhook → Mutation engine: applies mutators
- Mutation webhook → Resource targeting: matches resources
- Audit manager → Kubernetes API: reads resources
- Audit manager → Export system: exports violations
- Kubernetes API → External-data controller: sends events
- External-data controller → External provider: queries data
- Kubernetes API → Expansion controller: sends events
- Kubernetes API → Export controller: sends events
- Export controller → Export system: configures connections
- gator CLI → Policy verification: runs verification
- Policy verification → Policy catalog: loads policy inputs
- gator CLI → Policy management: manages policies
- Policy management → Policy catalog: fetches catalog
- Policy management → Kubernetes API: installs policies