Kubernetes Trusts You Too Much
Imagine a new employee joins your company and is given a keycard that opens every door in the building — the server room, the finance office, the CEO's office. That's essentially what Kubernetes does by default: it trusts whoever has API access to deploy whatever they want.
By default, Kubernetes is designed to run whatever you throw at it:
- "You want a Service with a LoadBalancer that costs $20/month?" → Allowed.
- "You want to run a container as root with full host network access?" → Allowed.
- "You want to deploy an image from
docker.ioinstead of your private, scanned registry?" → Allowed.
This is fine when you're a team of three who review every YAML file together. It becomes a serious problem when you have 50 developers, 10 clusters, and a compliance audit next quarter.
The Manual Review Problem
You could write a checklist: "Before merging, make sure your Deployment has resource limits, doesn't use latest tags, and pulls from our internal registry." But checklists rely on humans, and humans make mistakes, skip steps under deadline pressure, or simply don't know the rules exist. You need an automated, consistent, always-on enforcement mechanism — a bouncer at the door who never takes a coffee break.
OPA Gatekeeper
OPA (Open Policy Agent) is a general-purpose policy engine developed by Styra and now a CNCF (Cloud Native Computing Foundation) graduated project. It can enforce policy across many systems — Kubernetes, Terraform, HTTP APIs, CI pipelines. Gatekeeper is the specific, purpose-built integration of OPA for Kubernetes.
Gatekeeper acts as a Validating Admission Controller — a plugin that sits inside the Kubernetes API request flow and intercepts every single kubectl apply, kubectl create, and kubectl delete. If a request violates your policy, Gatekeeper rejects it before it ever reaches the cluster's database (etcd). The resource is never created. The developer gets an immediate, human-readable error message explaining exactly what rule they violated.
This is the standard approach for Policy as Code in the Cloud Native ecosystem: your governance rules live in version-controlled files, are reviewed like code, and are enforced automatically.