gatekeeper

Gatekeeper brings OPA's policy engine into Kubernetes as an admission controller. It enforces Rego-based policies on everything created in your cluster: require labels, block privileged containers, restrict which registries images can come from. It's the official OPA integration for Kubernetes, a CNCF project, open source and free.

It runs in-cluster and uses a constraint framework: you install a policy template once, then apply constraints that parameterize it, which makes policies reusable across teams. It also audits existing resources, not just new ones, so you can see what already violates a policy before you start blocking. Setup is a Helm install plus the policy library.

Fully free. The real decision is Gatekeeper versus Kyverno. Both do Kubernetes admission control; Gatekeeper uses Rego and inherits OPA's ecosystem and power, Kyverno uses plain YAML and is easier to pick up. If your org already runs OPA elsewhere and wants one policy language, Gatekeeper fits. If Kubernetes is the only target, Kyverno is usually the gentler path.

The catch: you inherit Rego. Gatekeeper's power comes from OPA, and so does its learning curve. For simple policies the constraint templates hide most of it, but anything custom drops you back into writing Rego. That's the trade for the flexibility.