instruction: How do you implement enterprise-grade Kubernetes security hardening?
output: Introduction | Gatekeeper Skip to main content Gatekeeper Docs Policy Library v3.20.x Next v3.20.x v3.19.x v3.18.x v3.17.x v3.16.x v3.15.x v3.14.x v3.13.x v3.12.x v3.11.x v3.10.x v3.9.x v3.8.x v3.7.x v3.6.x Search Getting Started Introduction Installation Examples How to use Gatekeeper How to use Gatekeeper Audit Handling Constraint Violations Replicating Data Exempting Namespaces Policy Library Customizing Startup Behavior Customizing Admission Behavior Metrics &amp; Observability Debugging Emergency Recovery Cloud and Vendor Specific Fixes Failing Closed Mutation Constraint Templates External Data Validating Workload Resources using ExpansionTemplate The gator CLI Working with Workload Resources Exporting violations Integration with Kubernetes Validating Admission Policy Enforcement points in Gatekeeper Runtime Flags Architecture Operations Performance Tuning OPA Versions Concepts Admission Review Input Background Information on Mutation Contributing Developers How to contribute Security Export Interface/Driver walkthrough Getting Started Introduction Version: v3.20.x On this page Introduction Goals ​ Every organization has policies. Some are essential to meet governance and legal requirements. Others help ensure adherence to best practices and institutional conventions. Attempting to ensure compliance manually would be error-prone and frustrating. Automating policy enforcement ensures consistency, lowers development latency through immediate feedback, and helps with agility by allowing developers to operate independently without sacrificing compliance. Kubernetes allows decoupling policy decisions from the inner workings of the API Server by means of admission controller webhooks , which are executed whenever a resource is created, updated or deleted. Gatekeeper is a validating and mutating webhook that enforces CRD-based policies executed by Open Policy Agent , a policy engine for Cloud Native environments hosted by CNCF as a graduated project . In addition to the admission scenario, Gatekeeper&#x27;s audit functionality allows administrators to see what resources are currently violating any given policy. Finally, Gatekeeper&#x27;s engine is designed to be portable, allowing administrators to detect and reject non-compliant commits to an infrastructure-as-code system&#x27;s source-of-truth, further strengthening compliance efforts and preventing bad state from slowing down the organization. Looking for sample policies? ​ Please visit Gatekeeper policy library to find a collection of sample policies. How is Gatekeeper different from OPA? ​ Compared to using OPA with its sidecar kube-mgmt (aka Gatekeeper v1.0), Gatekeeper introduces the following functionality: An extensible, parameterized policy library Native Kubernetes CRDs for instantiating the policy library (aka &quot;constraints&quot;) Native Kubernetes CRDs for extending the policy library (aka &quot;constraint templates&quot;) Native Kubernetes CRDs for mutation support Audit functionality External data support Edit this page Next Installation Goals Looking for sample policies? How is Gatekeeper different from OPA? Community GitHub Slack (#opa-gatekeeper) Meetings