opa-gatekeeper

Best Practices

• Write ConstraintTemplates with clear violation messages that include the resource name
• Use dryrun enforcementAction during rollout to audit before enforcing
• Define parameter schemas in ConstraintTemplate CRD spec for type-safe constraint configs
• Match constraints to specific resource kinds and namespaces to limit blast radius
• Use excludedNamespaces to skip system namespaces (kube-system, gatekeeper-system)
• Keep Rego policies simple and testable — one concern per ConstraintTemplate
• Configure Config sync for resources your policies need to reference (e.g., Namespaces, Ingresses)
• Use labels and annotations in Constraints for grouping and documentation
• Test Rego policies with conftest or OPA unit tests before deploying
• Provide meaningful violation messages with resource name and namespace interpolation
• Use AssignMetadata for defaulting labels and annotations instead of writing Rego
• Version ConstraintTemplates to allow gradual migration

Documentation Sources