Gatekeeper OPA
Connect Gatekeeper OPA to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Gatekeeper OPA to collect vendor procurement evidence with automated compliance tests, switched on per workspace.
| Category | Vendor Procurement |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Gatekeeper OPA's guide | kubernetes.io |
Connect with an API token
-
In Gatekeeper OPA:
- Create a service account for Safeguard: kubectl create serviceaccount safeguard-reader (add -n <namespace> to choose its namespace).
- Create a read-only ClusterRole: kubectl create clusterrole safeguard-reader --verb=get,list --resource=clusterrolebindings,clusterroles,roles,rolebindings,namespaces,nodes,pods,serviceaccounts,networkpolicies
- Bind the role to the service account: kubectl create clusterrolebinding safeguard-reader --clusterrole=safeguard-reader --serviceaccount=<namespace>:safeguard-reader
- Get a token. For a short-lived token run kubectl create token safeguard-reader. For a long-lived token, create a Secret of type kubernetes.io/service-account-token with the annotation kubernetes.io/service-account.name: safeguard-reader, then read it with kubectl get secret <secret> -o jsonpath='{.data.token}' | base64 --decode.
- Paste the token into Service account token.
Where to find the other values:
- Cluster CA certificate (PEM) (optional): The service-account token Secret also holds the cluster CA: kubectl get secret <secret> -o jsonpath='{.data.ca\.crt}' | base64 --decode.
Gatekeeper OPA's public documentation does not cover every step.
Steps are kubectl commands from the Kubernetes RBAC and service-account admin docs; there is no vendor UI. Permissions in RBAC are purely additive. The Kubernetes docs list constraints.gatekeeper.sh as an example custom API group; Gatekeeper creates one resource kind per constraint template, so the exact resource names to list (or using resources ["*"] for that group) and the Kyverno resource names (policies, clusterpolicies) were not confirmed from Gatekeeper or Kyverno docs in this pass. Tokens from kubectl create token are short-lived; the Secret-based token is long-lived. Where to read the API server URL and how to export a kubeconfig were not sourced (the kubeconfig the cluster provider issues normally carries both). Verification: the step adding constraints.gatekeeper.sh and kyverno.io rules was removed because neither fetched Kubernetes page mentions those API groups; take the resource rules from the Gatekeeper and Kyverno docs.
Source: kubernetes.io, kubernetes.io, checked 2026-10-07.
The permissions Safeguard needs:
get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies,get, list: constraints.gatekeeper.sh, kyverno.io policies. -
On Compliance › Connectors, open Gatekeeper OPA, click Connect, choose API token and fill in:
Field What to enter API server URL Optional. For example: https://203.0.113.10:6443 Service account token Optional. Stored encrypted and never shown again. Cluster CA certificate (PEM) (optional) Paste the whole key, including the BEGIN and END lines. Cluster name (optional) — Or, instead: Kubeconfig (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Gatekeeper OPA and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, C1.1, CC6.1, CC6.3, CC6.6, CC6.7, CC6.8, CC7.2, CC8.1 | 49 |
| ISO/IEC 27001 | Automated tests | A.5.17, A.8.2, A.8.5, A.8.6, A.8.9, A.8.15, A.8.20, A.8.24, A.8.32 | 49 |
| HIPAA Security Rule | Automated tests | 164.308(a)(4), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 40 |
| PCI DSS | Automated tests | 1.3.1, 2.2.1, 3.5.1, 4.2.1, 6.5.1, 7.2.2, 8.6.3, 10.2.1 | 48 |
| NIST CSF 2.0 | Automated tests | DE.CM-09, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.IR-01, PR.IR-03, PR.PS-01 | 49 |
| CIS Kubernetes Benchmark | Automated tests | 1.2.1, 1.2.2, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.10, 1.2.12, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18, 1.2.19, 1.2.21, 1.2.22, 1.2.23, 1.2.24, 1.2.25, 1.2.26, 1.2.27, 1.2.29, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.7, 1.4.1, 1.4.2, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.2.1, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.4.1, 5.7.2, 5.7.4 | 41 |
For a CIS benchmark, the numbers are its recommendations.
These tests are switched on per workspace by the Safeguard team.
Kubernetes, Kyverno connect to the same provider as Gatekeeper OPA, and these tests run for a connection made through any of them.
Related
- Vendor Procurement connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks