Gatekeeper is a validating (mutating TBA) webhook that enforces Kubernetes CRD-based policies executed by Open Policy Agent (OPA), a policy engine for Cloud Native environments.