# Overview

**Open Policy Agent (OPA)** is a general-purpose policy engine that can be used to enforce policies in microservices, Kubernetes, CI/CD pipelines, API gateways, and more. OPA policies are expressed in a high-level declarative language called **Rego**.

**Gatekeeper** provides first-class integration with OPA and Kubernetes. It is a customizable admission webhook for Kubernetes, enforcing CRD-based policies executed by Open Policy Agent (OPA). In addition to "enforcement", Gatekeeper also supports an audit functionality that allows evaluation of already deployed resources for pre-existing misconfigurations.

The following manifests are used with OPA Gatekeeper to specify the desired state:

- Constraint Templates
- Constraints

One or more Constraints can be associated with a **Policy**. The **Policy** construct makes it significantly easier to manage and enforce Gatekeeper manifests across a fleet of clusters. Enforcement of policy is through association with a cluster blueprint.

**Org Admin** and **Infra Admin** roles are allowed to configure and use this feature to enforce the policies on clusters.

* * *

## Get Started

Users are encouraged to use one of the following "Get Started" guides to learn how to use this service.

| Guide | Description |
| --- | --- |
| `1` | [Configure and Deploy OPA Gatekeeper Policies using CLI](https://docs.rafay.co/learn/quickstart/opa_gatekeeper/overview/) |
| `2` | [Turnkey OPA Gatekeeper Policies](https://docs.rafay.co/learn/quickstart/turnkey_opa/overview/) |

## Explore our blog for deeper insights on OPA Gatekeeper, available [here](https://docs.rafay.co/blog/2023/06/16/org-wide-dashboards-for-opa-gatekeeper/)!