Gatekeeper

Record your Gatekeeper connection as vendor procurement evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Gatekeeper:

   1. Create a service account for Safeguard: kubectl create serviceaccount safeguard-reader (add -n <namespace> to choose its namespace).
   2. Create a read-only ClusterRole: kubectl create clusterrole safeguard-reader --verb=get,list --resource=clusterrolebindings,clusterroles,roles,rolebindings,namespaces,nodes,pods,serviceaccounts,networkpolicies
   3. Bind the role to the service account: kubectl create clusterrolebinding safeguard-reader --clusterrole=safeguard-reader --serviceaccount=<namespace>:safeguard-reader
   4. Get a token. For a short-lived token run kubectl create token safeguard-reader. For a long-lived token, create a Secret of type kubernetes.io/service-account-token with the annotation kubernetes.io/service-account.name: safeguard-reader, then read it with kubectl get secret <secret> -o jsonpath='{.data.token}' | base64 --decode.
   5. Paste the token into Service account token.

   Where to find the other values:

   • Cluster CA certificate (PEM) (optional): The service-account token Secret also holds the cluster CA: kubectl get secret <secret> -o jsonpath='{.data.ca\.crt}' | base64 --decode.

   Gatekeeper's public documentation does not cover every step.

   Source: kubernetes.io, kubernetes.io, checked 2026-10-07.

   The permissions Safeguard needs: get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies.

2. On Compliance › Connectors, open Gatekeeper, click Connect, choose API token and fill in:

   Field	What to enter
   API server URL	Optional. For example: https://203.0.113.10:6443
   Service account token	Optional. Stored encrypted and never shown again.
   Cluster CA certificate (PEM) (optional)	Paste the whole key, including the BEGIN and END lines.
   Cluster name (optional)	—

   Or, instead: Kubeconfig (optional).

3. Click Connect with token.

Frameworks

Gatekeeper publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• Vendor Procurement connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks