本頁內容適用於 IT 管理員、營運人員和安全專家。這些人員會根據公司策略定義 IT 解決方案和系統架構，並提供及維護自動化功能，確保雲端平台中執行的所有資源都符合機構的法規遵循規定，以利稽核或強制執行。如要進一步瞭解我們在內容中提及的常見角色和範例工作，請參閱「常見的 GKE 使用者角色和工作」。 Google Cloud
您可以透過 Policy Controller，對 Kubernetes 叢集套用並強制執行可設定的政策。這些政策可以做為防護機制，協助您管理叢集和機群的最佳做法、安全性與法規遵循事宜。Policy Controller 以開放原始碼的 Open Policy Agent Gatekeeper 專案為基礎，並與 Google Cloud完全整合，內建可觀察性資訊主頁，且隨附完整的預建政策庫，適用於管控一般的安全防護措施與法規遵循情形。
您必須擁有 Google Kubernetes Engine (GKE) Enterprise 版授權，才能使用 Policy Controller。
Policy Controller 的優點
與 Google Cloud 整合：平台管理員可以使用 Google Cloud 控制台、Terraform 或 Google Cloud CLI，在連線至機群的任何叢集上安裝 Policy Controller。Policy Controller 可與其他服務搭配使用，例如 Config Sync、指標和 Cloud Monitoring。Google Cloud
Policy Controller 會使用名為「限制」的物件，強制讓叢集符合您的政策。您可以將限制視為政策的「建構區塊」。每項限制都會定義 Kubernetes API 的特定變更，允許或禁止在套用限制的叢集上進行。您可以設定政策，主動封鎖不符規定的 API 要求，或稽核叢集的設定並回報違規事項。無論是哪種情況，您都可以查看警告訊息，瞭解叢集發生哪些違規行為。您可以根據這些資訊修正問題。舉例來說，您可以使用下列個別限制：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-31 (世界標準時間)。"],[],[],null,["This page explains what Policy Controller is and how you can use it to help ensure\nyour Kubernetes clusters and workloads are running in a secure and compliant\nmanner.\n\nThis page is for IT administrators, Operators, and\nSecurity specialists who define IT solutions and system architecture\nin accordance with company strategy, and ensure that all resources running\nwithin the cloud platform meet organizational compliance requirements by\nproviding and maintaining automation to audit or enforce. To learn more about\ncommon roles and example tasks that we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nPolicy Controller enables the application and enforcement of programmable policies\nfor your Kubernetes clusters. These policies act as **guardrails** and can help\nwith best practices, security, and compliance management of your clusters and\nfleet. Based on the open source\n[Open Policy Agent Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/docs/)\nproject, Policy Controller is fully integrated with Google Cloud,\nincludes a built-in dashboard,\nfor observability, and comes with a full library of prebuilt policies for\ncommon security and compliance controls.\n\nPolicy Controller benefits\n\n- **Integrated with Google Cloud** : Platform admins can [install\n Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/installing-policy-controller) by using the Google Cloud console, by using Terraform, or by using Google Cloud CLI on any cluster connected to your fleet. Policy Controller works with other Google Cloud services like [Config Sync](/kubernetes-engine/enterprise/config-sync/docs/overview), [metrics](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-metrics), and Cloud Monitoring.\n- **Supports multiple enforcement points** : In addition to both audit and admission control for your cluster, Policy Controller can optionally enable a [shift-left\n approach](/architecture/devops/devops-tech-shifting-left-on-security) to [analyse and catch non-compliant changes](/kubernetes-engine/enterprise/policy-controller/docs/tutorials/app-policy-validation-ci-pipeline) prior to application.\n- **Prebuilt policy bundles** : Policy Controller comes with a full library of prebuilt policies for common security and compliance controls. These include both [Policy\n bundles](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles) and the [constraint template library](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library).\n- **Supports custom policies** : If policy customization is required beyond what is available using the [constraint template library](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library), Policy Controller additionally supports the development of custom [*constraint templates*](/kubernetes-engine/enterprise/policy-controller/docs/how-to/write-custom-constraint-templates).\n- **Built-in observability** : Policy Controller includes a Google Cloud console [dashboard](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-status), providing an overview for the state of all the policies applied to your fleet (including unregistered clusters). From the dashboard, view compliance and enforcement status to help you troubleshoot, and get opinionated recommendations to resolve policy violations.\n\nPolicy bundles\n\nYou can use policy bundles to apply a number of constraints that are grouped\nunder a specific Kubernetes standard, security, or compliance theme.\nFor example, you can use the following policy bundles:\n\n- [Enforce many of the same requirements as\n PodSecurityPolicies](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-constraints-to-enforce-pod-security), but with the added ability to audit your configuration before enforcing it, ensuring any policy changes aren't disruptive to running workloads.\n- [Use constraints compatible with\n Cloud Service Mesh](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-asm-security-policy) to audit the compliance of your mesh security vulnerabilities and best practices.\n- [Apply general best practices to your cluster resources](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-policy-essentials-v2022) to help strengthen your security posture.\n\n[Policy Controller bundles overview](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles)\nprovides more details and a list of currently available policy bundles.\n\nConstraints\n\nPolicy Controller enforces your clusters' compliance using objects called\n*constraints* . You can think of constraints as the \"building blocks\" of policy.\nEach constraint defines a specific change to the Kubernetes API that is allowed\nor disallowed on the cluster it's applied to. You can set policies to either\nactively block non-compliant API requests or\n[audit](/kubernetes-engine/enterprise/policy-controller/docs/how-to/auditing-constraints) the configuration of your\nclusters and report violations. In either case, you can view warning messages\nwith details on what violation occurred on a cluster. With that information, you\ncan remediate problems. For example, you can use the following individual\nconstraints:\n\n- [Require each namespace to have at least one\n label](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library#k8srequiredlabels). This constraint can be used to ensure accurate tracking of resource consumption when using GKE Usage Metering, for example.\n- [Restrict the repositories a given container image can be pulled from](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library#k8sallowedrepos). This constraint ensures any attempt to pull containers from unknown sources is denied, protecting your clusters from running potentially malicious software.\n- [Control whether or not a container can run in privileged mode](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library#k8spspprivilegedcontainer). This constraint controls the ability of any container to enable privileged mode, which gives you control over which containers (if any) can run with unrestricted policy.\n\nThese are just a few of the constraints provided in the [constraint template\nlibrary](/kubernetes-engine/enterprise/policy-controller/docs/latest/reference/constraint-template-library) included\nwith Policy Controller. This library contains numerous policies that you can use\nto help enforce best practices and limit risk. If you require more customization\nbeyond what is available in the constraint template library, you can also create\ncustom [constraint\ntemplates](/kubernetes-engine/enterprise/policy-controller/docs/how-to/write-custom-constraint-templates).\n\nConstraints can be applied directly to your clusters using the Kubernetes API,\nor distributed to a set of clusters from a centralized source, like a Git repository, by using [Config Sync](/kubernetes-engine/enterprise/config-sync/docs/config-sync-overview).\n\nWhat's next\n\n- [Install Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/installing-policy-controller).\n- [Learn about policy bundles](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles).\n- [Apply policy bundles](/kubernetes-engine/enterprise/policy-controller/docs/how-to/apply-policy-bundles)"]]
