opa-policies

# Skill: OPA Policies & Kyverno > **Expertise:** Gatekeeper ConstraintTemplates, Kyverno ClusterPolicies, validation + mutation + generation. ## When to load When writing admission policies, testing policy changes, or debugging policy-blocked deployments. ## Gatekeeper: ConstraintTemplate + Constraint ```yaml # 1. ConstraintTemplate — defines the policy logic in Rego apiVersion: templates.gatekeeper.sh/v1 kind: ConstraintTemplate metadata: name: k8srequirenonroot spec: crd: spec: names: { kind: K8sRequireNonRoot } targets: - target: admission.k8s.gatekeeper.sh rego: | package k8srequirenonroot violation[{"msg": msg}] { container := input.review.object.spec.containers[_] not container.securityContext.runAsNonRoot msg := sprintf("Container '%v' must set runAsNonRoot: true", [container.name]) } violation[{"msg": msg}] { container := input.review.object.spec.containers[_] container.securityContext.runAsUser == 0 msg := sprintf("Container '%v' must not run as UID 0", [container.name]) } --- # 2. Constraint — applies the template to specific resources/namespaces apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sRequireNonRoot metadata: name: require-non-root-production spec: enforcementAction: deny # deny | warn | dryrun match: kinds: - apiGroups: [apps] kinds: [Deployment, StatefulSet, DaemonSet] namespaceSelector: matchExpressions: - key: environment operator: In values: [production, staging] ``` ## Gatekeeper: Require Image Digest ```yaml apiVersion: templates.gatekeeper.sh/v1 kind: ConstraintTemplate metadata: name: k8srequireimagedigest spec: crd: spec: names: { kind: K8sRequireImageDigest } targets: - target: admission.k8s.gatekeeper.sh rego: | package k8srequireimagedigest violation[{"msg": msg}] { container := input.review.object.spec.containers[_] not contains(container.image, "@sha256:") msg := sprintf( "Container '%v' image '%v' must reference a digest (@sha256:...), not a mutable tag", [container.name, container.image] ) } ``` ## Kyverno: Simpler YAML Policies ```yaml # Disallow privileged containers (Kyverno) apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-privileged-containers spec: validationFailureAction: Enforce rules: - name: check-privileged match: any: - resources: kinds: [Pod] namespaces: [production, staging] validate: message: "Privileged containers are not allowed in production/staging" pattern: spec: containers: - =(securityContext): =(privileged): "false" ``` ```yaml # Kyverno MUTATION — auto-add security context defaults apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: add-default-securitycontext spec: rules: - name: add-security-context match: any: - resources: { kinds: [Pod] } mutate: patchStrategicMerge: spec: containers: - (name): "*" securityContext: +(runAsNonRoot): true +(allowPrivilegeEscalation): false +(readOnlyRootFilesystem): true ``` ## Policy Testing ```bash # OPA unit tests cat > policies/test_nonroot.rego << 'REGO' package k8srequirenonroot test_deny_root_container { violation[{"msg": _}] with input as { "review": {"object": {"spec": {"containers": [ {"name": "app", "securityContext": {"runAsUser": 0}} ]}}} } } test_allow_nonroot_container { count(violation) == 0 with input as { "review": {"object": {"spec": {"containers": [ {"name": "app", "securityContext": {"runAsNonRoot": true, "runAsUser": 1000}} ]}}} } } REGO opa test policies/ -v # Kyverno test with example manifests kyverno test . \ --test-case-selector "policy=disallow-privileged-containers" # Check which policies blocked a recent admission kubectl get events -n <ns> | grep "denied\|violated" ``` ## Debugging Policy Denials ```bash # See why a deployment was rejected kubectl describe deploy <n> -n <ns> # Look at Events section for: "admission webhook ... denied" # Check active constraints kubectl get constraints # Check constraint violations (audit mode) kubectl get k8srequirenonroot.constraints.gatekeeper.sh -o jsonpath='{.items[*].status.violations}' ```