Skip to main content Inicio Creadores xalgord xalgorix implementing-opa-gatekeeper-for-policy-enforcement
implementing-opa-gatekeeper-for-policy-enforcement Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/xalgord/xalgorix --skill implementing-opa-gatekeeper-for-policy-enforcementEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
name implementing-opa-gatekeeper-for-policy-enforcement description Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library. domain cybersecurity subdomain container-security tags ["opa","gatekeeper","kubernetes","admission-control","policy-as-code","rego"] version 1.0 author mahipal license Apache-2.0 nist_csf ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
Implementing OPA Gatekeeper for Policy Enforcement
Overview
OPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.
When to Use
When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
Constraint in dryrun/warn, not deny: a ConstraintTemplate plus Constraint left at enforcementAction: dryrun audits but never blocks. Verify: kubectl get constraints -o json | jq '.items[] | {name:.metadata.name, action:.spec.enforcementAction}'.Template without a Constraint: applying the ConstraintTemplate alone does nothing - you must also create the Constraint CR that instantiates it. Confirm both exist (kubectl get constrainttemplates and kubectl get <kind>).Webhook failurePolicy: Ignore: when Gatekeeper pods are down, requests are admitted unchecked (fail-open). For security-critical constraints prefer Fail, but scope namespaceSelector to avoid locking out the control plane.Over-broad exemptions: excludedNamespaces covering more than kube-system/gatekeeper-system quietly creates enforcement holes - review the Config CR.Audit lag / wrong Rego path: .status.violations populates on the audit interval, so pre-existing violators aren't instant; and a Rego rule reading input.review.object.spec.containers misses initContainers/ephemeralContainers.Verify enforcement: kubectl get <constraintKind> <name> -o jsonpath='{.status.violations}' for existing breaches, then kubectl apply a violating pod (e.g. privileged: true) and confirm it is
denied
Prerequisites
Kubernetes cluster v1.24+
Helm 3
kubectl with cluster-admin access
Familiarity with Rego policy language
Installing Gatekeeper
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm repo update
helm install gatekeeper gatekeeper/gatekeeper \
--namespace gatekeeper-system --create-namespace \
--set replicas=3 \
--set audit.replicas=1 \
--set audit.logLevel=INFO
kubectl get pods -n gatekeeper-system
kubectl get crd | grep gatekeeper
Verify Installation
kubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration
kubectl get crd constrainttemplates.templates.gatekeeper.sh
kubectl get crd configs.config.gatekeeper.sh
ConstraintTemplate Examples
1. Require Labels on Resources
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequiredlabels
spec:
crd:
spec:
names:
kind: K8sRequiredLabels
validation:
openAPIV3Schema:
type: object
properties:
labels:
type: array
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequiredlabels
violation[{"msg": msg, "details": {"missing_labels": missing }}] {
provided := {label | input.review.object.metadata.labels [label ]}
required := {label | label := input.parameters.labels [_ ]}
missing := required - provided
count(missing) > 0
msg := sprintf("Missing required labels: %v" , [missing ])
}
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: require-team-label
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Namespace" ]
- apiGroups: ["apps" ]
kinds: ["Deployment" ]
parameters:
labels:
- "team"
- "environment"
2. Block Privileged Containers
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sblockprivileged
spec:
crd:
spec:
names:
kind: K8sBlockPrivileged
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sblockprivileged
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.privileged == true
msg := sprintf("Privileged container not allowed: %v" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.initContainers [_ ]
container.securityContext.privileged == true
msg := sprintf("Privileged init container not allowed: %v" , [container.name ])
}
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
name: block-privileged-containers
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
namespaces:
- "production"
- "staging"
3. Restrict Container Image Registries
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sallowedrepos
spec:
crd:
spec:
names:
kind: K8sAllowedRepos
validation:
openAPIV3Schema:
type: object
properties:
repos:
type: array
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sallowedrepos
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not image_matches(container.image)
msg := sprintf("Container image %v is not from an allowed registry. Allowed: %v" , [container.image , input.parameters.repos ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.initContainers [_ ]
not image_matches(container.image)
msg := sprintf("Init container image %v is not from an allowed registry. Allowed: %v" , [container.image , input.parameters.repos ])
}
image_matches(image) {
repo := input.parameters.repos [_ ]
startswith(image , repo)
}
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: restrict-image-repos
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
parameters:
repos:
- "gcr.io/my-project/"
- "ghcr.io/my-org/"
- "registry.k8s.io/"
4. Enforce Resource Limits
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequirelimits
spec:
crd:
spec:
names:
kind: K8sRequireLimits
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequirelimits
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.resources.limits.cpu
msg := sprintf("Container %v has no CPU limit" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.resources.limits.memory
msg := sprintf("Container %v has no memory limit" , [container.name ])
}
5. Block Latest Image Tag
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sblocklatesttag
spec:
crd:
spec:
names:
kind: K8sBlockLatestTag
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sblocklatesttag
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
endswith(container.image , ":latest" )
msg := sprintf("Container %v uses ':latest' tag. Use specific version tags." , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not contains(container.image , ":" )
msg := sprintf("Container %v has no tag (defaults to latest). Use specific version tags." , [container.name ])
}
6. Enforce Read-Only Root Filesystem apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sreadonlyroot
spec:
crd:
spec:
names:
kind: K8sReadOnlyRoot
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sreadonlyroot
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.securityContext.readOnlyRootFilesystem
msg := sprintf("Container %v must have readOnlyRootFilesystem set to true ", [container.name])
}
Audit and Enforcement Modes
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
name: block-privileged-dryrun
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
Check Audit Violations
kubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations
kubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations // [] | length)}'
Gatekeeper Config (Exempt Namespaces) apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
name: config
namespace: gatekeeper-system
spec:
match:
- excludedNamespaces:
- kube-system
- gatekeeper-system
- calico-system
processes:
- "*"
Monitoring
kubectl port-forward -n gatekeeper-system svc/gatekeeper-webhook-service 8443:443
kubectl get --raw /metrics | grep gatekeeper
Best Practices
Start with dryrun - Deploy constraints in dryrun mode first, review violations, then switch to denyUse the policy library - Leverage https://github.com/open-policy-agent/gatekeeper-library for pre-built templatesExempt system namespaces - Always exclude kube-system and gatekeeper-systemVersion control policies - Store ConstraintTemplates and Constraints in GitMonitor audit results - Check constraint .status.violations regularlyTest Rego policies - Use opa test or Rego Playground before deployingCombine with admission webhooks - Layer Gatekeeper with Pod Security Admission for defense in depth 