Skip to main content Accueil Créateurs oyi77 1ai-skills implementing-opa-gatekeeper-for-policy-enforcement
implementing-opa-gatekeeper-for-policy-enforcement Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library. Use when working with implementing opa gatekeeper for policy enforcement.
Aller à l'installation Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/oyi77/1ai-skills --skill implementing-opa-gatekeeper-for-policy-enforcementLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... Métiers associés SOC
Basé sur la classification professionnelle SOC
name implementing-opa-gatekeeper-for-policy-enforcement description Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library. Use when working with implementing opa gatekeeper for policy enforcement. domain cybersecurity subdomain container-security tags ["opa","gatekeeper","kubernetes","admission-control","policy-as-code","rego"] version 1.0 author oyi77 license Apache-2.0 nist_csf ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]
Implementing OPA Gatekeeper for Policy Enforcement
Overview
OPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.
When to Use
Trigger phrases:
"implementing opa gatekeeper for policy enforcement"
"Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTempla"
When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Kubernetes cluster v1.24+
Helm 3
kubectl with cluster-admin access
Familiarity with Rego policy language
Installing Gatekeeper
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm repo update
helm install gatekeeper gatekeeper/gatekeeper \
--namespace gatekeeper-system --create-namespace \
--set replicas=3 \
--set audit.replicas=1 \
--set audit.logLevel=INFO
kubectl get pods -n gatekeeper-system
kubectl get crd | grep gatekeeper
Verify Installation
kubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration
kubectl get crd constrainttemplates.templates.gatekeeper.sh
kubectl get crd configs.config.gatekeeper.sh
ConstraintTemplate Examples
1. Require Labels on Resources
apiVersion: templates.gatekeeper.sh/v1
kind:
ConstraintTemplate
metadata:
name:
k8srequiredlabels
spec:
crd:
spec:
names:
kind:
K8sRequiredLabels
validation:
openAPIV3Schema:
type:
object
properties:
labels:
type:
array
items:
type:
string
targets:
-
target:
admission.k8s.gatekeeper.sh
rego:
|
package k8srequiredlabels
violation[{"msg":
msg,
"details":
"missing_labels":
missing
}]
provided
:=
label
|
input.review.object.metadata.labels
label
required
:=
label
|
label
:=
input.parameters.labels
_
missing
:=
required
-
provided
count(missing)
>
0
msg
:=
sprintf("Missing
required labels:
%v"
missing
)
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: require-team-label
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Namespace" ]
- apiGroups: ["apps" ]
kinds: ["Deployment" ]
parameters:
labels:
- "team"
- "environment"
2. Block Privileged Containers
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sblockprivileged
spec:
crd:
spec:
names:
kind: K8sBlockPrivileged
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sblockprivileged
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
container.securityContext.privileged == true
msg := sprintf("Privileged container not allowed: %v" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.initContainers [_ ]
container.securityContext.privileged == true
msg := sprintf("Privileged init container not allowed: %v" , [container.name ])
}
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
name: block-privileged-containers
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
namespaces:
- "production"
- "staging"
3. Restrict Container Image Registries
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sallowedrepos
spec:
crd:
spec:
names:
kind: K8sAllowedRepos
validation:
openAPIV3Schema:
type: object
properties:
repos:
type: array
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sallowedrepos
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not image_matches(container.image)
msg := sprintf("Container image %v is not from an allowed registry. Allowed: %v" , [container.image , input.parameters.repos ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.initContainers [_ ]
not image_matches(container.image)
msg := sprintf("Init container image %v is not from an allowed registry. Allowed: %v" , [container.image , input.parameters.repos ])
}
image_matches(image) {
repo := input.parameters.repos [_ ]
startswith(image , repo)
}
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: restrict-image-repos
spec:
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
parameters:
repos:
- "gcr.io/my-project/"
- "ghcr.io/my-org/"
- "registry.k8s.io/"
4. Enforce Resource Limits
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequirelimits
spec:
crd:
spec:
names:
kind: K8sRequireLimits
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequirelimits
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.resources.limits.cpu
msg := sprintf("Container %v has no CPU limit" , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.resources.limits.memory
msg := sprintf("Container %v has no memory limit" , [container.name ])
}
5. Block Latest Image Tag
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sblocklatesttag
spec:
crd:
spec:
names:
kind: K8sBlockLatestTag
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sblocklatesttag
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
endswith(container.image , ":latest" )
msg := sprintf("Container %v uses ':latest' tag. Use specific version tags." , [container.name ])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not contains(container.image , ":" )
msg := sprintf("Container %v has no tag (defaults to latest). Use specific version tags." , [container.name ])
}
6. Enforce Read-Only Root Filesystem apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8sreadonlyroot
spec:
crd:
spec:
names:
kind: K8sReadOnlyRoot
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8sreadonlyroot
violation[{"msg": msg}] {
container := input.review.object.spec.containers [_ ]
not container.securityContext.readOnlyRootFilesystem
msg := sprintf("Container %v must have readOnlyRootFilesystem set to true ", [container.name])
}
Audit and Enforcement Modes
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
name: block-privileged-dryrun
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups: ["" ]
kinds: ["Pod" ]
Check Audit Violations
kubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations
kubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations // [] | length)}'
Gatekeeper Config (Exempt Namespaces) apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
name: config
namespace: gatekeeper-system
spec:
match:
- excludedNamespaces:
- kube-system
- gatekeeper-system
- calico-system
processes:
- "*"
Monitoring
kubectl port-forward -n gatekeeper-system svc/gatekeeper-webhook-service 8443:443
kubectl get --raw /metrics | grep gatekeeper
Best Practices
Start with dryrun - Deploy constraints in dryrun mode first, review violations, then switch to denyUse the policy library - Leverage https://github.com/open-policy-agent/gatekeeper-library for pre-built templatesExempt system namespaces - Always exclude kube-system and gatekeeper-systemVersion control policies - Store ConstraintTemplates and Constraints in GitMonitor audit results - Check constraint .status.violations regularlyTest Rego policies - Use opa test or Rego Playground before deployingCombine with admission webhooks - Layer Gatekeeper with Pod Security Admission for defense in depth
When NOT to Use
You need to test the implementation (use performing-* skills)
Task is about configuring existing tools (use configuring-* skills)
You need to analyze security events (use analyzing-* skills)
Task is about building detection rules (use building-* skills)
You don't have access to the target environment
Task requires vendor-specific expertise (consult vendor docs)
Red Flags
Performing actions without explicit written authorization from the asset owner
Testing against production systems without a defined scope and rules of engagement
Modifying cloud IAM policies or security groups without approval
Exposing cloud credentials or secrets in logs or reports
Running scans that generate excessive API calls and trigger billing alerts
Verification
All steps executed successfully against a test environment before production use
Output documented with screenshots or logs demonstrating expected behavior
Cloud resource changes reverted or documented as intentional
IAM policies reviewed for least-privilege compliance after testing
No residual test resources left running (cost and security check)
Process
Analyze the task requirements
Apply domain expertise
Verify output quality
Anti-Rationalization Table Rationalization Reality "We are too small to be targeted" Automated attacks target everyone. Size does not matter. "Security slows us down" A breach slows you down 100x more. Build security in from the start. "We will fix it after launch" Vulnerabilities in production are exploited within hours. Fix before deploy.
