Docs on how to create OPA Gatekeeper constraints using default templates

2026-09-25 20:48:11 +00:00 · 2020-04-14 01:16:22 -07:00
parent f47f80fe72
commit 9636e99268
1 changed files with 116 additions and 0 deletions
@@ -45,6 +45,8 @@ When OPA Gatekeeper is enabled, Rancher installs some templates by default.

 To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**

+For detailed steps on how to create constraints using these default templates, please refer [this section below](#Using-the-Default-Constraint-Templates)
+
 Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
   
 # Creating and Configuring Constraints
@@ -95,3 +97,117 @@ The detail view of each constraint lists information about the resource that vio

 **Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.

+# Using the Default Constraint Templates
+
+When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently there are following templates installed:
+
+1. **k8sallowedrepos** - Template that can be used to whitelist registries.
+1. **k8srequiredlabels** - Template that can be used to enforce desired Labels on specific Kubernetes objects.
+
+This section describes how to use these templates to create constraints for enforcing certain policies on the cluster via the **Dashboard** view.
+
+Currently it is not possible to create a constraint via "Edit as Form" by passing non-scalar parameters, but one can create it by using the **Edit As YAML** option.
+
+The constraint created can be edited using the form.
+
+## Constraint to whitelist registries
+
+Suppose you want to apply a policy that restricts creation of any Pods in your cluster to use images from a particular repository only,
+
+then you can create a constraint from the  **k8sallowedrepos** template.
+
+For example, suppose we want all "Pods" launched in the namespace "test" to use images only from "quay.io" registry.
+
+Steps to do that via Rancher's dashboard view are as follows:
+1. Enable OPA Gatekeeper using the cluster's **Dashboard** view
+1. Navigate to OPA Gatekeeper -> Constraints -> Create
+1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint
+1. The yaml specifies the parameter "repos" as defined by the "k8sallowedrepos" template schema.
+1. This constraint specifies that the image repository "quay.io" should be used by all "Pod" objects in "test" namespace.
+1. Notice that all the system namespaces are by default added to list of "excludedNamespaces"
+
+    ```yml
+    type: constraints.gatekeeper.sh.k8sallowedrepos
+    spec:
+      match:
+        excludedNamespaces:
+          - cattle-system
+          - gatekeeper-system
+          - ingress-nginx
+          - kube-node-lease
+          - kube-public
+          - kube-system
+          - security-scan
+        kinds:
+          - apiGroups: [""]
+            kinds: ["Pod"]
+        namespaces:
+          - "test"
+        labelSelector:
+          matchExpressions: []
+        namespaceSelector:
+          matchExpressions: []
+      parameters:
+        repos:
+          - "quay.io"
+      enforcementAction: deny
+    metadata:
+      name: test-repo-is-quay-io
+      annotations:
+        cattle.io/description: whitelist repo quay.io
+    ```
+
+1. After the above constraint is created, it will be listed under "K8sAllowedRepos" on the "Constraints" page.
+1. You can edit the constraint via form to change the namespaces and other information.
+1. Now if you navigate **Back to Rancher** and create a workload under "test" namespace with any image other than the "quay.io" registry,
+you will get an error from OPA Gatekeeper.
+
+
+## Constraint to enforce Labels
+
+Suppose you want to apply a policy that requires certain set of Labels present on Kubernetes resources of specific Kind, then you can create a constraint from the  **k8srequiredlabels** template.
+
+For example, suppose we want all "Namespaces" in the cluster to have labels "test".
+
+Steps to do that via Rancher's dashboard view are as follows:
+1. Enable OPA Gatekeeper using the cluster's **Dashboard** view.
+1. Navigate to OPA Gatekeeper -> Constraints -> Create.
+1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint.
+1. The yaml specifies the parameters "message" and "labels" as defined by the "k8srequiredlabels" template schema.
+1. This constraint defines that all "namespaces" must have a label "team" whose value should match the given "allowedRegex".
+1. Notice that all the system namespaces are by default added to list of "excludedNamespaces".
+
+    ```yml
+    type: constraints.gatekeeper.sh.k8srequiredlabels
+    spec:
+      match:
+        excludedNamespaces:
+          - cattle-system
+          - gatekeeper-system
+          - ingress-nginx
+          - kube-node-lease
+          - kube-public
+          - kube-system
+          - security-scan
+        kinds:
+          - apiGroups: [""]
+            kinds: ["Namespace"]
+        labelSelector:
+          matchExpressions: []
+        namespaceSelector:
+          matchExpressions: []
+      parameters:
+        message: "All namespaces must have an `team` label that points to your team name"
+        labels:
+          - key: team
+            allowedRegex: "^[a-zA-Z]+$"
+      enforcementAction: deny
+    metadata:
+      name: ns-must-have-label
+      annotations:
+        cattle.io/description: constraint for ns label
+    ```
+
+1. After the above constraint is created, it will be listed under "K8sRequiredLabels" on the "Constraints" page.
+1. You can edit the constraint via form to change the namespaces and other information.
+1. Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label "team", the create request should be denied.