From 9c3755a73a31cb3f40328adb4cd1358cb88be8a1 Mon Sep 17 00:00:00 2001 From: Venkata Krishna Rohit Sakala Date: Mon, 7 Oct 2024 11:27:20 -0700 Subject: [PATCH 1/4] Remove OPA Gatekeeper docs OPA Gatekeeper is no longer available from 2.10 Rancher. So removing the docs related to it. --- .../integrations-in-rancher/opa-gatekeeper.md | 117 ------------------ .../reference-guides/rancher-cluster-tools.md | 6 - sidebars.js | 1 - 3 files changed, 124 deletions(-) delete mode 100644 docs/integrations-in-rancher/opa-gatekeeper.md diff --git a/docs/integrations-in-rancher/opa-gatekeeper.md b/docs/integrations-in-rancher/opa-gatekeeper.md deleted file mode 100644 index cea9732b36c..00000000000 --- a/docs/integrations-in-rancher/opa-gatekeeper.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: OPA Gatekeeper ---- - - - - - - - -To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. - -OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making. - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is a project that provides integration between OPA and Kubernetes. OPA Gatekeeper provides: - -- An extensible, parameterized policy library. -- Native Kubernetes CRDs for instantiating the policy library, also called “constraints." -- Native Kubernetes CRDs for extending the policy library, also called "constraint templates." -- Audit functionality. - -To read more about OPA, please refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/) - -## How the OPA Gatekeeper Integration Works - -Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies. - -OPA Gatekeeper is made available via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.` - -## Enabling OPA Gatekeeper in a Cluster - -:::note - -In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh`. - -::: - -:::note Prerequisite: - -Only administrators and cluster owners can enable OPA Gatekeeper. - -::: - -The OPA Gatekeeper Helm chart can be installed from **Apps**. - -### Enabling OPA Gatekeeper - -1. In the upper left corner, click **☰ > Cluster Management**. -1. In the **Clusters** page, go to the cluster where you want to enable OPA Gatekeeper and click **Explore**. -1. In the left navigation bar, click **Apps**. -1. Click **Charts** and click **OPA Gatekeeper**. -1. Click **Install**. - -**Result:** OPA Gatekeeper is deployed in your Kubernetes cluster. - -## Constraint Templates - -[Constraint templates](https://github.com/open-policy-agent/gatekeeper#constraint-templates) are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/policy-language/) - -When OPA Gatekeeper is enabled, Rancher installs some templates by default. - -To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates**. - -Rancher also provides the ability to create your own constraint templates by importing YAML definitions. - -## Creating and Configuring Constraints - -[Constraints](https://github.com/open-policy-agent/gatekeeper#constraints) are Kubernetes custom resources that define the scope of objects to which a specific constraint template applies to. The complete policy is defined by constraint templates and constraints together. - -:::note Prerequisite: - -OPA Gatekeeper must be enabled in the cluster. - -::: - -To list the constraints installed, go to the left side menu under OPA Gatekeeper, and click on **Constraints**. - -New constraints can be created from a constraint template. - -Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields. - -The **Edit as yaml** option is also available to configure the the constraint's yaml definition. - -### Exempting Rancher's System Namespaces from Constraints - -When a constraint is created, ensure that it does not apply to any Rancher or Kubernetes system namespaces. If the system namespaces are not excluded, then it is possible to see many resources under them marked as violations of the constraint. - -To limit the scope of the constraint only to user namespaces, always specify these namespaces under the **Match** field of the constraint. - -Also, the constraint may interfere with other Rancher functionality and deny system workloads from being deployed. To avoid this, exclude all Rancher-specific namespaces from your constraints. - -## Enforcing Constraints in your Cluster - -When the **Enforcement Action** is **Deny,** the constraint is immediately enabled and will deny any requests that violate the policy defined. By default, the enforcement value is **Deny**. - -When the **Enforcement Action** is **Dryrun,** then any resources that violate the policy are only recorded under the constraint's status field. - -To enforce constraints, create a constraint using the form. In the **Enforcement Action** field, choose **Deny**. - -## Audit and Violations in your Cluster - -OPA Gatekeeper runs a periodic audit to check if any existing resource violates any enforced constraint. The audit-interval (default 300s) can be configured while installing Gatekeeper. - -On the Gatekeeper page, any violations of the defined constraints are listed. - -Also under **Constraints,** the number of violations of the constraint can be found. - -The detail view of each constraint lists information about the resource that violated the constraint. - -## Disabling Gatekeeper - -1. Navigate to the cluster's Dashboard view -1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper**. -1. Click the **⋮ > Disable**. - -**Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted. - diff --git a/docs/reference-guides/rancher-cluster-tools.md b/docs/reference-guides/rancher-cluster-tools.md index 4607ae59035..ad46fbdd9d2 100644 --- a/docs/reference-guides/rancher-cluster-tools.md +++ b/docs/reference-guides/rancher-cluster-tools.md @@ -42,12 +42,6 @@ Rancher's integration with Istio was improved in Rancher v2.5. For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md) -## OPA Gatekeeper - - - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.](../integrations-in-rancher/opa-gatekeeper.md) - ## CIS Scans Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. diff --git a/sidebars.js b/sidebars.js index b5766e2fd9a..12a6e77233e 100644 --- a/sidebars.js +++ b/sidebars.js @@ -1292,7 +1292,6 @@ const sidebars = { "integrations-in-rancher/monitoring-and-alerting/promql-expressions", ] }, - "integrations-in-rancher/opa-gatekeeper", "integrations-in-rancher/rancher-extensions", ] }, From e12d7b2f11e6c481f04811ad72363dc28d0f3d1d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 29 Oct 2024 14:33:18 -0700 Subject: [PATCH 2/4] Remove other OPA Gatekeeper refs --- .../pod-security-standards.md | 2 +- .../new-user-guides/manage-clusters/manage-clusters.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md index 7b55b963fda..5e8f2ee3b58 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md @@ -13,7 +13,7 @@ PSS define security levels for workloads. PSAs describe requirements for pod sec ## Upgrade to Pod Security Standards (PSS) -Ensure that you migrate all PSPs to another workload security mechanism. This includes mapping your current PSPs to Pod Security Standards for enforcement with the [PSA controller](https://kubernetes.io/docs/concepts/security/pod-security-admission/). If the PSA controller won't meet all of your organization's needs, we recommend that you use a policy engine, such as [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper), [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), or [NeuVector](https://neuvector.com/). Refer to the documentation of your policy engine of choice for more information on how to migrate from PSPs. +Ensure that you migrate all PSPs to another workload security mechanism. This includes mapping your current PSPs to Pod Security Standards for enforcement with the [PSA controller](https://kubernetes.io/docs/concepts/security/pod-security-admission/). If the PSA controller won't meet all of your organization's needs, we recommend that you use a policy engine, such as [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), or [NeuVector](https://neuvector.com/). Refer to the documentation of your policy engine of choice for more information on how to migrate from PSPs. :::caution You must add your new policy enforcement mechanisms _before_ you remove the PodSecurityPolicy objects. If you don't, you may create an opportunity for privilege escalation attacks within the cluster. diff --git a/docs/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md b/docs/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md index eafa50faff9..a694c2f77c2 100644 --- a/docs/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md +++ b/docs/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md @@ -31,6 +31,5 @@ Rancher contains a variety of tools that aren't included in Kubernetes to assist - Logging - Monitoring - Istio Service Mesh -- OPA Gatekeeper Tools can be installed through **Apps.** From dbd4dfa688c237dd7c7abbc6527d9bbcb661388b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 29 Oct 2024 14:39:27 -0700 Subject: [PATCH 3/4] Apply 9c3755a7 and e12d7b2f (Remove OPA Gatekeeper docs) to en/zh 2.10 docs --- .../pod-security-standards.md | 2 +- .../manage-clusters/manage-clusters.md | 1 - .../integrations-in-rancher/opa-gatekeeper.md | 111 ----------------- .../reference-guides/rancher-cluster-tools.md | 5 +- .../pod-security-standards.md | 2 +- .../manage-clusters/manage-clusters.md | 1 - .../integrations-in-rancher/opa-gatekeeper.md | 117 ------------------ .../reference-guides/rancher-cluster-tools.md | 6 - versioned_sidebars/version-2.10-sidebars.json | 1 - 9 files changed, 3 insertions(+), 243 deletions(-) delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md delete mode 100644 versioned_docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md index 7c16ac10192..75053324a0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md @@ -9,7 +9,7 @@ PSS 定义了工作负载的安全级别。PSA 描述了 Pod 安全上下文和 ## 升级到 Pod 安全标准 (PSS) -确保将所有 PSP 都迁移到了另一个工作负载安全机制，包括将你当前的 PSP 映射到 Pod 安全标准，以便使用 [PSA 控制器](https://kubernetes.io/docs/concepts/security/pod-security-admission/)执行。如果 PSA 控制器不能满足企业的所有需求，建议你使用策略引擎，例如 [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper)、[Kubewarden](https://www.kubewarden.io/)、[Kyverno](https://kyverno.io/) 或 [NeuVector](https://neuvector.com/)。有关如何迁移 PSP 的更多信息，请参阅你选择的策略引擎的文档。 +确保将所有 PSP 都迁移到了另一个工作负载安全机制，包括将你当前的 PSP 映射到 Pod 安全标准，以便使用 [PSA 控制器](https://kubernetes.io/docs/concepts/security/pod-security-admission/)执行。如果 PSA 控制器不能满足企业的所有需求，建议你使用策略引擎，例如 [Kubewarden](https://www.kubewarden.io/)、[Kyverno](https://kyverno.io/) 或 [NeuVector](https://neuvector.com/)。有关如何迁移 PSP 的更多信息，请参阅你选择的策略引擎的文档。 :::caution 必须在删除 PodSecurityPolicy 对象_之前_添加新的策略执行机制。否则，你可能会为集群内的特权升级攻击创造机会。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md index a1c89025444..c6de1117793 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md @@ -31,6 +31,5 @@ Rancher 包含 Kubernetes 中未包含的各种工具来协助你进行 DevOps - Logging - Monitoring - Istio 服务网格 -- OPA Gatekeeper 你可以通过 **Apps** 来安装工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md deleted file mode 100644 index 41c91274c66..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: OPA Gatekeeper ---- - -为了确保一致性和合规性，每个组织都需要能够以自动化的方式在环境中定义和执行策略。[OPA（Open Policy Agent）](https://www.openpolicyagent.org/) 是一个策略引擎，用于基于策略控制云原生环境。Rancher 支持在 Kubernetes 集群中启用 OPA Gatekeeper，并且还安装了一些内置的策略定义（也称为约束模板）。 - -OPA 提供了一种高级声明性语言，可以让你将策略指定为代码，还能扩展简单的 API，从而减轻策略决策的负担。 - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) 是一个提供 OPA 和 Kubernetes 集成的项目。OPA Gatekeeper 提供： - -- 一个可扩展的参数化策略库。 -- 用于实例化策略库的原生 Kubernetes CRD，也称为“约束”。 -- 用于扩展策略库的原生 Kubernetes CRD，也称为“约束模板”。 -- 审计功能。 - -要了解更多关于 OPA 的信息，请参阅[官方文档](https://www.openpolicyagent.org/docs/latest/)。 - -## OPA Gatekeeper 集成的工作原理 - -Kubernetes 支持通过准入控制器（准入控制器）webhook 来扩展 API Server 的功能，创建、更新或删除资源时都会调用这些 webhook。Gatekeeper 作为验证 webhook 安装，并执行由 Kubernetes CRD（Custom Resource Definition）定义的策略。除了使用准入控制之外，Gatekeeper 还能审计 Kubernetes 集群中的现有资源，并对违反当前策略的情况进行标记。 - -OPA Gatekeeper 由 Rancher 的 Helm system Chart 提供，它安装在名为 `gatekeeper-system` 的命名空间中。 - -## 在集群中启用 OPA Gatekeeper - -:::note - -Rancher 2.5 改进了 OPA Gatekeeper 应用。无法从 Rancher 2.4 升级到 Rancher 2.5 中的新版本。如果你在 Rancher 2.4 中安装了 OPA Gatekeeper，则需要在旧 UI 中卸载 OPA Gatekeeper 及其 CRD，然后在 Rancher 2.5 中重新安装它。如需卸载 CRD，请在 kubectl 控制台中运行 `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh` 命令。 - -::: - -:::note 先决条件： - -只有管理员和集群所有者才能启用 OPA Gatekeeper。 - -::: - -你可以在 **Apps** 页面安装 OPA Gatekeeper Helm Chart。 - -### 启用 OPA Gatekeeper - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**页面中，转到要启用 OPA Gatekeeper 的集群，然后单击 **Explore**。 -1. 在左侧导航栏中，点击 **Apps**。 -1. 点击 **Charts** 并点击 **OPA Gatekeeper**。 -1. 单击**安装**。 - -**结果**：已将 OPA Gatekeeper 部署到你的 Kubernetes 集群。 - -## 约束模板 - -[约束模板](https://github.com/open-policy-agent/gatekeeper#constraint-templates)是 Kubernetes 自定义资源，用于定义要由 Gatekeeper 应用的 OPA 策略的架构和 Rego 逻辑。有关 Rego 策略语言的更多信息，请参阅[官方文档](https://www.openpolicyagent.org/docs/latest/policy-language/)。 - -启用 OPA Gatekeeper 后，Rancher 默认会安装一些模板。 - -要列出集群中安装的约束模板，请转到 OPA Gatekeeper 下的左侧菜单，然后单击**模板**。 - -Rancher 还支持通过导入 YAML 定义来创建你自己的约束模板。 - -## 创建和配置约束 - -[约束](https://github.com/open-policy-agent/gatekeeper#constraints)是 Kubernetes 自定义资源，用于定义要应用约束模板的对象范围。约束模板和约束共同定义一个完整的策略。 - -:::note 先决条件： - -集群中已启用 OPA Gatekeeper。 - -::: - -要列出已安装的约束，请转到 OPA Gatekeeper 下的左侧菜单，然后单击**约束**。 - -可以从约束模板创建新的约束。 - -Rancher 支持通过使用方便的表单来创建约束，你可以在该表单中输入各种约束字段。 - -**以 YAML 文件编辑**选项也可以用于配置约束的 YAML 定义。 - -### 使 Rancher 的 System 命名空间不受约束 - -创建约束时，请确保该约束不应用于任何 Rancher 或 Kubernetes System 命名空间。如果不排除 System 命名空间，则可能会出现 system 命名空间下的许多资源被标记为违反约束。 - -要让约束仅限制用户命名空间，请在约束的**匹配**字段下指定这些命名空间。 - -此外，该约束可能会干扰其他 Rancher 功能并拒绝部署系统工作负载。为避免这种情况，请从你的约束中排除所有 Rancher 特定的命名空间。 - -## 在集群中实施约束 - -如果**执行动作**为 **Deny**，约束会立即启用，并拒绝任何违反策略的请求。默认情况下，执行的值为 **Deny**。 - -如果**执行动作** 为 **Dryrun**，违反策略的资源仅会记录在约束的状态字段中。 - -要强制执行约束，请使用表单创建约束。在**执行动作**字段中，选择 **Deny**。 - -## 集群中的审计和违规 - -OPA Gatekeeper 运行定期审计，以检查现有资源是否违反强制执行的约束。你可以在安装 Gatekeeper 时配置审计间隔（默认 300 秒）。 - -Gatekeeper 页面上列出了违反已定义的约束的情况。 - -此外，你也可以在**约束**页面中找到违反约束的数量。 - -每个约束的详细信息视图列出了违反约束的资源的信息。 - -## 禁用 Gatekeeper - -1. 导航到集群的仪表板视图。 -1. 在左侧菜单中，展开集群菜单并单击 **OPA Gatekeeper**。 -1. 单击 **⋮ > 禁用**。 - -**结果**：禁用 OPA Gatekeeper 后，所有约束模板和约束也将被删除。 - diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-cluster-tools.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-cluster-tools.md index e454be93e76..29a448f3a1f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-cluster-tools.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-cluster-tools.md @@ -4,7 +4,6 @@ title: 集群工具：Logging，Monitoring 和可视化 Rancher 包含 Kubernetes 中未包含的各种工具来协助你进行 DevOps 操作。Rancher 可以与外部服务集成，让你的集群更高效地运行。工具分为以下几类： - ## Logging Logging 支持： @@ -18,6 +17,7 @@ Logging 支持： Rancher 可以与 Elasticsearch、splunk、kafka、syslog 和 fluentd 集成。 有关详细信息，请参阅 [Logging 文档](../integrations-in-rancher/logging/logging.md)。 + ## 监控和告警 你可以使用 Rancher，通过业界领先并开源的 [Prometheus](https://prometheus.io/) 来监控集群节点、Kubernetes 组件和软件部署的状态和进程。 @@ -37,9 +37,6 @@ Rancher 可以与 Elasticsearch、splunk、kafka、syslog 和 fluentd 集成。 Rancher v2.5 改进了与 Istio 的集成。 如需更多信息，请参阅 [Istio 文档](..//integrations-in-rancher/istio/istio.md)。 -## OPA Gatekeeper - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) 是一个开源项目，它对 OPA 和 Kubernetes 进行了集成，以通过许可控制器 Webhook 提供策略控制。有关如何在 Rancher 中启用 Gatekeeper 的详细信息，请参阅 [OPA Gatekeeper](../integrations-in-rancher/opa-gatekeeper.md)。 ## CIS 扫描 diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md index 7b55b963fda..5e8f2ee3b58 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md @@ -13,7 +13,7 @@ PSS define security levels for workloads. PSAs describe requirements for pod sec ## Upgrade to Pod Security Standards (PSS) -Ensure that you migrate all PSPs to another workload security mechanism. This includes mapping your current PSPs to Pod Security Standards for enforcement with the [PSA controller](https://kubernetes.io/docs/concepts/security/pod-security-admission/). If the PSA controller won't meet all of your organization's needs, we recommend that you use a policy engine, such as [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper), [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), or [NeuVector](https://neuvector.com/). Refer to the documentation of your policy engine of choice for more information on how to migrate from PSPs. +Ensure that you migrate all PSPs to another workload security mechanism. This includes mapping your current PSPs to Pod Security Standards for enforcement with the [PSA controller](https://kubernetes.io/docs/concepts/security/pod-security-admission/). If the PSA controller won't meet all of your organization's needs, we recommend that you use a policy engine, such as [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), or [NeuVector](https://neuvector.com/). Refer to the documentation of your policy engine of choice for more information on how to migrate from PSPs. :::caution You must add your new policy enforcement mechanisms _before_ you remove the PodSecurityPolicy objects. If you don't, you may create an opportunity for privilege escalation attacks within the cluster. diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md index eafa50faff9..a694c2f77c2 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/manage-clusters.md @@ -31,6 +31,5 @@ Rancher contains a variety of tools that aren't included in Kubernetes to assist - Logging - Monitoring - Istio Service Mesh -- OPA Gatekeeper Tools can be installed through **Apps.** diff --git a/versioned_docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md b/versioned_docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md deleted file mode 100644 index cea9732b36c..00000000000 --- a/versioned_docs/version-2.10/integrations-in-rancher/opa-gatekeeper.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: OPA Gatekeeper ---- - - - - - - - -To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. - -OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making. - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is a project that provides integration between OPA and Kubernetes. OPA Gatekeeper provides: - -- An extensible, parameterized policy library. -- Native Kubernetes CRDs for instantiating the policy library, also called “constraints." -- Native Kubernetes CRDs for extending the policy library, also called "constraint templates." -- Audit functionality. - -To read more about OPA, please refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/) - -## How the OPA Gatekeeper Integration Works - -Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies. - -OPA Gatekeeper is made available via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.` - -## Enabling OPA Gatekeeper in a Cluster - -:::note - -In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh`. - -::: - -:::note Prerequisite: - -Only administrators and cluster owners can enable OPA Gatekeeper. - -::: - -The OPA Gatekeeper Helm chart can be installed from **Apps**. - -### Enabling OPA Gatekeeper - -1. In the upper left corner, click **☰ > Cluster Management**. -1. In the **Clusters** page, go to the cluster where you want to enable OPA Gatekeeper and click **Explore**. -1. In the left navigation bar, click **Apps**. -1. Click **Charts** and click **OPA Gatekeeper**. -1. Click **Install**. - -**Result:** OPA Gatekeeper is deployed in your Kubernetes cluster. - -## Constraint Templates - -[Constraint templates](https://github.com/open-policy-agent/gatekeeper#constraint-templates) are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/policy-language/) - -When OPA Gatekeeper is enabled, Rancher installs some templates by default. - -To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates**. - -Rancher also provides the ability to create your own constraint templates by importing YAML definitions. - -## Creating and Configuring Constraints - -[Constraints](https://github.com/open-policy-agent/gatekeeper#constraints) are Kubernetes custom resources that define the scope of objects to which a specific constraint template applies to. The complete policy is defined by constraint templates and constraints together. - -:::note Prerequisite: - -OPA Gatekeeper must be enabled in the cluster. - -::: - -To list the constraints installed, go to the left side menu under OPA Gatekeeper, and click on **Constraints**. - -New constraints can be created from a constraint template. - -Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields. - -The **Edit as yaml** option is also available to configure the the constraint's yaml definition. - -### Exempting Rancher's System Namespaces from Constraints - -When a constraint is created, ensure that it does not apply to any Rancher or Kubernetes system namespaces. If the system namespaces are not excluded, then it is possible to see many resources under them marked as violations of the constraint. - -To limit the scope of the constraint only to user namespaces, always specify these namespaces under the **Match** field of the constraint. - -Also, the constraint may interfere with other Rancher functionality and deny system workloads from being deployed. To avoid this, exclude all Rancher-specific namespaces from your constraints. - -## Enforcing Constraints in your Cluster - -When the **Enforcement Action** is **Deny,** the constraint is immediately enabled and will deny any requests that violate the policy defined. By default, the enforcement value is **Deny**. - -When the **Enforcement Action** is **Dryrun,** then any resources that violate the policy are only recorded under the constraint's status field. - -To enforce constraints, create a constraint using the form. In the **Enforcement Action** field, choose **Deny**. - -## Audit and Violations in your Cluster - -OPA Gatekeeper runs a periodic audit to check if any existing resource violates any enforced constraint. The audit-interval (default 300s) can be configured while installing Gatekeeper. - -On the Gatekeeper page, any violations of the defined constraints are listed. - -Also under **Constraints,** the number of violations of the constraint can be found. - -The detail view of each constraint lists information about the resource that violated the constraint. - -## Disabling Gatekeeper - -1. Navigate to the cluster's Dashboard view -1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper**. -1. Click the **⋮ > Disable**. - -**Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted. - diff --git a/versioned_docs/version-2.10/reference-guides/rancher-cluster-tools.md b/versioned_docs/version-2.10/reference-guides/rancher-cluster-tools.md index 4607ae59035..ad46fbdd9d2 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-cluster-tools.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-cluster-tools.md @@ -42,12 +42,6 @@ Rancher's integration with Istio was improved in Rancher v2.5. For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md) -## OPA Gatekeeper - - - -[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.](../integrations-in-rancher/opa-gatekeeper.md) - ## CIS Scans Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. diff --git a/versioned_sidebars/version-2.10-sidebars.json b/versioned_sidebars/version-2.10-sidebars.json index 072459e5228..7af1666eee9 100644 --- a/versioned_sidebars/version-2.10-sidebars.json +++ b/versioned_sidebars/version-2.10-sidebars.json @@ -1253,7 +1253,6 @@ "integrations-in-rancher/monitoring-and-alerting/promql-expressions" ] }, - "integrations-in-rancher/opa-gatekeeper", "integrations-in-rancher/rancher-extensions" ] }, From 770c5bfed25378a427c79dbea4cb3a9b338b8f6a Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 29 Oct 2024 15:27:35 -0700 Subject: [PATCH 4/4] Remove redirect to OPA Gatekeeper page --- docusaurus.config.js | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 08b580edf08..708f4eef94f 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -2544,10 +2544,6 @@ module.exports = { to: '/integrations-in-rancher/neuvector', from: '/explanations/integrations-in-rancher/neuvector' }, - { - to: '/integrations-in-rancher/opa-gatekeeper', - from: '/explanations/integrations-in-rancher/opa-gatekeeper' - }, { to: '/v2.6/faq/general-faq', from: '/v2.6/faq'