Files
rancher-docs/integrations-in-rancher/opa-gatekeeper.html
T

26 lines
31 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-integrations-in-rancher/opa-gatekeeper">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.3.1">
<title data-rh="true">OPA Gatekeeper | Rancher</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://ranchermanager.docs.rancher.com/integrations-in-rancher/opa-gatekeeper"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="OPA Gatekeeper | Rancher"><meta data-rh="true" name="description" content="To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates."><meta data-rh="true" property="og:description" content="To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates."><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/opa-gatekeeper"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/opa-gatekeeper" hreflang="en"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/zh/integrations-in-rancher/opa-gatekeeper" hreflang="zh"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/opa-gatekeeper" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="preconnect" href="https://www.googletagmanager.com">
<script>window.dataLayer=window.dataLayer||[]</script>
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<link rel="search" type="application/opensearchdescription+xml" title="Rancher" href="/opensearch.xml">
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
<link rel="preload" href="/assets/js/runtime~main.5e8050ed.js" as="script">
<link rel="preload" href="/assets/js/main.7c8ccb50.js" as="script">
</head>
<body class="navigation-with-keyboard">
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/integrations-in-rancher/opa-gatekeeper">Latest</a></li><li><a class="dropdown__link" href="/v2.7/integrations-in-rancher/opa-gatekeeper">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/integrations-in-rancher/opa-gatekeeper">v2.6</a></li><li><a class="dropdown__link" href="/v2.5">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/integrations-in-rancher/opa-gatekeeper" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/integrations-in-rancher/opa-gatekeeper" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/getting-started/overview">Getting Started</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/new-user-guides">How-to Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/best-practices">Reference Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/pages-for-subheaders/cloud-marketplace">Integrations in Rancher</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/cloud-marketplace">Cloud Marketplace Integration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Cloud Marketplace Integration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/cis-scans">CIS Scans</a><button aria-label="Toggle the collapsible sidebar category &#x27;CIS Scans&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/fleet-gitops-at-scale">Continuous Delivery with Fleet</a><button aria-label="Toggle the collapsible sidebar category &#x27;Continuous Delivery with Fleet&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/integrations-in-rancher/harvester">Harvester Integration</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/istio">Istio</a><button aria-label="Toggle the collapsible sidebar category &#x27;Istio&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/integrations-in-rancher/longhorn">Longhorn - Cloud native distributed block storage for Kubernetes</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/logging">Logging</a><button aria-label="Toggle the collapsible sidebar category &#x27;Logging&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/monitoring-and-alerting">Monitoring and Alerting</a><button aria-label="Toggle the collapsible sidebar category &#x27;Monitoring and Alerting&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/integrations-in-rancher/neuvector">NeuVector Integration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/integrations-in-rancher/opa-gatekeeper">OPA Gatekeeper</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/integrations-in-rancher/rancher-extensions">Rancher Extensions</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/faq/general-faq">FAQ</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/troubleshooting/general-troubleshooting">Troubleshooting</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/contribute-to-rancher">Contributing to Rancher</a></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Integrations in Rancher</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">OPA Gatekeeper</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: Latest</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>OPA Gatekeeper</h1></header><p>To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. <a href="https://www.openpolicyagent.org/" target="_blank" rel="noopener noreferrer">OPA (Open Policy Agent)</a> is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates.</p><p>OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making.</p><p><a href="https://github.com/open-policy-agent/gatekeeper" target="_blank" rel="noopener noreferrer">OPA Gatekeeper</a> is a project that provides integration between OPA and Kubernetes. OPA Gatekeeper provides:</p><ul><li>An extensible, parameterized policy library.</li><li>Native Kubernetes CRDs for instantiating the policy library, also called “constraints.&quot;</li><li>Native Kubernetes CRDs for extending the policy library, also called &quot;constraint templates.&quot;</li><li>Audit functionality.</li></ul><p>To read more about OPA, please refer to the <a href="https://www.openpolicyagent.org/docs/latest/" target="_blank" rel="noopener noreferrer">official documentation.</a></p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="how-the-opa-gatekeeper-integration-works">How the OPA Gatekeeper Integration Works<a href="#how-the-opa-gatekeeper-integration-works" class="hash-link" aria-label="Direct link to How the OPA Gatekeeper Integration Works" title="Direct link to How the OPA Gatekeeper Integration Works">​</a></h2><p>Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies.</p><p>OPA Gatekeeper is made available via Rancher&#x27;s Helm system chart, and it is installed in a namespace named <code>gatekeeper-system.</code></p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="enabling-opa-gatekeeper-in-a-cluster">Enabling OPA Gatekeeper in a Cluster<a href="#enabling-opa-gatekeeper-in-a-cluster" class="hash-link" aria-label="Direct link to Enabling OPA Gatekeeper in a Cluster" title="Direct link to Enabling OPA Gatekeeper in a Cluster">​</a></h2><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</div><div class="admonitionContent_S0QG"><p>In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can&#x27;t be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console <code>kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh</code>.</p></div></div><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>Prerequisite:</div><div class="admonitionContent_S0QG"><p>Only administrators and cluster owners can enable OPA Gatekeeper.</p></div></div><p>The OPA Gatekeeper Helm chart can be installed from <strong>Apps</strong>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="enabling-opa-gatekeeper">Enabling OPA Gatekeeper<a href="#enabling-opa-gatekeeper" class="hash-link" aria-label="Direct link to Enabling OPA Gatekeeper" title="Direct link to Enabling OPA Gatekeeper">​</a></h3><ol><li>In the upper left corner, click <strong>☰ &gt; Cluster Management</strong>.</li><li>In the <strong>Clusters</strong> page, go to the cluster where you want to enable OPA Gatekeeper and click <strong>Explore</strong>.</li><li>In the left navigation bar, click <strong>Apps</strong>.</li><li>Click <strong>Charts</strong> and click <strong>OPA Gatekeeper</strong>.</li><li>Click <strong>Install</strong>.</li></ol><p><strong>Result:</strong> OPA Gatekeeper is deployed in your Kubernetes cluster.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="constraint-templates">Constraint Templates<a href="#constraint-templates" class="hash-link" aria-label="Direct link to Constraint Templates" title="Direct link to Constraint Templates">​</a></h2><p><a href="https://github.com/open-policy-agent/gatekeeper#constraint-templates" target="_blank" rel="noopener noreferrer">Constraint templates</a> are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the <a href="https://www.openpolicyagent.org/docs/latest/policy-language/" target="_blank" rel="noopener noreferrer">official documentation.</a></p><p>When OPA Gatekeeper is enabled, Rancher installs some templates by default.</p><p>To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on <strong>Templates</strong>.</p><p>Rancher also provides the ability to create your own constraint templates by importing YAML definitions.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="creating-and-configuring-constraints">Creating and Configuring Constraints<a href="#creating-and-configuring-constraints" class="hash-link" aria-label="Direct link to Creating and Configuring Constraints" title="Direct link to Creating and Configuring Constraints">​</a></h2><p><a href="https://github.com/open-policy-agent/gatekeeper#constraints" target="_blank" rel="noopener noreferrer">Constraints</a> are Kubernetes custom resources that define the scope of objects to which a specific constraint template applies to. The complete policy is defined by constraint templates and constraints together.</p><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>Prerequisite:</div><div class="admonitionContent_S0QG"><p>OPA Gatekeeper must be enabled in the cluster.</p></div></div><p>To list the constraints installed, go to the left side menu under OPA Gatekeeper, and click on <strong>Constraints</strong>.</p><p>New constraints can be created from a constraint template.</p><p>Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields.</p><p>The <strong>Edit as yaml</strong> option is also available to configure the the constraint&#x27;s yaml definition.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="exempting-ranchers-system-namespaces-from-constraints">Exempting Rancher&#x27;s System Namespaces from Constraints<a href="#exempting-ranchers-system-namespaces-from-constraints" class="hash-link" aria-label="Direct link to Exempting Rancher&#x27;s System Namespaces from Constraints" title="Direct link to Exempting Rancher&#x27;s System Namespaces from Constraints">​</a></h3><p>When a constraint is created, ensure that it does not apply to any Rancher or Kubernetes system namespaces. If the system namespaces are not excluded, then it is possible to see many resources under them marked as violations of the constraint.</p><p>To limit the scope of the constraint only to user namespaces, always specify these namespaces under the <strong>Match</strong> field of the constraint.</p><p>Also, the constraint may interfere with other Rancher functionality and deny system workloads from being deployed. To avoid this, exclude all Rancher-specific namespaces from your constraints.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="enforcing-constraints-in-your-cluster">Enforcing Constraints in your Cluster<a href="#enforcing-constraints-in-your-cluster" class="hash-link" aria-label="Direct link to Enforcing Constraints in your Cluster" title="Direct link to Enforcing Constraints in your Cluster">​</a></h2><p>When the <strong>Enforcement Action</strong> is <strong>Deny,</strong> the constraint is immediately enabled and will deny any requests that violate the policy defined. By default, the enforcement value is <strong>Deny</strong>.</p><p>When the <strong>Enforcement Action</strong> is <strong>Dryrun,</strong> then any resources that violate the policy are only recorded under the constraint&#x27;s status field.</p><p>To enforce constraints, create a constraint using the form. In the <strong>Enforcement Action</strong> field, choose <strong>Deny</strong>.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="audit-and-violations-in-your-cluster">Audit and Violations in your Cluster<a href="#audit-and-violations-in-your-cluster" class="hash-link" aria-label="Direct link to Audit and Violations in your Cluster" title="Direct link to Audit and Violations in your Cluster">​</a></h2><p>OPA Gatekeeper runs a periodic audit to check if any existing resource violates any enforced constraint. The audit-interval (default 300s) can be configured while installing Gatekeeper.</p><p>On the Gatekeeper page, any violations of the defined constraints are listed.</p><p>Also under <strong>Constraints,</strong> the number of violations of the constraint can be found.</p><p>The detail view of each constraint lists information about the resource that violated the constraint.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="disabling-gatekeeper">Disabling Gatekeeper<a href="#disabling-gatekeeper" class="hash-link" aria-label="Direct link to Disabling Gatekeeper" title="Direct link to Disabling Gatekeeper">​</a></h2><ol><li>Navigate to the cluster&#x27;s Dashboard view</li><li>On the left side menu, expand the cluster menu and click on <strong>OPA Gatekeeper</strong>.</li><li>Click the <strong>⋮ &gt; Disable</strong>.</li></ol><p><strong>Result:</strong> Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/integrations-in-rancher/opa-gatekeeper.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2022-12-09T01:26:28.000Z">Dec 9, 2022</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/integrations-in-rancher/neuvector"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">NeuVector Integration</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/integrations-in-rancher/rancher-extensions"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Rancher Extensions</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#how-the-opa-gatekeeper-integration-works" class="table-of-contents__link toc-highlight">How the OPA Gatekeeper Integration Works</a></li><li><a href="#enabling-opa-gatekeeper-in-a-cluster" class="table-of-contents__link toc-highlight">Enabling OPA Gatekeeper in a Cluster</a><ul><li><a href="#enabling-opa-gatekeeper" class="table-of-contents__link toc-highlight">Enabling OPA Gatekeeper</a></li></ul></li><li><a href="#constraint-templates" class="table-of-contents__link toc-highlight">Constraint Templates</a></li><li><a href="#creating-and-configuring-constraints" class="table-of-contents__link toc-highlight">Creating and Configuring Constraints</a><ul><li><a href="#exempting-ranchers-system-namespaces-from-constraints" class="table-of-contents__link toc-highlight">Exempting Rancher&#39;s System Namespaces from Constraints</a></li></ul></li><li><a href="#enforcing-constraints-in-your-cluster" class="table-of-contents__link toc-highlight">Enforcing Constraints in your Cluster</a></li><li><a href="#audit-and-violations-in-your-cluster" class="table-of-contents__link toc-highlight">Audit and Violations in your Cluster</a></li><li><a href="#disabling-gatekeeper" class="table-of-contents__link toc-highlight">Disabling Gatekeeper</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/assets/js/runtime~main.5e8050ed.js"></script>
<script src="/assets/js/main.7c8ccb50.js"></script>
</body>
</html>