Creating a new Gatekeeper Rego policy
For this tutorial you'll implement the same policy that you wrote with
Open Policy Agent.
Namely, a policy that rejects a resource if it's targeting the default
namespace.
There is a repository template that you can use as a base to port an existing policy.
Requirements​
You need the following tools:
opa
kwctl
The policy​
Gatekeeper policies must return none or more violation objects. If no violations are reported, the request is accepted. If one, or more violations are reported, the request is rejected.
Create a new folder, named rego-policy
.
In it, create a policy.rego
file with the contents:
package policy
violation[{"msg": msg}] {
input.review.object.metadata.namespace == "default"
msg := "it is forbidden to use the default namespace"
}
In this case, the entrypoint is policy/violation
,
and due to how Rego works, the policy can have the following outcomes:
-
Return 1 violation: the object reviewed is targeting the default namespace.
-
Return 0 violations: the object reviewed is compliant with the policy.
Take a moment to compare this policy with the one written in the Open Policy Agent section.
That one had to build the whole AdmissionReview
response,
and the inputs were slightly different.
In the Gatekeeper mode,
the AdmissionRequest
object is provided with the input.review
attribute.
All attributes of the AdmissionRequest
are readable along with object
.
Now, you can create the requests to evaluate in the next section.
You first create a default-ns.json
file with the following contents inside the data
directory:
{
"apiVersion": "admission.k8s.io/v1",
"kind": "AdmissionReview",
"request": {
"uid": "1299d386-525b-4032-98ae-1949f69f9cfc",
"operation": "CREATE",
"object": {
"kind": "Pod",
"apiVersion": "v1",
"metadata": {
"name": "nginx",
"namespace": "default",
"uid": "04dc7a5e-e1f1-4e34-8d65-2c9337a43e64"
}
}
}
}
Now, create another AdmissionReview
object that, this time,
is targeting a namespace different to the default
one.
Name this file other-ns.json
.
It has the following contents:
{
"apiVersion": "admission.k8s.io/v1",
"kind": "AdmissionReview",
"request": {
"uid": "1299d386-525b-4032-98ae-1949f69f9cfc",
"operation": "CREATE",
"object": {
"kind": "Pod",
"apiVersion": "v1",
"metadata": {
"name": "nginx",
"namespace": "other",
"uid": "04dc7a5e-e1f1-4e34-8d65-2c9337a43e64"
}
}
}
}
You can see, this simulates another pod creation request,
this time under a namespace called other
.