gatekeeper组件可以帮助您方便地管理和应用集群内的Open Policy Agent(OPA)策略。本文介绍gatekeeper组件的架构以及通过一个示例来演示具体的使用方法和工作效果。
背景信息
有关OPA的介绍,请参见Open Policy Agent。
组件架构

示例
本示例将演示如何通过gatekeeper实现限制指定命名空间下创建的Pod必须包含一个名为gatekeeper-test-label的标签,借此展示getekeeper的基本用法。
gatekeeper组件可以帮助您方便地管理和应用集群内的Open Policy Agent(OPA)策略。本文介绍gatekeeper组件的架构以及通过一个示例来演示具体的使用方法和工作效果。
有关OPA的介绍,请参见Open Policy Agent。
本示例将演示如何通过gatekeeper实现限制指定命名空间下创建的Pod必须包含一个名为gatekeeper-test-label的标签,借此展示getekeeper的基本用法。
kubectl create ns test-gatekeeper
kubectl label ns test-gatekeeper name=test-gatekeeper
kubectl apply -f - <<EOF
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: k8srequiredlabels
spec:
crd:
spec:
names:
kind: K8sRequiredLabels
validation:
openAPIV3Schema:
properties:
labels:
type: array
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequiredlabels
violation[{"msg": msg, "details": {"missing_labels": missing}}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_]}
missing := required - provided
count(missing) > 0
msg := sprintf("you must provide labels: %v", [missing])
}
EOF
kubectl apply -f - <<EOF
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: pod-must-have-gatekeeper-test-label
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
namespaceSelector:
matchExpressions:
- key: name
operator: In
values: ["test-gatekeeper"]
parameters:
labels: ["gatekeeper-test-label"]
EOF
kubectl -n test-gatekeeper run test-deny --image=nginx --restart=Never
Error from server ([denied by pod-must-have-gatekeeper-test-label] you must provide labels: {"gatekeeper-test-label"}): admission webhook "validation.gatekeeper.sh" denied the request: [denied by pod-must-have-gatekeeper-test-label] you must provide labels: {"gatekeeper-test-label"}
kubectl -n test-gatekeeper run test-pass -l gatekeeper-test-label=pass --image=nginx --restart=Never
pod/test-pass created
kubectl -n default run test-deny --image=nginx --restart=Never
pod/test-deny created
在文档使用中是否遇到以下问题
更多建议
匿名提交