gatekeeper

Prerequisites

Before you begin, ensure that you have:

• An ACK cluster with gatekeeper installed

• kubectl configured to connect to the cluster

• Permissions to create namespaces and apply custom resources

Create the namespace and label it

Run the following commands to create a test-gatekeeper namespace and add the name=test-gatekeeper label:

kubectl create ns test-gatekeeper
kubectl label ns test-gatekeeper name=test-gatekeeper

Create a ConstraintTemplate

Apply the following ConstraintTemplate. It defines a policy that checks whether pods have all required labels:

kubectl apply -f - <<EOF
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("you must provide labels: %v", [missing])
        }
EOF

The ConstraintTemplate takes about 10 seconds to initialize.

Create a Constraint

Apply the following Constraint. It uses the K8sRequiredLabels template to require the gatekeeper-test-label label on all pods created in any namespace with the name=test-gatekeeper label:

kubectl apply -f - <<EOF
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: pod-must-have-gatekeeper-test-label
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaceSelector:
      matchExpressions:
      - key: name
        operator: In
        values: ["test-gatekeeper"]
  parameters:
    labels: ["gatekeeper-test-label"]
EOF

The Constraint takes about 10 seconds to initialize.

Verify the constraint

Run three test commands to confirm the constraint is working:

Deny: pod without the required label in the constrained namespace

kubectl -n test-gatekeeper run test-deny --image=nginx --restart=Never

Expected output:

Error from server (Forbidden): admission webhook "validation.gatekeeper.sh" denied the request: [pod-must-have-gatekeeper-test-label] you must provide labels: {"gatekeeper-test-label"}

Pass: pod with the required label in the constrained namespace

kubectl -n test-gatekeeper run test-pass-1 -l gatekeeper-test-label=pass --image=nginx --restart=Never

Expected output:

pod/test-pass-1 created

Pass: pod without the label in an unconstrained namespace

kubectl -n default run test-pass-2 --image=nginx --restart=Never

Expected output:

pod/test-pass-2 created

The results confirm that gatekeeper enforces the label requirement only in namespaces that match the Constraint's match criteria—other namespaces are unaffected.

March 2024