Summary - OPA

Combine Rego and ConstraintTemplate to write a policy.

Summary: OPA

In this group:

OPA separates policies from code; in Kubernetes it checks object content in the admission stage (RBAC checks who, OPA checks content).
Rego: violation rules, input.review.object, [_], not; tested locally with opa eval and opa test.
Gatekeeper: stops new requests with admission and reports existing violations with the audit.
A ConstraintTemplate defines the logic and parameter definition, a Constraint the targets (match) and parameters.
enforcementAction: gradual rollout with dryrun → warn → deny; system namespaces are excluded.

kubectl get constrainttemplates
kubectl get constraints

Exercise Move from warn to deny

Write three commands: list all Constraints; apply the patch {"spec":{"enforcementAction":"deny"}} to the deployment-etiketleri (k8szorunluetiket) Constraint with --type=merge; try creating a deneme deployment with the nginx:1.27 image in magaza with --dry-run=server.

Show example solution

kubectl get constraints
kubectl patch k8szorunluetiket deployment-etiketleri --type=merge -p '{"spec":{"enforcementAction":"deny"}}'
kubectl create deployment deneme --image=nginx:1.27 -n magaza --dry-run=server

Test yourself

Which lists all Constraints regardless of their types?
- kubectl get constraints
- kubectl get policies
- kubectl get rego
- kubectl get admission
Show answer

kubectl get constraints — Gatekeeper gathers all Constraint types in the constraints category.

Specify the target object type.

  match:
    ____:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]

Show answer

  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]

Match.

Rego

Policy language
ConstraintTemplate

Logic
Constraint

Application
audit

Existing violations

Next lesson: Backup strategy

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies