What is Gatekeeper?
- Docker & Kubernetes course
- Expert
- Lesson 33/47
- 4 min
Learn that Gatekeeper is a Kubernetes admission webhook.
What is Gatekeeper?
Gatekeeper is the project connecting OPA to Kubernetes. It has two parts:
- The admission controller: checks new or changing objects against the policies and rejects them if there's a violation.
- The audit: regularly scans objects already in the cluster and writes violations into the policy object's status.
Policies are written with two CRDs: the ConstraintTemplate (the Rego logic and parameter definition) and the Constraint (to which objects and with which parameters that template applies).
ConstraintTemplate K8sZorunluEtiket (Rego: does the label exist?)
└── Constraint deployment-etiketleri (etiketler: [takim, ortam], target: Deployment)Seeing violations
The audit results are in the Constraint's status. A rejected request returns to the user together with the violation message:
$ kubectl get k8szorunluetiket deployment-etiketleri -o jsonpath='{.status.totalViolations}'
4
$ kubectl create deployment deneme --image=nginx:1.27
error: admission webhook "validation.gatekeeper.sh" denied the request: [deployment-etiketleri] eksik etiket: takimPractice Query violations
Write three commands: list the ConstraintTemplates (kubectl get constrainttemplates); print the total violation count of the deployment-etiketleri Constraint of type k8szorunluetiket with jsonpath='{.status.totalViolations}'; show the same Constraint in detail.
Starter code
# buraya yazSample solution
kubectl get constrainttemplates
kubectl get k8szorunluetiket deployment-etiketleri -o jsonpath='{.status.totalViolations}'
kubectl describe k8szorunluetiket deployment-etiketleriExpected output
NAME AGE
k8szorunluetiket 3d
4
Name: deployment-etiketleri
Status:
Total Violations: 4
Violations:
Message: eksik etiket: takim
Name: eski-rapor
Namespace: magaza
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What happens to a deployment created before Gatekeeper was installed that violates the policy?
- It's deleted immediately
- It's restarted
- It's never noticed
- It isn't deleted; the audit reports it as a violation Correct answer
Explanation: Admission only stops new requests; the audit shows the existing ones.
2 Write the object type containing the Rego logic.
apiVersion: templates.gatekeeper.sh/v1
kind: ____apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplateExplanation: The template defines the logic, the Constraint the application.
3 Match.
| Term | Meaning |
|---|---|
ConstraintTemplate |
Rego and parameters |
Constraint |
Where and how it applies |
admission |
Stops new requests |
audit |
Reports existing ones |