What is Gatekeeper?

Learn that Gatekeeper is a Kubernetes admission webhook.

What is Gatekeeper?

Gatekeeper is the project connecting OPA to Kubernetes. It has two parts:

The admission controller: checks new or changing objects against the policies and rejects them if there's a violation.
The audit: regularly scans objects already in the cluster and writes violations into the policy object's status.

Policies are written with two CRDs: the ConstraintTemplate (the Rego logic and parameter definition) and the Constraint (to which objects and with which parameters that template applies).

ConstraintTemplate  K8sZorunluEtiket   (Rego: does the label exist?)
   └── Constraint   deployment-etiketleri  (etiketler: [takim, ortam], target: Deployment)

Seeing violations

The audit results are in the Constraint's status. A rejected request returns to the user together with the violation message:

$ kubectl get k8szorunluetiket deployment-etiketleri -o jsonpath='{.status.totalViolations}'
4
$ kubectl create deployment deneme --image=nginx:1.27
error: admission webhook "validation.gatekeeper.sh" denied the request: [deployment-etiketleri] eksik etiket: takim

Exercise Query violations

Write three commands: list the ConstraintTemplates (kubectl get constrainttemplates); print the total violation count of the deployment-etiketleri Constraint of type k8szorunluetiket with jsonpath='{.status.totalViolations}'; show the same Constraint in detail.

Show example solution

kubectl get constrainttemplates
kubectl get k8szorunluetiket deployment-etiketleri -o jsonpath='{.status.totalViolations}'
kubectl describe k8szorunluetiket deployment-etiketleri

Test yourself

What happens to a deployment created before Gatekeeper was installed that violates the policy?
- It's deleted immediately
- It's restarted
- It's never noticed
- It isn't deleted; the audit reports it as a violation
Show answer

It isn't deleted; the audit reports it as a violation — Admission only stops new requests; the audit shows the existing ones.

Write the object type containing the Rego logic.

apiVersion: templates.gatekeeper.sh/v1
kind: ____

Show answer

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate

Match.

ConstraintTemplate

Rego and parameters
Constraint

Where and how it applies
admission

Stops new requests
audit

Reports existing ones

Next lesson: ConstraintTemplate

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies