Gatekeeper Cheat Sheet¶

Comandi di Copia
Genera PDF

Installazione e Configurazione¶

Installa Gatekeeper¶

# Install latest Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.14/deploy/gatekeeper.yaml

# Verify installation
kubectl get pods -n gatekeeper-system
kubectl get crd | grep gatekeeper

Controlla lo Stato del Sistema¶

# Check all Gatekeeper components
kubectl get all -n gatekeeper-system

# View Gatekeeper configuration
kubectl get config -n gatekeeper-system -o yaml

# Check webhook configuration
kubectl get validatingadmissionconfiguration gatekeeper-validating-admission-configuration

Template di Constraint¶

Crea Template di Constraint¶

# constraint-template.yaml
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        type: object
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg}] {
          required := input.parameters.labels
          provided := input.review.object.metadata.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }

Applica Template¶

# Apply constraint template
kubectl apply -f constraint-template.yaml

# List all constraint templates
kubectl get constrainttemplates

# View template details
kubectl describe constrainttemplate k8srequiredlabels

Constraints¶

Crea Constraint¶

# constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: must-have-environment
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
    namespaces: ["production"]
  parameters:
    labels: ["environment", "team", "version"]

Gestisci Constraints¶

# Apply constraint
kubectl apply -f constraint.yaml

# List all constraints
kubectl get constraints

# View constraint status
kubectl get k8srequiredlabels must-have-environment -o yaml

# Check violations
kubectl describe k8srequiredlabels must-have-environment

Esempi di Policy¶

Policy per Etichette Obbligatorie¶

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg}] {
          required := input.parameters.labels
          provided := input.review.object.metadata.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }

Policy per Limiti di Risorse¶

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8scontainerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sContainerLimits
      validation:
        properties:
          cpu:
            type: string
          memory:
            type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerlimits

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := "Container must have CPU limits"
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := "Container must have memory limits"
        }

Policy per Contesto di Sicurezza¶

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8ssecuritycontext
spec:
  crd:
    spec:
      names:
        kind: K8sSecurityContext
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8ssecuritycontext

        violation[{"msg": msg}] {
          input.review.object.spec.securityContext.runAsRoot == true
          msg := "Containers must not run as root"
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := "Privileged containers are not allowed"
        }

Gestione Configurazione¶

Configurazione Sincronizzazione¶

# sync-config.yaml
apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  sync:
    syncOnly:
      - group: ""
        version: "v1"
        kind: "Namespace"
      - group: "apps"
        version: "v1"
        kind: "Deployment"
  validation:
    traces:
      - user:
          kind:
            group: "*"
            version: "*"
            kind: "*"

Escludi Namespace¶

apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  match:
    - excludedNamespaces: ["kube-system", "gatekeeper-system"]
      processes: ["*"]

Mutation Policies¶

Assegnazione Mutation¶

# assign-mutation.yaml
apiVersion: mutations.gatekeeper.sh/v1alpha1
kind: Assign
metadata:
  name: add-security-label
spec:
  applyTo:
    - groups: ["apps"]
      kinds: ["Deployment"]
      versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  location: "metadata.labels.security-scan"
  parameters:
    assign:
      value: "required"

Mutation AssignMetadata¶

# assignmetadata-mutation.yaml
apiVersion: mutations.gatekeeper.sh/v1alpha1
kind: AssignMetadata
metadata:
  name: add-annotation
spec:
  match:
    scope: Namespaced
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  location: "metadata.annotations.gatekeeper"
  parameters:
    assign:
      value: "mutated"

Replica Dati¶

Configurazione Provider¶

# provider-config.yaml
apiVersion: externaldata.gatekeeper.sh/v1alpha1
kind: Provider
metadata:
  name: image-scanner
spec:
  url: https://image-scanner.example.com/scan
  timeout: 30

Template Dati Esterni¶

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8simagescan
spec:
  crd:
    spec:
      names:
        kind: K8sImageScan
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8simagescan

        violation[{"msg": msg}] {
          image := input.review.object.spec.containers[_].image
          response := external_data({"provider": "image-scanner", "keys": [image]})
          response[image].vulnerabilities > 0
          msg := sprintf("Image %v has vulnerabilities", [image])
        }

Monitoraggio e Risoluzione Problemi¶

Controlla Violazioni¶

# View constraint violations
kubectl get <constraint-kind> <constraint-name> -o yaml

# Check audit logs
kubectl logs -n gatekeeper-system -l control-plane=audit-controller

# View webhook logs
kubectl logs -n gatekeeper-system -l control-plane=controller-manager

# Check metrics
kubectl port-forward -n gatekeeper-system svc/gatekeeper-controller-manager-metrics-service 8080:8080
curl localhost:8080/metrics

Debug Policies¶

# Test constraint template
kubectl apply --dry-run=server -f test-resource.yaml

# View constraint status
kubectl describe constraint <constraint-name>

# Check template compilation
kubectl get constrainttemplate <template-name> -o yaml

Procedure di Emergenza¶

Disabilita Gatekeeper¶

# Disable admission webhook
kubectl delete validatingadmissionconfiguration gatekeeper-validating-admission-configuration

# Set webhook to ignore failures
kubectl patch validatingadmissionconfiguration gatekeeper-validating-admission-configuration \
  --type='merge' \
  -p='{"webhooks":[{"name":"validation.gatekeeper.sh","failurePolicy":"Ignore"}]}'

Operazioni di Ripristino¶

Note: I've translated the text to Italian while maintaining the original structure, markdown formatting, and keeping technical terms in English. The translations preserve the meaning and context of the original text.```bash

Remove all constraints¶

kubectl delete constraints --all

Remove constraint templates¶

kubectl delete constrainttemplates --all

Restart Gatekeeper¶

kubectl rollout restart deployment/gatekeeper-controller-manager -n gatekeeper-system kubectl rollout restart deployment/gatekeeper-audit -n gatekeeper-system ```

Migliori Pratiche¶

Sviluppo delle Politiche¶

Iniziare con la modalità di applicazione dell'avvertimento
Testare le politiche in ambienti di sviluppo
Utilizzare messaggi di violazione descrittivi
Implementare strategie di rollout graduali

Ottimizzazione delle Prestazioni¶

Limitare l'ambito dei vincoli con criteri di corrispondenza
Utilizzare politiche Rego efficienti
Monitorare l'utilizzo delle risorse
Implementare strategie di caching appropriate

Considerazioni sulla Sicurezza¶

Aggiornare regolarmente Gatekeeper
Monitorare i tentativi di bypass delle politiche
Implementare RBAC appropriato
Controllare le modifiche delle politiche