implementing-opa-gatekeeper-for-policy-enforcement

Install Gatekeeper with Helm by adding the open-policy-agent chart repository and running helm install into the gatekeeper-system namespace. Verify the installation by checking the pods, the validating webhook configuration, and the ConstraintTemplate CRDs.

Create a ConstraintTemplate with a Rego rule that checks container securityContext.privileged, then apply a Constraint matching Pod kinds in target namespaces. Test by deploying a pod with privileged set to true and confirm the admission request is denied.

A ConstraintTemplate defines the policy blueprint including the Rego logic and parameter schema, while a Constraint instantiates that template with specific match criteria and parameter values. Applying only the template without a constraint enforces nothing.

The constraint is likely set to enforcementAction dryrun, which audits but never denies requests. Check the enforcement action with kubectl get constraints and switch it to deny after reviewing dryrun violations.

Gatekeeper audits pre-existing resources on its audit interval and records them in the constraint's status.violations field. Results are not instant, so check .status.violations after the audit cycle completes.

For security-critical constraints use Fail so requests are rejected when Gatekeeper is unavailable, since Ignore fails open and admits everything unchecked. Scope namespaceSelector carefully to avoid locking out the control plane.