Senior LevelDocker & Deployment
How does OPA Gatekeeper enforce corporate compliance policies using Rego language?
❓ Interview Prompt: Explain OPA Gatekeeper ConstraintTemplates, Rego policy language, audit mode, and common policy examples for Kubernetes governance.
OPA Gatekeeper (Open Policy Agent) is a Kubernetes admission controller that enforces custom policies expressed in Rego — a declarative, purpose-built policy language.
Architecture:
1
ConstraintTemplate: Defines the Rego policy logic and creates a new CRD type.
2
Constraint: An instance of a ConstraintTemplate with specific parameters — defines what resources the policy applies to and with which parameters.
3
Audit Mode: Gatekeeper continuously audits existing resources for policy violations (not just new admissions).
How Rego Works:
Rego policies receive the admission request object and return a violation if the request doesn't comply. Multiple violations can be returned for detailed error messages.
Common Enterprise Policies:
•
Require images to be pulled from approved registries.
•
Block
latest image tags in production namespaces.•
Require resource limits on all containers.
•
Enforce label requirements (team, environment, cost-center).
•
Block privileged containers.
•
Require ReadOnlyRootFilesystem.
Gatekeeper vs Kyverno:
•
Gatekeeper: Mature, uses Rego (powerful but learning curve). Part of OPA ecosystem.
•
Kyverno: YAML-native policies (easier for K8s practitioners). More intuitive for simple policies.
Code Implementation Example
yaml
# ConstraintTemplate: block containers without resource limits
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: containerrequireslimits
spec:
crd:
spec:
names:
kind: ContainerRequiresLimits
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package containerrequireslimits
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not container.resources.limits.memory
msg := sprintf(
"Container '%v' must have memory limits set",
[container.name]
)
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not container.resources.limits.cpu
msg := sprintf(
"Container '%v' must have CPU limits set",
[container.name]
)
}
---
# Constraint: apply the policy to all pods in production namespace
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ContainerRequiresLimits
metadata:
name: require-limits-production
spec:
enforcementAction: deny # or: warn, dryrun
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
namespaces: ["production"]💡Gatekeeper ConstraintTemplate + Constraint: Rego denies pods missing memory or CPU limits in production namespace.
🎯 Interview Key Takeaway
OPA Gatekeeper enforces Rego policies as admission webhooks — ConstraintTemplate defines the logic, Constraint applies it. Audit mode retroactively finds existing violations.
#OPA#Gatekeeper#Rego#Policy Enforcement#Compliance#Senior
Back to all Docker & Deployment Questions→