OPA gatekeeper: Create a rule to warn the users

Kubernetes OPA gatekeeper warning

2 min read | by Jordi Prats

OPA gatekeeper is most commonly used to block retain objects from getting into the Kubernetes cluster, but we can use it to warn the user as well

To do so we just need to set spec.enforcementAction to warn as follows:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: RestrictTolerations
metadata:
  name: restrict-tolerations
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-delete-policy": "before-hook-creation"
    "helm.sh/hook-weight": "1"
spec:
  enforcementAction: warn
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    tolerations:
      - key: node-role.kubernetes.io/demo
      - key: node-role.kubernetes.io/another
      - key: node-role.kubernetes.io/yetanother

On the ENFORCEMENT-ACTION column we'll see this setting:

$ kubectl get RestrictTolerations
NAME                                ENFORCEMENT-ACTION   TOTAL-VIOLATIONS
restrict-infra-master-tolerations   warn                 0

With this rule in place we'll get warnings when applying the object but it will get through anyway:

$ kubectl apply -f testPod.yaml
Warning: [restrict-infra-master-tolerations] found restricted toleration(s)
pod/pod-tolerations-test created

We can use this to warn the user about potentially problems with their manifests without affecting their ability of managing it's own manifests

Posted on 07/11/2022

Categories