This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Gatekeeper

How to use Gatekeeper with M9sweeper to define and enforce rules for things deployed to Kubernetes.

1: Getting Started
2: Managing Constraints
3: Reviewing Exceptions
4: Reviewing Pod Compliance

1 - Getting Started

M9sweeper makes managing Gatekeeper constraints and constraint templates easy!

Gatekeeper is a great tool for creating rules for your Kubernetes cluster. You configure rules using constraint templates and constraints.

Constraint templates, such as this, allow you to define rules using a language called Rego.

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("you must provide labels: %v", [missing])
        }

Constraints are then created to apply these rules to a particular set of kubernetes entities. These constraints can also contain configuration parameters, such as which labels are required (in this example).

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-gk
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]
  parameters:
    labels: ["gatekeeper"]

M9sweeper makes managing your constraint templates and constraints extremely convenient through an easy-to-use user interface.

To get started, you need to install Gatekeeper.

2 - Managing Constraints

Using the M9sweeper Interface to Configure Gatekeeper

Managing Constraint Templates

After installing Gatekeeper, your next step is to install constraint templates. You can do this using a CICD pipeline, or if you are new to this you can use the m9sweeper graphical user interface to install Constraint Templates from our library of templates.

First, open the Gatekeeper page for your cluster and click on “+Add More” in the top right.

../img.png

Then, check the boxes on the constraint templates you want to install and click save changes.

../img_1.png

After doing this, you will see the list of constraint templates has been installed.

Managing Constraints

Just installing constraint templates alone does not do anything - you also have to apply these constraint templates to specific workloads / namespaces. This is done through the use of constraints.

If you click on one of your constraint templates, you will be taken to a page that lists all of the constraints created for this constraint template. After doing so, click “+Add More” to create a constraint for this template.

../img_2.png

In this user interface, it will let you set which namespaces and type of entity it applies to. Reasonable defaults are typically filled in if you used one of our templates.

../img_3.png

If properties can be configured, we will automatically generate a user interface for configuring those properties. You can fill in the required properties.

../img_4.png

Do not forget to select whether it is to be in enforcement mode or audit mode. Only enforcement mode is actually enforced - audit mode is purely used for evaluation purposes.

../img_5.png

Click save changes and now you should have your constraint created!

../img_6.png

3 - Reviewing Exceptions

M9sweeper extends Gatekeeper through the use of exceptions!

While Gatekeeper constraints can be scoped to specific namespaces or entity types, sometimes you want to create temporary exceptions for a particular namespace that end at a specific date, or sometimes you want to just target a specific workload.

In those cases, you can use our exceptions feature. Our exceptions feature will automatically code-generate rego code nightly, re-evaluating the exceptions every day and taking into account the exception’s status, start date, and end date. These exceptions work just like image compliance exceptions, except they target Gatekeeper constraint templates rather than image scanning rules.

To use them, be sure and pick Gatekeeper as the exception type:

../img_7.png

4 - Reviewing Pod Compliance

M9sweeper makes seeing a pod’s Gatekeeper compliance extremely easy!

To view a pod’s compliance, navigate to your cluster’s list of workloads. Then, click on the namespace you want to review.

../img_8.png

Next, it will list all pods in the namespace. Note that it re-populates this list hourly.

../img_9.png

If you click on a pod, it will list all images in the pod and those images' own compliance.

../img_10.png

If you click on the Gatekeeper icon in the top right, it will tell if you if any violations exist and, if so, what violations exist.

../img_11.png