OPA Gatekeeper policy to disallow specific image tag for any deployments

user_12030626 0
Viewed 44

What are the packages inside Kubernetes ConstraintTemplate policy definition? and can we create our own packages using rego? I have a use case wherein I want to disallow the use of a stable image tag for any deployments. I have seen the Github repository of OPA gatekeeper samples and I see they have used packages while defining policies.

kubernetes
1 Answers

Packages group the rules defined in one or more modules into a particular namespace. Because rules are namespaced they can be safely shared across.

You can try this ConstraintTemplate, also set it as per requirement to disable stable image

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sblocklatesttag
  annotations:
    description: Blocks images with the "stable" tag.
spec:
  crd:
    spec:
      names:
        kind: K8sBlockLatestTag
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sblocklatesttag
        violation[{"msg": msg, "details": {}}]{
        input.review.object.kind == "Pod"
        imagename := input.review.object.spec.containers[_].image
        endswith(imagename,"stable")
        msg := "Image with \"stable\" tab is not allowed"
        }
user_55258240
Related