第 3 章 Gatekeeper operator

ConstraintTemplates 和约束： 使用 Red Hat Advanced Cluster Management 策略在 hub 集群上进行多集群发布 Gatekeeper 约束和 Gatekeeper 审计结果聚合。以下示例定义了一个 Gatekeeper ConstraintTemplate 和 constraint (K8sRequiredLabels)，以确保在所有命名空间中设置了 gatekeeper 标签：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: require-gatekeeper-labels-on-ns
spec:
  remediationAction: inform 1
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: templates.gatekeeper.sh/v1beta1
        kind: ConstraintTemplate
        metadata:
          name: k8srequiredlabels
          annotations:
            policy.open-cluster-management.io/severity: low 2
        spec:
          crd:
            spec:
              names:
                kind: K8sRequiredLabels
              validation:
                openAPIV3Schema:
                  properties:
                    labels:
                      type: array
                      items: string
          targets:
            - target: admission.k8s.gatekeeper.sh
              rego: |
                package k8srequiredlabels
                violation[{"msg": msg, "details": {"missing_labels": missing}}] {
                  provided := {label | input.review.object.metadata.labels[label]}
                  required := {label | label := input.parameters.labels[_]}
                  missing := required - provided
                  count(missing) > 0
                  msg := sprintf("you must provide labels: %v", [missing])
                }
    - objectDefinition:
        apiVersion: constraints.gatekeeper.sh/v1beta1
        kind: K8sRequiredLabels
        metadata:
          name: ns-must-have-gk
          annotations:
            policy.open-cluster-management.io/severity: low 3
        spec:
          enforcementAction: dryrun
          match:
            kinds:
              - apiGroups: [""]
                kinds: ["Namespace"]
          parameters:
            labels: ["gatekeeper"]

使用前面的策略，您可能会收到以下策略状态消息：warn - you must provide labels: {"gatekeeper"} (on Namespace default); warn - you must provide labels: {"gatekeeper"} (on Namespace gatekeeper-system)。当包含 Gatekeeper 约束或 ConstraintTemplates 被删除后，限制和 ConstraintTemplates 也会从受管集群中删除。

要从控制台查看特定受管集群的 Gatekeeper 审计结果，请进入策略模板 结果 页面。如果启用了搜索，请查看失败的审计的 Kubernetes 对象的 YAML。

备注：

policy-gatekeeper-admission ：在 Red Hat Advanced Cluster Management 策略中使用 policy-gatekeeper-admission 配置策略来检查 gatekeeper admission webhook 拒绝的 Kubernetes API 请求：

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-gatekeeper-admission
spec:
  remediationAction: inform # will be overridden by remediationAction in parent policy
  severity: low
  object-templates:
    - complianceType: mustnothave
      objectDefinition:
        apiVersion: v1
        kind: Event
        metadata:
          namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
          annotations:
            constraint_action: deny
            constraint_kind: K8sRequiredLabels
            constraint_name: ns-must-have-gk
            event_type: violation