Dry run is an audit mode for a Policy Controller constraint. Add `enforcementAction: dryrun` to the constraint manifest to report violations without denying the Pods that cause them. A new constraint is enforced by default, so test it before relying on it in a cluster. section 13.4.1
Use dry run as a deployment check:
- Add `enforcementAction: dryrun` under `spec` and deploy the constraint. Matching Pods that violate it can still start. section 13.4.1
- Inspect the audit with `kubectl get <constraint kind> <constraint name> -o yaml`. Check the `violations` entries for affected Pods, messages, and namespaces. Dry run evaluates running Pods as well as new requests, revealing what could happen when existing Pods restart. section 13.4.1
- Resolve unintended effects before enforcement. To enforce a tested constraint, remove the `enforcementAction: dryrun` line and redeploy it; the worked deployment first deletes the existing constraint with `kubectl delete -f <manifest file>`. section 13.9.1
Privileged-container policy
A dry-run `K8sPSPPrivilegedContainer` constraint reports privileged `kube-proxy` and Cilium Pods in `kube-system`. Enforcing the constraint without reviewing those results could deny startup to system Pods the cluster needs. In the worked deployment, the manifest lists system namespaces as exclusions, but the audit output still contains Pods from excluded namespaces: those exclusions stop enforcement, not auditing. section 13.4.1 section 13.9.1
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
name: psp-privileged-container
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
Constraint manifest showing `enforcementAction: dryrun` under `spec` for a Pod-matching privileged-container policy. section 13.4.1
violations:
- enforcementAction: dryrun
kind: Pod
message: 'Privileged container is not allowed: cilium-agent, securityContext:
{"capabilities": {"add": ["NET_ADMIN", "SYS_MODULE"]}, "privileged": true}'
name: anetd-4nldm
namespace: kube-system
- enforcementAction: dryrun
kind: Pod
message: 'Privileged container is not allowed: kube-proxy, securityContext: {"privileged":
true}'
name: kube-proxy-4z8qh
namespace: kube-system
Abbreviated audit output showing the violation messages and affected system Pods to review before enforcement. section 13.4.1
