A Gatekeeper constraint activates a policy defined by a ConstraintTemplate. The template supplies the evaluation logic; the constraint supplies its arguments and identifies the Kubernetes resources to check. In ACM, Policy Controller evaluates those policies when objects are created or updated. A denial prevents the API server from accepting the object and returns a policy error. section 11.2.3 section 13.4.1
Create a constraint as YAML with an API version, a kind matching the template, a name, and a spec. Use spec.match to select resource kinds and, where the template requires them, spec.parameters to set policy-specific values. A template definition alone does not enable its policy. section 13.4.1 section 11.2.3
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
name: privileged-containers
spec:
enforcementAction: dryrun
excludedNamespaces:
- kube-system
- gke-system
- config-management-system
- gatekeeper-system
- gke-connect
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
This privileged-container constraint matches Pods, excludes named system namespaces, and uses enforcementAction: dryrun to report violations without denying requests. section 13.9.1
Scope and test a constraint before relying on it:
- Choose the policy and its targets. For example, K8sRequiredLabels can require Namespace labels and restrict their accepted values; K8sAllowedRepos can limit Pod images to specified registries. section 11.3.1 section 13.9.1
- Check exemptions carefully. A constraint can exclude namespaces; Gatekeeper configuration can also exempt namespaces from audit, webhook, sync, or all three processes. section 13.4.1 section 13.9.1
- Run a disruptive policy in dry-run mode first and inspect reported violations. Existing system Pods may otherwise be affected by a privileged-container policy. section 13.4.1 section 13.9.1
Restrict image registries
A K8sAllowedRepos constraint named allowed-registries matches Pods and sets spec.parameters.repos to gcr.io and hub.evermore.local. When enforced, an image from another repository receives an admission-webhook denial identifying the invalid repository. section 13.9.1
