search

open-policy-agent / gatekeeper

🐊 Gatekeeper - Policy Controller for Kubernetes
https://open-policy-agent.github.io/gatekeeper/
Apache License 2.0
3.72k stars 765 forks source link

kubectl plugin for opa gatekeeper #1172

Open developer-guy opened 3 years ago

developer-guy commented 3 years ago

Describe the solution you'd like [A clear and concise description of what you want to happen.] It would be good if we develop a kubectl plugin for OPA Gatekeeper, maybe with this plugin we can apply, validate, and test the Contraint & ConstraintTemplates, or maybe rule written by Rego.

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

brycecr commented 3 years ago

One possible option would be to use kpt, which has the gatekeeper-validate function that validates yaml against constraints. This walkthrough gives some indication how that might be achieved.

ritazh commented 3 years ago

+1

developer-guy commented 3 years ago

is it possible to start the development of this plugin within the project Gatekeeper? @ritazh or should we start the development with a separate project?

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

ritazh commented 2 years ago

@developer-guy We now have https://open-policy-agent.github.io/gatekeeper/website/docs/gator#the-gator-test-subcommand. Can you PTAL and see if this addresses your ask?

ritazh commented 2 years ago

As discussed on 8/3/3022 community call, gator currently can verify and test, but it cannot apply.

One thought is if kubectl apply can wait for constraint templates and constraints to be applied, before deploying the rest of resources that need to be validated. This is a missing experience for Kubernetes at large beyond the scope of this project.