Kubernetes Gatekeeper OPA 策略约束实战

Kubernetes Gatekeeper OPA 策略约束实战ConstraintTemplateapiVersion: templates.gatekeeper.sh/v1

kind: ConstraintTemplate

metadata:

name: k8sdisallowlatest

spec:

crd:

spec:

names:

kind: K8sDisallowLatest

targets:

- target: admission.k8s.gatekeeper.sh

rego: |

package k8sdisallowlatest

violation[{

"msg": msg,

"details": {}}] {

input.review.kind.kind == "Pod"

some i

container := input.review.object.spec.containers[i]

endswith(container.image, ":latest")

msg := sprintf("image %s uses tag latest", [container.image])

}

ConstraintapiVersion: constraints.gatekeeper.sh/v1beta1

kind: K8sDisallowLatest

metadata:

name: disallow-latest

spec:

match:

kinds:

- apiGroups: [""]

kinds: ["Pod"]

验证应用模板与约束后，创建含 `:latest` 的 Pod 将被拒绝总结Gatekeeper 能为集群提供可审计、可组合的策略约束，提升安全与一致性。