Skip to content

OPA-Gatekeeper💣

Overview💣

Gatekeeper is an auditing tool that allows administrators to see what resources are currently violating any given policy.

Big Bang Touch Points💣

Storage💣

Data from gatekeeper is not stored is provided via metrics.

Database💣

Gatekeeper doesn’t have a database.

Istio Configuration💣

When deploying to k3d, istio-system should be added from excludedNamespaces under the allowedDockerRegistries violations. This can be done by modifying chart/values.yaml file or passing an override file with the values set as seen below. This is for development purposes only: production should not allow containers in the istio-system namespace to be pulled from outside of Registry1. 

gatekeeper:
  values:
    violations:
      allowedDockerRegistries:
        match:
          excludedNamespaces: 
            - istio-system # allows creation for loadbalancer pods for various ports and various vendor loadbalancers

High Availability💣

High availability is accomplished by ensuring the replicas in the values file of this helm chart are > 1. By default, this chart is configured for high availability with replicas: 3.

gatekeeper:
  values:
    replicas: 3

Single Sign on (SSO)💣

None. This service doesn’t have a web interface.

Licensing💣

Apache License

Dependencies💣

None.

Last update: 2022-09-15 by brandt keller