Skip to content

Gatekeeper in Big Bang

This package deploys OPA Gatekeeper and Big Bang’s policy library. Gatekeeper evaluates Kubernetes admission requests and audits existing resources against the enabled ConstraintTemplates and Constraints. For Gatekeeper concepts, policy authoring, and the full upstream configuration surface, use the Gatekeeper documentation and the version 3.23.1 chart values.

Big Bang integration

Enable and configure the package through the umbrella’s canonical packages.gatekeeper entry. The legacy gatekeeper entry remains a compatibility alias. The umbrella deploys the release to gatekeeper-system, marks that namespace to avoid self-management, uses a non-persistent Flux client for Gatekeeper CRDs, and configures Flux to use CreateReplace CRD handling.

The package wraps upstream Gatekeeper 3.23.1, supplies hardened images and a hardened gatekeeper-admin ServiceAccount, and disables the upstream CRD-upgrade hook because Flux manages CRD handling. Big Bang-specific defaults live at the package level; upstream is the passthrough parent for upstream chart values. Do not duplicate upstream nested values in an umbrella override. See the upstream values for 3.23.1 for supported upstream options.

Constraints, admission, and audit

The chart renders ConstraintTemplates from chart/templates/constraint-templates/ and their value-driven Constraint instances from chart/templates/constraints/. Configure enabled constraints, enforcementAction, matches, and constraint parameters under violations. A deny action can block cluster workloads; use dryrun to observe violations before enforcing a policy.

For a new audit experiment in a disposable environment, these package values show the exact constraint nesting while preserving its non-root-user requirement:

violations:
  allowedUsers:
    enabled: true
    enforcementAction: dryrun
    parameters:
      runAsUser:
        rule: MustRunAsNonRoot

For umbrella v1 use, place the fragment under packages.gatekeeper.values with packageConfiguration.version: v1. This changes only the selected constraint; other constraints still enforce their own actions. Do not use it to relax an existing production deny policy without security approval. Existing match and other parameters remain merged; review the rendered constraint and audit status before considering approved enforcement. The exception guide provides concrete narrow-match examples and their risks; prefer fixing resources over expanding exclusions.

Gatekeeper’s Config excludes kube-system and the Gatekeeper release namespace from processing (with OpenShift-specific exclusions), and limits synced objects to Ingresses, Namespaces, Pods, and Services. The package enables audit match-kind-only behavior and caps recorded violations at 1000. It also enables deny and mutation logging while disabling admission and audit event emission by default.

See Constraint Framework, Constraint Templates, and Violation Exceptions for this package’s policy model and exception process. Prefer correcting a violating resource. When an exception is necessary, make it as narrow as possible and document its security justification; broad namespace exclusions and disabling a constraint are progressively riskier options.

Networking, metrics, and mesh behavior

Gatekeeper is intentionally outside the Istio service mesh: Big Bang disables sidecars, ambient mode, HBONE injection, and Istio authorization policies for this package. This is a package integration decision, not a workload option to reverse casually.

When network policies are enabled, the chart permits Kubernetes API access for Gatekeeper and the cleanup job, permits API-server ingress to the admission webhook on port 8443, and permits configured monitoring scrapes to the metrics endpoint on port 8888. Set monitoring.enabled to render the Gatekeeper PodMonitor; the umbrella supplies the environment-specific monitoring and control-plane network inputs.

CRD and upgrade lifecycle

The package includes a post-upgrade cleanup hook by default. It lists all Gatekeeper constraints and deletes constraints not represented by currently enabled violations values. Review enabled constraints, overrides, and upgrade impact before an upgrade; this cluster-wide lifecycle behavior requires disposable-environment upgrade evidence.

Do not run the deployed policy fixtures against a shared cluster. The chart test script creates and deletes resources in the default namespace and queries cluster-wide constraints. Package CI and an umbrella branch test are the appropriate evidence for constraint or cross-package exception changes.

Package documentation