{"id":24548223,"url":"https://github.com/gotoren/gatekeeper-policies-playground","last_synced_at":"2025-03-16T11:20:49.529Z","repository":{"id":272250241,"uuid":"881290266","full_name":"GotoRen/gatekeeper-policies-playground","owner":"GotoRen","description":null,"archived":false,"fork":false,"pushed_at":"2025-01-13T07:50:50.000Z","size":13,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-22T23:16:29.412Z","etag":null,"topics":["gatekeeper","kubernetes","opa","policy-as-code","rego"],"latest_commit_sha":null,"homepage":"https://www.ren510.dev/blog/opa-gatekeeper-policy","language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GotoRen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-31T09:23:50.000Z","updated_at":"2025-01-13T07:50:53.000Z","dependencies_parsed_at":"2025-01-13T08:34:57.738Z","dependency_job_id":"08903fd5-078b-4410-b74b-1371959f172d","html_url":"https://github.com/GotoRen/gatekeeper-policies-playground","commit_stats":null,"previous_names":["gotoren/gatekeeper-policies-playground"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GotoRen%2Fgatekeeper-policies-playground","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GotoRen%2Fgatekeeper-policies-playground/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GotoRen%2Fgatekeeper-policies-playground/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GotoRen%2Fgatekeeper-policies-playground/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GotoRen","download_url":"https://codeload.github.com/GotoRen/gatekeeper-policies-playground/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243858573,"owners_count":20359375,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gatekeeper","kubernetes","opa","policy-as-code","rego"],"created_at":"2025-01-22T23:16:31.023Z","updated_at":"2025-03-16T11:20:49.503Z","avatar_url":"https://github.com/GotoRen.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gatekeeper-policies-playground\n\n## Gatekeeper インストール\n\n```shell\n$ cd ./gatekeeper-system/playground\n$ kustomize build . --enable-helm | kubectl apply -f -\n```\n\n## ポリシの作成\n\n1. Rego でポリシとテストを記述\n\n\u003e `./policies/yet-another-gatekeeper-policy`\n\n2. Rego で定義したポリシをテストする\n\n```shell\n$ make test/policy ## $ opa test -v ./policies\n```\n\n3. Rego から `ConstraintTemplate` を生成する\n4. `gatekeeper/$policy_name/template`に `ConstraintTemplate` を配置する\n\n```shell\n$ make build/template ## $ konstraint create policies \u0026\u0026 ./hack/mv-templates.sh\n```\n\n5. `Constraint` でポリシの適用範囲を定義\n\n\u003e `./gatekeeper/yet-another-gatekeeper-policy/constraint/constraint.yaml`\n\n6. `testdata` に検証するサンプルマニフェストを用意\n\n\u003e `./gatekeeper/yet-another-gatekeeper-policy/constraint/testdata`\n\n7. `Suite` でテスト対象となるポリシスタック（Constraint, Template, 対象マニフェスト）を定義\n\n\u003e `./gatekeeper/yet-another-gatekeeper-policy/suite.yaml`\n\n8. `Suite` で `ConstraintTemplate` をテストを実行\n\n```shell\n### gator verify で一括検証する場合\n$ make test/gatekeeper ## $ gator verify -v ./gatekeeper/...\n\n### gator test で単一のマニフェストを検証する場合\n$ cat ./gatekeeper/yet-another-gatekeeper-policy/constraint/testdata/my-manifest.yaml | gator test \\\n    -f gatekeeper/yet-another-gatekeeper-policy/constraint/constraint.yaml \\\n    -f gatekeeper/yet-another-gatekeeper-policy/template/template.yaml\n```\n\n## ポリシの適用\n\n1. ConstraintTemplate をインストール\n\n```sh\n$ kubectl apply -f ./gatekeeper/yet-another-gatekeeper-policy/template/template.yaml\n```\n\n2. Constraint をインストール\n\n```sh\n$ kubectl apply -f ./gatekeeper/yet-another-gatekeeper-policy/constraint/constraint.yaml\n```\n\n## 検証\n\n- 例：`privileged-container`\n\n```shell\n### 検証の名前空間を作成\n$ kubectl apply -f ./gatekeeper/privileged-container/constraint/testdata/restricted-namespace.yaml\n\n### 違反リソースをデプロイ\n$ kubectl apply -f ./gatekeeper/privileged-container/constraint/testdata/denied-pod.yaml\nError from server (Forbidden): error when creating \"./gatekeeper/privileged-container/constraint/testdata/denied-pod.yaml\": admission webhook \"validation.gatekeeper.sh\" denied the request: [deny-privileged-container] privileged-container: apiVersion: v1, kind: Pod, name: denied-pod, container: denied-container; container runs as privileged\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgotoren%2Fgatekeeper-policies-playground","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgotoren%2Fgatekeeper-policies-playground","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgotoren%2Fgatekeeper-policies-playground/lists"}