https://support.tools/categories/opa-gatekeeper/Recent content in Opa Gatekeeper on Support ToolsHugoen-USFri, 11 Jun 2021 01:11:00 +0000https://support.tools/post/opa-gatekeeper-allow-images-from-private-registry/Fri, 11 Jun 2021 01:11:00 +0000https://support.tools/post/opa-gatekeeper-allow-images-from-private-registry/<p>By default, Kubernetes will pull from Docker Hub unless the deployment requests a fully qualified path. For example, if you deploy a pod with the image <code>rancherlabs/swiss-army-knife,</code> Kubernetes will default <code>index.docker.io/rancherlabs/swiss-army-knife.</code> This is works for environments that can pull images from the internet. But in environments that don&rsquo;t have internet access or if your security team requires all images to be scanned before being deployed. To solve this issue, you&rsquo;ll need to instruct your application teams to update to use a private registry IE <code>private.example.com/rancherlabs/swiss-army-knife.</code>, But there is always a chance that an application team forgets to change their image path in their code. Now you have pods stuck in <code>imagepullbackoff.</code> To prevent this kind of issue, we will set up OPA Gatekeeper to block all deployment requests that are missing our private registry IE <code>private.example.com.</code></p>https://support.tools/post/opa-gatekeeper-require-labels/Fri, 11 Jun 2021 01:11:00 +0000https://support.tools/post/opa-gatekeeper-require-labels/<p>By default, Kubernetes will create namespaces without any labels. This can tracking the owner of the namespace difcult. Also, by having all namespaces labeled. You can use labels for running show-back and charge-back reports based on owner labels.</p>