Why opa-gatekeeper policies doesn't work in GK default namespace.

[ZiaUrRehman-GBI]

I Have implemented the following template and constraint but I’m still able to create a load balancer in the default namespace of Kubernetes.
`apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: loadbalancerconstraint
spec:
crd:
spec:
names:
kind: LoadBalancerConstraint
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package insomniacoder.constraint
violation[{"msg": msg}] {
input.review.kind.kind = "Service"
input.review.operation = "CREATE"
input.review.object.spec.type = "LoadBalancer"
allowed_users := {"admin-service-account@PROJECT_ID.iam.gserviceaccount.com", "test-service-account@PROJECT_ID.iam.gserviceaccount.com"}
not allowed_users[input.review.userInfo.username]
msg := sprintf("Only users %v are allowed to create LoadBalancer", [allowed_users])
}

---

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: LoadBalancerConstraint
metadata:
name: loadbalancerconstraint
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Service"]`

[maxsmythe]

Hi!

Can you re-post your example resources using triple backtics (```) to wrap the yaml, it may help diagnose the issue, since it will preserve indentation.

• You can remove spec.match.kinds from the constraint to remove a variable here.
• Can you create a deny-all constraint that dumps the contents of the review in the violation? That may help in case there is a problem between the object and the Rego. Instructions on how to create a deny all constraint are here:

https://open-policy-agent.github.io/gatekeeper/website/docs/debug#viewing-the-request-object

• Are there other constraints/templates that are working? If not, there is a possibility that there is an issue calling the webhook. Usually this is the result of firewall issues. Here is a common one:

https://open-policy-agent.github.io/gatekeeper/website/docs/vendor-specific#running-on-private-gke-cluster-nodes

[ZiaUrRehman-GBI]

kind: ConstraintTemplate
metadata:
  name: loadbalancerconstraint
spec:
  crd:
    spec:
      names:
        kind: LoadBalancerConstraint
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package insomniacoder.constraint
        violation[{"msg": msg}] {
          input.review.kind.kind = "Service"
          input.review.operation = "CREATE"
          input.review.object.spec.type = "LoadBalancer"
          allowed_users := {"admin-service-account@PROJECT_ID.iam.gserviceaccount.com", "test-service-account@PROJECT_ID.iam.gserviceaccount.com"} 
          not allowed_users[input.review.userInfo.username]
          msg := sprintf("Only users %v are allowed to create LoadBalancer", [allowed_users])
        }

---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: LoadBalancerConstraint
metadata:
  name: loadbalancerconstraint
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]

[ZiaUrRehman-GBI]

This template and constraint are working for other namespaces but don't restrict to creating of Load Balancer in the default namespace.

[ZiaUrRehman-GBI]

@maxsmythe I don't get your this point.

• You can remove spec.match.kinds from the constraint to remove a variable here.

[maxsmythe]

Sorry, unclear wording "remove a variable here" -> "remove a bit of config so there are less things to consider when debugging"

[ritazh]

When you say “doesn’t work in default GK namespace”, do you mean resources deployed to the “default” namespace is not getting blocked? what version of GK are using.

[ZiaUrRehman-GBI]

@ritazh yes, resources are not blocked in the default namespace. Although I am not able to create a load balancer in other namespaces.
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.3", GitCommit:"c92036820499fedefec0f847e2054d824aea6cd1", GitTreeState:"clean", BuildDate:"2021-10-27T18:34:20Z", GoVersion:"go1.16.10", Compiler:"gc", Platform:"darwin/amd64"}

[ZiaUrRehman-GBI]

Thanks, it's started working in the default namespace as well.

[maxsmythe]

What fixed it? Upgrading GK?