Skip to main content
Version: Next

Kubernetes Fury OPA

Kubernetes Fury OPA provides policy enforcement for the Kubernetes Fury Distribution (KFD) using OPA Gatekeeper.

If you are new to KFD please refer to the official documentation on how to get started with KFD.

Overview

The Kubernetes API server provides a mechanism to review every request that is made, being objects creation, modification or deletion. To use this mechanism the API server allow us to create a Validating Admission Webhook that, as the name says, will validate every requests and let the API server know if the request is allowed or not based on some logic (policy).

Kubernetes Fury OPA module is based on OPA Gatekeeper, a popular open-source Kubernetes-native policy engine with OPA as its core that runs as a Validating Admission Webhook. It allows writing custom constraints (policies) in rego (a tailor-made language) as Kubernetes objects and enforce at runtime.

SIGHUP provides a set of base constraints that could be used both as a starting point to apply constraints to your current workloads or to give you an idea on how to implement new rules matching your requirements.

Packages

Fury Kubernetes OPA provides the following packages:

PackageVersionDescription
Gatekeeper Corev3.7.0Gatekeeper deployment, ready to apply rules.
Gatekeeper RulesN.A.A set of custom rules to get started.
Gatekeeper Policy Managerv0.5.1Gatekeeper Policy Manager, a simple to use web-ui for Gatekeeper.

Click on each package to see its full documentation.

Compatibility

Kubernetes VersionCompatibilityNotes
1.20.xNo known issues
1.21.xNo known issues
1.22.xNo known issues
1.23.x⚠️Conformance tests passed. Not officially supported.

Check the compatibility matrix for additional informations about previous releases of the modules.

Usage

Prerequisites

ToolVersionDescription
furyctl>=0.6.0The recommended tool to download and manage KFD modules and their packages. To learn more about furyctl read the official documentation.
kustomize>=3.5.0Packages are customized using kustomize. To learn how to create your customization layer with kustomize, please refer to the repository.
KFD Monitoring Module>v1.10.0Expose metrics to Prometheus (optional)

You can comment out the service monitor in the kustomization.yaml file if you don't want to install the monitoring module.

Deployment

  1. List the packages you want to deploy and their version in a Furyfile.yml
bases:
- name: opa/gatekeeper
version: "v1.6.2"

See furyctl documentation for additional details about Furyfile.yml format.

  1. Execute furyctl vendor -H to download the packages

  2. Inspect the download packages under ./vendor/katalog/opa/gatekeeper.

  3. Define a kustomization.yaml that includes the ./vendor/katalog/opa/gatekeeper directory as resource.

resources:
- ./vendor/katalog/opa/gatekeeper
  1. Apply the necessary patches. You can find a list of common customization here.

  2. To deploy the packages to your cluster, execute:

kustomize build . | kubectl apply -f -

Common Customizations

Disable constraints

Disable one of the default constraints by creating the following kustomize patch:

patchesJson6902:
- target:
group: constraints.gatekeeper.sh
version: v1beta1
kind: K8sUniqueIngressHost # replace with the kind of the constraint you want to disable
name: unique-ingress-host # replace with the name of the constraint you want to disable
path: patches/allow.yml

add this in the patches/allow.yml file:

- op: "replace"
path: "/spec/enforcementaction"
value: "allow"

Emergency break

If for some reason OPA Gatekeeper is giving you issues and blocking normal operations in your cluster, you can disable it by removing the Validating Admission Webhook definition from your cluster:

kubectl delete ValidatingWebhookConfiguration gatekeeper-validating-webhook-configuration