Review OPA Gatekeeper as a possible tool for testing

[taylor]

Goal: Review using OPA Gatekeeper validate that CNFs continue to carry traffic when appropriate policies are enforced

Tasks:

• Research OPA Gatekeeper
• Create an outline
• Create a rough draft
• Peer review of draft
• Iterate as needed, peer review (optional)
• Add content to markdown

ref: s43

[wvwatson]

OPA vs K-rails

OPA is more rigorous and all inclusive than K-Rails. OPA and Gatekeeper seem to be more configurable and should be able to handle more edge cases than K-Rails. OPA seems to be becoming the standard within the K8s community. OPA has more forks/stars/contributes OPA requires more configuration out of the box.

K-rails has a monitor mode that allows default 'violations' to be monitored and reported on. K-rails has default violations/policies that need very little configuration. The violations are stored in a log and can be scraped. This can be useful for testing a cluster for containers that have privileged mode turned on, among other things.

[wvwatson]

Open Policy Agent is an open source, general-purpose policy engine that unifies policy enforcement across the stack. OPA Gatekeeper provides first-class integration between OPA and Kubernetes.

We can use OPA for at least one CNF Conformance test, and possibly more. The steps for using OPA and OPA Gatekeeper would be as follows:

1. Deploy Gatekeeper using Helm in the potential CNF's cluster

helm install mesosphere-staging/gatekeeper --name gatekeeper

2. Create a privileged pod policy constraint template

kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/library/pod-security-policy/privileged-containers/template.yaml

3. Create the privileged pod policy constraint

kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/library/pod-security-policy/privileged-containers/constraint.yaml

4. Test that the constraint is enforced

kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/library/pod-security-policy/privileged-containers/example.yaml

5. Check the output for errors

Error from server ([denied by psp-privileged-container] Privileged container is not allowed: nginx, securityContext: {"privileged": true}): error when creating "https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/library/pod-security-policy/privileged-containers/example.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [denied by psp-privileged-container] Privileged container is not allowed: nginx, securityContext: {"privileged": true}

[taylor]

@nickolaev peer review?

[wvwatson]

https://hackmd.io/SssiDL4kTNiKfWlkhgqaCg