Enhance OPA policies

[Morriz]

We want our opa policies to also limit access to the following resources:

• istio stuff
• ResourceQuota
• ?

[githubcdr]

We'll use opa-gatekeeper (v3) for this, this is the latest version of OPA for Kubernetes.

How is Gatekeeper different from OPA?

Compared to using OPA with its sidecar kube-mgmt (aka Gatekeeper v1.0), Gatekeeper introduces the following functionality:

• An extensible, parameterized policy library
• Native Kubernetes CRDs for instantiating the policy library (aka "constraints")
• Native Kubernetes CRDs for extending the policy library (aka "constraint templates")
• Audit functionality

I've added examples Constrains in the opa-gatekeeper branch, this includes policies per team namespace; nonroot, nohostnetwork and required labels.

[Morriz]

This framework exists and rules should be enforced again after carefully making resources meet their criteria

[Morriz]

@githubcdr see here comments from closed duplicate issue:

See below

On Thu, 10 Sep 2020 at 16:09, cDR notifications@github.com wrote:

Do we want to set quotas on the namespace or enforce them using OPA?

opa is nicer and allows pre deploy linting

Limitrange and OPA seems to be a weird combo, I'll test this.

Limitrange sux. We should check resource specs in opa. Again better to lint

Do team get a dedicated namespace or will we allow multiple teams in
the same namespace?

one per ns

[Morriz]

only resource constraint template for now

[Morriz]

Do you think you can still do that this week?

[Morriz]

Whoever will do this task, please upgrade the operator chart by copying the contents of this file:

https://github.com/open-policy-agent/gatekeeper/blob/master/deploy/gatekeeper.yaml

into the templates/gatekeeper.yaml file

and updating Chart.yaml to reflect the new version

[rawc0der]

We should start refactoring all the policies to a common .rego language syntax, since the Konstraint library is going to support input.parameters as part of the core definitions.

PR that started all the mess here - plexsystems/konstraint#80
Nice to see the community reacting so quickly

[j-zimnowoda]

Nice to see the community reacting so quickly
Indeed that is really encouraging

[Morriz]

Awesome!