A policy management tool for interacting with Gatekeeper
Konstraint is a CLI tool to assist with the creation and management of templates and constraints when using Gatekeeper.
GO111MODULE=on go get github.com/plexsystems/konstraint
Binaries are also available on the releases page.
To create the Gatekeeper resources, use
To generate the accompanying documentation, use
Both commands support the
--outputflag to specify where to save the output. For more detailed usage documentation, see the CLI Documentation.
When writing policies for Gatekeeper, the Rego must be added to ConstraintTemplates in order for Gatekeeper to enforce the policy. This creates a scenario in which the Rego is written in a
.regofile, and then copied into the ConstraintTemplate. When a change is needed to be made to the Rego, both instances must be updated.
Gatekeeper supports importing libraries into
libsfield. If a change is required to the imported library, every template must be updated to include this new change.
With Gatekeeper, policies are evaluated in the context of an AdmissionReview. This means that policies are typically written with a prefix of
With Conftest, policies are written against
This creates a scenario where the policy needs to be written differently depending upon the context in which the policy is being evaluated in.
In the examples/lib directory, there are multiple libraries that enable policies to be written for both Conftest and Gatekeeper.
You can include as little or as many of these libraries into your policies as desired.
By first validating the Kubernetes manifests with
Confteston a local machine, we can catch manifests that would otherwise violate policy without needing to deploy to a cluster running Gatekeeper.
Konstraint ran without error, but I don't see any new files.
This typically means no policies were found, or the policies did not have any
violationrules, so they are not compatible with Gatekeeper.
For more information, see How Constraints are Created.
My ConstraintTemplates are missing the input parameters
Input parameters can be specified by using one or more
@parametertags in the comment header block. If you use input parameters, Konstraint will skip generating the
Constraintresource for that policy.
For more information, see Using Input Parameters.