website·Indexed 29 days ago
https://open-policy-agent.github.io/gatekeeper/website/docs/A collection of ConstraintTemplates for Gatekeeper, providing pre-defined validation and mutation policies for Kubernetes. Includes templates for pod security standards (pod-security-baseline and pod-security-restricted), resource limits, API deprecation checks, and container security controls such as Seccomp, AppArmor, and SELinux.
Gatekeeper (v3.10+ stable) provides mutation policies via specific Custom Resource Definitions (CRDs) called mutators. These allow modifying Kubernetes resources at request time. There are four primary mutators:
AssignMetadata: Modifies the metadata section (labels and annotations only).Assign: Modifies any field outside the metadata section.ModifySet: Adds or removes entries from a list (e.g., container arguments).AssignImage: Specifically modifies components of an image string (domain, path, tag).Gatekeeper (v3.10+ stable) allows modifying Kubernetes resources at request time using mutation-specific CRDs called mutators. There are four primary mutators:
AssignMetadata: Modifies the metadata section (specifically labels and annotations).Assign: Modifies any field outside the metadata section.ModifySet: Adds or removes entries from a list (set-like behavior).AssignImage: Specifically modifies components of an image string (domain, path, tag).http.send because it provides better security (restricting accessible hosts), supports mutation (which http.send does not), and allows Gatekeeper to manage caching and batching for better performance.http.send because it supports mutation, improves security by restricting accessible hosts, and allows Gatekeeper to manage response caching and request batching.Gatekeeper mutation allows modifying Kubernetes resources at request time based on customizable policies. This feature is available in Gatekeeper v3.4+ (alpha). There are two primary CRDs used for mutations:
metadata section of a resource. Due to the sensitivity of metadata, this is currently limited to adding labels and annotations.metadata section.http.send because it supports mutation, improves security by restricting accessible hosts, and allows Gatekeeper to manage caching and batching for better performance.Gatekeeper mutation policies allow the modification of Kubernetes resources at request time. Unlike validation constraints, mutation policies use specific mutation CRDs (mutators) rather than ConstraintTemplate and Constraint resources.
Available mutators include:
AssignMetadata: Modifies the metadata section of a resource (has stricter rules than other mutators).Assign: Modifies any field outside the metadata section.ModifySet: Adds or removes entries from a list (e.g., container arguments).AssignImage: Modifies components of an image string.http.send because it supports mutation, improves security by restricting accessible hosts, and enables better performance through Gatekeeper-controlled caching and request batching.ConstraintTemplate and Constraint resources. Mutation is stable in Gatekeeper version v3.10+.enable-generator-resource-expansion flag to false.