{"page":{"pageid":1173,"slug":"skill-cybersec-implementing-opa-gatekeeper-for-policy-enforcement","title":"implementing-opa-gatekeeper-for-policy-enforcement skill (Anthropic-Cybersecurity-Skills)","content":"**What it does.** Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller. Part of [[skills-anthropic-cybersecurity-skills]] (mukul975/Anthropic-Cybersecurity-Skills).\n\n| | |\n| --- | --- |\n| Upstream | [mukul975/Anthropic-Cybersecurity-Skills](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) |\n| Skill file | [skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md) |\n| License | Apache-2.0 (skill folder LICENSE) |\n| Author | mukul975 |\n| Fetched | 2026-09-10 |\n\n## Install\n\n- `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-opa-gatekeeper-for-policy-enforcement`, or copy the skill folder into `~/.claude/skills/implementing-opa-gatekeeper-for-policy-enforcement/`.\n- Raw file: `curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md`\n\n## SKILL.md (verbatim)\n\n```yaml\nname: implementing-opa-gatekeeper-for-policy-enforcement\ndescription: >-\n Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes\n ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny\n resource requests at admission time. Use when enforcing custom policy-as-code at admission\n on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a\n rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint,\n Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles\n that Pod Security Admission already covers - use\n implementing-pod-security-admission-controller.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- opa\n- gatekeeper\n- kubernetes\n- admission-control\n- policy-as-code\n- rego\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n```\n\n# Implementing OPA Gatekeeper for Policy Enforcement\n\n## Overview\n\nOPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.\n\n\n## When to Use\n\n- When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+\n- Helm 3\n- kubectl with cluster-admin access\n- Familiarity with Rego policy language\n\n## Installing Gatekeeper\n\n```bash\n# Install via Helm\nhelm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts\nhelm repo update\n\nhelm install gatekeeper gatekeeper/gatekeeper \\\n --namespace gatekeeper-system --create-namespace \\\n --set replicas=3 \\\n --set audit.replicas=1 \\\n --set audit.logLevel=INFO\n\n# Verify\nkubectl get pods -n gatekeeper-system\nkubectl get crd | grep gatekeeper\n```\n\n### Verify Installation\n\n```bash\n# Check webhook\nkubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration\n\n# Check CRDs\nkubectl get crd constrainttemplates.templates.gatekeeper.sh\nkubectl get crd configs.config.gatekeeper.sh\n```\n\n## ConstraintTemplate Examples\n\n### 1. Require Labels on Resources\n\n```yaml\n# template-required-labels.yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8srequiredlabels\nspec:\n crd:\n spec:\n names:\n kind: K8sRequiredLabels\n validation:\n openAPIV3Schema:\n type: object\n properties:\n labels:\n type: array\n items:\n type: string\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8srequiredlabels\n\n violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n provided := {label | input.review.object.metadata.labels[label]}\n required := {label | label := input.parameters.labels[_]}\n missing := required - provided\n count(missing) > 0\n msg := sprintf(\"Missing required labels: %v\", [missing])\n }\n```\n\n```yaml\n# constraint-require-team-label.yaml\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: K8sRequiredLabels\nmetadata:\n name: require-team-label\nspec:\n match:\n kinds:\n - apiGroups: [\"\"]\n kinds: [\"Namespace\"]\n - apiGroups: [\"apps\"]\n kinds: [\"Deployment\"]\n parameters:\n labels:\n - \"team\"\n - \"environment\"\n```\n\n### 2. Block Privileged Containers\n\n```yaml\n# template-block-privileged.yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8sblockprivileged\nspec:\n crd:\n spec:\n names:\n kind: K8sBlockPrivileged\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8sblockprivileged\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n container.securityContext.privileged == true\n msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n }\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.initContainers[_]\n container.securityContext.privileged == true\n msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n }\n```\n\n```yaml\n# constraint-block-privileged.yaml\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: K8sBlockPrivileged\nmetadata:\n name: block-privileged-containers\nspec:\n match:\n kinds:\n - apiGroups: [\"\"]\n kinds: [\"Pod\"]\n namespaces:\n - \"production\"\n - \"staging\"\n```\n\n### 3. Restrict Container Image Registries\n\n```yaml\n# template-allowed-repos.yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8sallowedrepos\nspec:\n crd:\n spec:\n names:\n kind: K8sAllowedRepos\n validation:\n openAPIV3Schema:\n type: object\n properties:\n repos:\n type: array\n items:\n type: string\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8sallowedrepos\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n not image_matches(container.image)\n msg := sprintf(\"Container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n }\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.initContainers[_]\n not image_matches(container.image)\n msg := sprintf(\"Init container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n }\n\n image_matches(image) {\n repo := input.parameters.repos[_]\n startswith(image, repo)\n }\n```\n\n```yaml\n# constraint-allowed-repos.yaml\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: K8sAllowedRepos\nmetadata:\n name: restrict-image-repos\nspec:\n match:\n kinds:\n - apiGroups: [\"\"]\n kinds: [\"Pod\"]\n parameters:\n repos:\n - \"gcr.io/my-project/\"\n - \"ghcr.io/my-org/\"\n - \"registry.k8s.io/\"\n```\n\n### 4. Enforce Resource Limits\n\n```yaml\n# template-require-limits.yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8srequirelimits\nspec:\n crd:\n spec:\n names:\n kind: K8sRequireLimits\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8srequirelimits\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n not container.resources.limits.cpu\n msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n }\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n not container.resources.limits.memory\n msg := sprintf(\"Container %v has no memory limit\", [container.name])\n }\n```\n\n### 5. Block Latest Image Tag\n\n```yaml\n# template-block-latest-tag.yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8sblocklatesttag\nspec:\n crd:\n spec:\n names:\n kind: K8sBlockLatestTag\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8sblocklatesttag\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n endswith(container.image, \":latest\")\n msg := sprintf(\"Container %v uses ':latest' tag. Use specific version tags.\", [container.name])\n }\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n not contains(container.image, \":\")\n msg := sprintf(\"Container %v has no tag (defaults to latest). Use specific version tags.\", [container.name])\n }\n```\n\n### 6. Enforce Read-Only Root Filesystem\n\n```yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8sreadonlyroot\nspec:\n crd:\n spec:\n names:\n kind: K8sReadOnlyRoot\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8sreadonlyroot\n\n violation[{\"msg\": msg}] {\n container := input.review.object.spec.containers[_]\n not container.securityContext.readOnlyRootFilesystem\n msg := sprintf(\"Container %v must have readOnlyRootFilesystem set to true\", [container.name])\n }\n```\n\n## Audit and Enforcement Modes\n\n```yaml\n# Dry-run mode (audit only, don't block)\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: K8sBlockPrivileged\nmetadata:\n name: block-privileged-dryrun\nspec:\n enforcementAction: dryrun # dryrun | deny | warn\n match:\n kinds:\n - apiGroups: [\"\"]\n kinds: [\"Pod\"]\n```\n\n### Check Audit Violations\n\n```bash\n# List all constraint violations\nkubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations\n\n# Check all constraints audit status\nkubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations // [] | length)}'\n```\n\n## Gatekeeper Config (Exempt Namespaces)\n\n```yaml\napiVersion: config.gatekeeper.sh/v1alpha1\nkind: Config\nmetadata:\n name: config\n namespace: gatekeeper-system\nspec:\n match:\n - excludedNamespaces:\n - kube-system\n - gatekeeper-system\n - calico-system\n processes:\n - \"*\"\n```\n\n## Monitoring\n\n```bash\n# Check Gatekeeper metrics\nkubectl port-forward -n gatekeeper-system svc/gatekeeper-webhook-service 8443:443\n\n# Prometheus metrics\nkubectl get --raw /metrics | grep gatekeeper\n```\n\n## Best Practices\n\n1. **Start with dryrun** - Deploy constraints in `dryrun` mode first, review violations, then switch to `deny`\n2. **Use the policy library** - Leverage https://github.com/open-policy-agent/gatekeeper-library for pre-built templates\n3. **Exempt system namespaces** - Always exclude kube-system and gatekeeper-system\n4. **Version control policies** - Store ConstraintTemplates and Constraints in Git\n5. **Monitor audit results** - Check constraint `.status.violations` regularly\n6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying\n7. **Combine with admission webhooks** - Layer Gatekeeper with Pod Security Admission for defense in depth\n\n## Other files in this skill\n\n- [LICENSE](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/LICENSE)\n- [assets/template.md](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md)\n- [references/api-reference.md](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md)\n- [references/standards.md](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md)\n- [references/workflows.md](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md)\n- [scripts/agent.py](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/scripts/agent.py)\n- [scripts/process.py](https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/scripts/process.py)\n\n## assets/template.md (verbatim)\n\n# OPA Gatekeeper Policy Deployment Checklist\n\n## Policy Rollout Plan\n\n### Pre-Deployment\n- [ ] Policy reviewed and approved by security team\n- [ ] Rego logic tested with `opa test`\n- [ ] ConstraintTemplate syntax validated\n- [ ] Exempt namespaces identified\n\n### Deployment Steps\n1. [ ] Deploy ConstraintTemplate to cluster\n2. [ ] Verify CRD created: `kubectl get crd`\n3. [ ] Deploy Constraint in `dryrun` mode\n4. [ ] Wait 24 hours for audit results\n5. [ ] Review violations and remediate/exempt\n6. [ ] Switch to `warn` mode\n7. [ ] Wait 7 days, monitor for issues\n8. [ ] Switch to `deny` mode\n\n### Post-Deployment\n- [ ] Verify enforcement is active\n- [ ] Test with known-bad resource (should be denied)\n- [ ] Update documentation\n- [ ] Alert engineering teams\n\n## Policy Registry\n\n| Policy Name | Kind | Mode | Namespaces | Owner |\n|-------------|------|------|------------|-------|\n| block-privileged | K8sBlockPrivileged | deny | all except kube-system | Security |\n| require-labels | K8sRequiredLabels | deny | all | Platform |\n| allowed-repos | K8sAllowedRepos | deny | production, staging | Security |\n| block-latest | K8sBlockLatestTag | warn | production | DevOps |\n| require-limits | K8sRequireLimits | deny | production | SRE |\n\n## Exemption Request Form\n\n| Field | Value |\n|-------|-------|\n| Constraint Name | |\n| Resource | |\n| Namespace | |\n| Reason | |\n| Duration | |\n| Compensating Control | |\n| Approved By | |\n| Expiry Date | |\n\n## references/api-reference.md (verbatim)\n\n# API Reference: OPA Gatekeeper Policy Enforcement\n\n## OPA REST API (localhost:8181)\n\n| Endpoint | Method | Description |\n|----------|--------|-------------|\n| `/v1/data/{path}` | GET/POST | Query policy |\n| `/v1/policies/{id}` | PUT | Create/update policy |\n| `/v1/data` | POST | Evaluate input against policy |\n\n## Gatekeeper CRDs\n\n| CRD | Description |\n|-----|-------------|\n| `ConstraintTemplate` | Define policy schema + Rego |\n| `Constraint` | Instantiate a template |\n| `Config` | Audit/sync configuration |\n\n## ConstraintTemplate Example\n```yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: k8srequiredlabels\nspec:\n crd:\n spec:\n names:\n kind: K8sRequiredLabels\n targets:\n - target: admission.k8s.gatekeeper.sh\n rego: |\n package k8srequiredlabels\n violation[{\"msg\": msg}] {\n not input.review.object.metadata.labels[\"app\"]\n msg := \"Missing required label: app\"\n }\n```\n\n## Key Libraries\n\n| Library | Use |\n|---------|-----|\n| `kubernetes` | K8s API client |\n| `requests` | OPA REST queries |\n| `subprocess` | kubectl commands |\n\n## references/standards.md (verbatim)\n\n# Standards and References - OPA Gatekeeper Policy Enforcement\n\n## Industry Standards\n\n### NIST SP 800-190\n- Section 4.1: Image vulnerabilities - Enforce image registry restrictions\n- Section 4.2: Image configuration defects - Enforce security context requirements\n- Section 5.2: Registry security - Restrict allowed image sources\n\n### CIS Kubernetes Benchmark v1.8\n- 5.2.1: Ensure Pods cannot run with privileged containers\n- 5.2.2: Ensure Pods cannot share host PID namespace\n- 5.2.3: Ensure Pods cannot share host IPC namespace\n- 5.2.4: Ensure Pods cannot share host network namespace\n- 5.2.5: Ensure containers do not allow privilege escalation\n- 5.2.6: Ensure containers do not run as root\n- 5.2.7: Ensure Pods use seccomp profile\n- 5.2.8: Ensure Pods restrict volume types\n- 5.2.9: Ensure Pods restrict host path volumes\n- 5.7.1: Create administrative boundaries using namespaces\n- 5.7.2: Ensure seccomp profile is set\n- 5.7.3: Apply security context to pods\n\n### NSA/CISA Kubernetes Hardening Guide\n- Section 2: Pod Security - Admission control enforcement\n- Recommends admission controllers to enforce security baselines\n\n## Gatekeeper Policy Library\n\n| Template | Purpose | CIS Mapping |\n|----------|---------|-------------|\n| K8sPSPPrivilegedContainer | Block privileged containers | 5.2.1 |\n| K8sPSPHostNamespace | Block host PID/IPC/Network | 5.2.2-5.2.4 |\n| K8sPSPAllowPrivilegeEscalation | Prevent privilege escalation | 5.2.5 |\n| K8sPSPRunAsNonRoot | Require non-root | 5.2.6 |\n| K8sPSPSeccomp | Require seccomp profiles | 5.2.7 |\n| K8sPSPVolumeTypes | Restrict volume types | 5.2.8 |\n| K8sPSPHostFilesystem | Restrict hostPath | 5.2.9 |\n| K8sAllowedRepos | Restrict image registries | 5.1.1 |\n| K8sRequiredLabels | Enforce labeling standards | Organizational |\n| K8sContainerLimits | Enforce resource limits | Operational |\n\n## Compliance Mappings\n\n### PCI DSS v4.0\n- Req 2.2: Secure system components per configuration standards\n- Req 6.3.2: Develop software securely with automated controls\n\n### SOC 2\n- CC6.1: Logical access to system components is restricted\n- CC8.1: Changes to infrastructure are controlled\n\n## references/workflows.md (verbatim)\n\n# Workflow - OPA Gatekeeper Policy Enforcement\n\n## Phase 1: Install Gatekeeper\n\n```bash\nhelm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts\nhelm repo update\nhelm install gatekeeper gatekeeper/gatekeeper \\\n --namespace gatekeeper-system --create-namespace \\\n --set replicas=3 --set audit.replicas=1\n\nkubectl -n gatekeeper-system rollout status deployment/gatekeeper-controller-manager\n```\n\n## Phase 2: Deploy ConstraintTemplates\n\n```bash\n# Clone Gatekeeper policy library\ngit clone https://github.com/open-policy-agent/gatekeeper-library.git\n\n# Apply common templates\nkubectl apply -f gatekeeper-library/library/pod-security-policy/privileged-containers/template.yaml\nkubectl apply -f gatekeeper-library/library/pod-security-policy/host-namespaces/template.yaml\nkubectl apply -f gatekeeper-library/library/pod-security-policy/allow-privilege-escalation/template.yaml\nkubectl apply -f gatekeeper-library/library/general/allowedrepos/template.yaml\nkubectl apply -f gatekeeper-library/library/general/requiredlabels/template.yaml\nkubectl apply -f gatekeeper-library/library/general/containerlimits/template.yaml\n```\n\n## Phase 3: Deploy Constraints in Dryrun Mode\n\n```bash\nkubectl apply -f - <