GatekeeperKubernetes Setup

Kubernetes Setup

Set up OPA Gatekeeper in your Kubernetes cluster to enforce policies.

Prerequisites

  • Kubernetes cluster v1.16+
  • kubectl access with admin privileges
  • Helm 3.x (recommended)

Installation

Using Helm (Recommended)

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm repo update
 
helm install gatekeeper/gatekeeper \
  --name-template=gatekeeper \
  --namespace gatekeeper-system \
  --create-namespace

Verify Installation

kubectl get pods -n gatekeeper-system

You should see:

  • gatekeeper-audit-* - Audits existing resources
  • gatekeeper-controller-manager-* - Enforces policies on new resources

Using Policies in SRExpert

Creating Policy Templates

  1. Go to Security > Gatekeeper > Policy Templates
  2. Click Create Template
  3. Choose a template from the Policy Examples
  4. Fill in Name, Kind, Description, Category, Severity
  5. Paste the Rego code
  6. Save the template

Applying Policies

  1. Go to Security > Gatekeeper > Policies
  2. Click Create Policy
  3. Select your template
  4. Choose target clusters
  5. Configure parameters
  6. Set enforcement mode (Warn or Deny)
  7. Click Create

Compliance Frameworks

These policies help meet requirements from major compliance frameworks:

FrameworkRequirements Covered
CIS Kubernetes Benchmark5.2 (Pod Security), 5.7 (Network Policies), 4.2 (RBAC)
NIST SP 800-190Container isolation, least privilege, network segmentation
PCI-DSSNetwork segmentation (6.6), Encryption in transit (4.1)
SOC 2CC6.6 (Availability controls), CC6.1 (Access controls)
ISO 27001A.14.1 (Security in development), A.13.1 (Network security)
HIPAA164.312(a)(1) (Access control), 164.312(e)(1) (Transmission security)

References

Next Steps

OverviewPolicy Examples