Part 3: Blueprint

What Will You Do

In this part of the self-paced exercise, you will create a custom cluster blueprint with the previously created OPA Gatekeeper policy.

Step 4: Create Blueprint

In this step, you will create a custom cluster blueprint with OPA Gatekeeper.

• Under Infrastructure section, navigate to Blueprints

• Create a New Blueprint, provide a name (e.g. opa-gs-blueprint) and select Custom Blueprint as the type

• Provide a version name (e.g. v1)

• Navigate to the OPA Gatekeeper section and select Enable

• Click Add Policy and add the OPA Gatekeeper policy along with the version (opa-gs-policy, v1)

• Click Save Changes

Step 5: Update Cluster Blueprint

In this step, you will update the cluster to use the newly created custom blueprint with OPA Gatekeeper and the defined policy.

• Navigate to Infrastructure -> Clusters page
• Click on the gear icon next to the cluster
• Select Update Blueprint
• Select the blueprint and the version (e.g. opa-gs-blueprint, v1)
• Click Save and Publish

After the blueprint sync operation is complete, you should see the cluster is now using the "opa-gs-blueprint"

• Navigate to Infrastructure -> Clusters
• Click on "KUBECTL" in the cluster card
• Type the command below

kubectl get pods -n rafay-system

Once the custom cluster blueprint is applied to the target cluster, all configured add-ons (managed and self managed) are automatically deployed to the cluster. You should see a result like the following showing the OPA Gatekeeper pods running.

NAME                                             READY   STATUS    RESTARTS   AGE
controller-manager-v3-6b748b7695-nnffs           1/1     Running   0          4m28s
edge-client-67b7695748-9qfll                     1/1     Running   0          2m51s
gatekeeper-audit-7f574bdf8b-kkpz4                2/2     Running   0          104s
gatekeeper-controller-manager-867b454866-8g4mx   2/2     Running   0          104s
gatekeeper-controller-manager-867b454866-qd5zd   2/2     Running   0          104s
gatekeeper-controller-manager-867b454866-rjx2k   2/2     Running   0          104s
ingress-controller-v1-controller-bzhsb           1/1     Running   0          3m23s
ingress-controller-v1-controller-s6ckz           1/1     Running   0          4m4s
rafay-connector-v3-7f97cd668-wc9nj               1/1     Running   0          4m28s
relay-agent-5f99474d86-jkmz4                     1/1     Running   0          4h8m

Recap

As of this step, you have created a cluster blueprint with OPA Gatekeeper and applied this blueprint to an existing cluster. You are now ready to move onto the next step where you will deploy a test workload to test the policy constraints.

Step 4: Create Blueprint

In this step, you will create a custom cluster blueprint with OPA Gatekeeper. The "blueprint-v2.yaml" file contains the declarative specification for the blueprint.

• Open Terminal (on macOS/Linux) or Command Prompt (Windows) and navigate to the folder where you forked the Git repository
• Navigate to the folder "/getstarted/opa_gatekeeper/blueprint"

Ensure you update the "project: defaultproject" with the name of the project in your Org

apiVersion: infra.k8smgmt.io/v3
kind: Blueprint
metadata:
  name: opa-gs-blueprint
  project: defaultproject
  description: opa getting started blueprint
spec:
  base:
    name: default
    version: 1.17.0
  defaultAddons:
    csiSecretStoreConfig:
      providers: {}
    enableIngress: true
    enableLogging: false
    enableMonitoring: true
    enableVM: false
  drift:
    enabled: false
  networkPolicy: {}
  opaPolicy:
    opaPolicy:
    - name: opa-gs-policy
      version: opa-gs-policy-version
    profile:
      name: default
  placement: {}
  sharing:
    enabled: false
  version: v1

• Type the command below to create the blueprint

rctl apply -f blueprint-v2.yaml

If you did not encounter any errors, you can optionally verify if everything was created correctly on the controller.

• Navigate to the "defaultproject" project in your Org
• Select Infrastructure -> Blueprint
• Click on the "opa-gs-blueprint" custom cluster blueprint

Step 5: Update Cluster Blueprint

In this step, you will update the cluster to use the newly created custom blueprint with OPA Gatekeeper and the defined policy.

• Replace the cluster name, "opa-gs-cluster", in the command below with the name of your cluster.
• Run the updated command

rctl update cluster opa-gs-cluster -b opa-gs-blueprint --blueprint-version v1

If you did not encounter any errors, you can optionally verify if everything was created correctly on the controller.

• Navigate to the "defaultproject" project in your Org

• Select Infrastructure -> Clusters

• You should see the cluster is now using the "opa-gs-blueprint"

• Navigate to Infrastructure -> Clusters

• Click on "KUBECTL" in the cluster card

• Type the command below

kubectl get pods -n rafay-system

Recap