Learn KOP - Part 3 - Test OPA Policy - Rafay Product Documentation

Part 3: Test

This is Part 3 of a multi-part, self-paced quick start exercise.

What Will You Do

In part 3, you will create and attempt to publish a workload on the cluster that will violate the OPA constraints that are currently enforced by OPA Gatekeeper on the cluster.

Step 1: Create Namespace

In this step, we will create a namespace for our workload.

Navigate to Infrastructure -> Namespaces
Click "New Namespace"
Enter a name for the namespace
Select "Wizard" for the type
Click "Save"
Click "Save & Go To Placement"
Select the cluster with the OPA Gatekeeper blueprint
Click "Save & Go to Publish"
Click "Publish"
Click "Exit"

Step 2: Create Workload

In this step, we will create a test workload in order to test the OPA constraints in the OPA policy running on the cluster.

Navigate to Applications -> Workloads
Click on your NGINX workload
Click "New Workload" -> "Create New Workload"
Enter a name for the workload
Select "K8s YAML" for the package type
Click "Continue"
Save the below workload YAML file to your machine

apiVersion: v1
kind: Pod
metadata:
  name: opa-disallowed
  labels:
    owner: me.agilebank.demo
spec:
  containers:
    - name: opa
      image: openpolicyagent/opa:0.9.2
      args:
        - "run"
        - "--server"
        - "--addr=localhost:8080"
      resources:
        limits:
          cpu: "100m"
          memory: "2Gi"

In the console, Click "Choose File"
Select the workload YAML file that was previously saved
Click "Save and Go to Placement"
Select the cluster with the OPA Gatekeeper blueprint
Click "Save & Go to Publish"
Click "Publish"

The workload is now attempting to be published on the cluster. OPA Gatekeeper is acting as the admission controller, validating the workload specification against the applied OPA constraints. The workload should be denied by the admission controller as it violates the applied OPA constraints.

Important
Our workload has defined "resource limits" over the allowed limit and therefore should be blocked on the cluster.

Recap

In this part, you created a workload and attempted to publish it to the cluster. You saw that the workload could not be published as it violated a constraint.

You are now ready to use any of the turnkey OPA policies provided in this guide within your environment.