Constraint Templates

Constraint Templates describes both the Rego that enforces the Constraint and the schema of the Constraint. The Constraint schema allows an admin to fine-tune the behavior, much like arguments to a function. For example, a Constraint Template can be created to check all the labels described in a Constraint to be present. Templates are always defined in YAML format.

Create New Template

Perform the below steps to create a new Constraint Template:

• Login to the Controller and select Constraint Templates under OPA Gatekeeper. Users can view the list of existing templates on the Constraint Templates page
• Click New Template
• Provide a name for the template and select an Artifact Sync option
• To upload a file from the system, select the Upload files manually option
• To use the files available from the git repository, select the Pull files from repository option
• Click Create to proceed or Cancel to abort the process

Example of YAML file:

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sreplicalimits
  annotations:
    description: >-
      Requires that objects with the field `spec.replicas` (Deployments,
      ReplicaSets, etc.) specify a number of replicas within defined ranges.
spec:
  crd:
    spec:
      names:
        kind: K8sReplicaLimits
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          type: object
          properties:
            ranges:
              type: array
              description: Allowed ranges for numbers of replicas.  Values are inclusive.
              items:
                type: object
                description: A range of allowed replicas.  Values are inclusive.
                properties:
                  min_replicas:
                    description: The minimum number of replicas allowed, inclusive.
                    type: integer
                  max_replicas:
                    description: The maximum number of replicas allowed, inclusive.
                    type: integer
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sreplicalimits

deployment_name = input.review.object.metadata.name

violation[{"msg": msg}] {
            spec := input.review.object.spec
            not input_replica_limit(spec)
            msg := sprintf("The provided number of replicas is not allowed for deployment: %v. Allowed ranges: %v", [deployment_name, input.parameters])
        }

input_replica_limit(spec) {
            provided := input.review.object.spec.replicas
            count(input.parameters.ranges) > 0
            range := input.parameters.ranges[_]
            value_within_range(range, provided)
        }

value_within_range(range, value) {
            range.min_replicas <= value
            range.max_replicas >= value
        }

• Click Choose File and upload the YAML file (if the Upload files manually option was chosen)
• Select the name of the repository from the drop-down and enter the path for the YAML file (if the Pull files from repository option was chosen)

Advanced Settings (Optional)

• Click Advanced Settings to select any of the provided options
• force: Enabling force option forces resource updates through a replacement strategy
• disableOpenAPIValidation: Enabling DisableOpenAPIValidation option prevents validating rendered YAML templates against the Kubernetes OpenAPI Schema

Below is an example of Upload files manually

Below is an example of Pull files from Repository

• Click Save & Exit

Edit / Delete Templates

• Click the Delete icon to delete or Edit icon to edit the existing templates

Template Types

Two types of Constraint Templates are Custom and System

• Templates created by customers are listed as Custom
• Templates created by system for reference are listed as System. Users can edit but cannot delete the System templates

Important

Users with Namespace Admin role do not have access to Constraint Templates page.