Installation Profiles

Installation Profiles allows the users to pass the installation parameters for OPA Gatekeeper. The Installation Profiles page shows custom and default profiles. A default installation profile is provided that can be leveraged out of box. In cases where installation profiles need to be customized, a custom installation profile can be created.

Create a Custom Installation Profile

Perform the below steps to create a custom installation profile:

• Login to the Controller and select Installation Profiles under OPA Gatekeeper

• Under the Custom Profiles tab, click New Profile

• Provide a name for the profile

• Select an OPA Version (latest version 3.21.0)

• Click Create

• Provide a version name

Excluded Namespaces and Process
Users are allowed to exclude the namespace(s) and process associated with the selected namespace from evaluation

• Click Add Namespace to exclude one or more namespace(s) from evaluation
• Click Add Process to exclude one or more process(s). Audit process exclusion will exclude resources from specified namespace(s) in audit results. WebHook process exclusion will exclude resources from specified namespace(s) from the admission webhook. Sync process exclusion will exclude resources from specified namespace(s) from being synced into OPA. All would include all of the process exclusions

Sync Objects
Sync Objects allows to sync data into OPA. Kubernetes data can be replicated into OPA via the sync config resource.

• Click Add Sync Object to add group, version and kind

Installation Parameters

• Set the Audit interval and Constraint Violation Limit. This audit functionality enables periodic evaluations of resources to detect pre-existing misconfigurations. The default value of Audit Interval is 60 seconds and Constraint Violations Limit is 20.

• Enable Audit from Cache to rely on OPA cache as the source-of-truth for audit queries

Note: This requires replication of Kubernetes resources into OPA before they can be evaluated against the enforced policies

• If all of the constraints match against specific kinds (example: match only pods), enable Audit Match KindOnly to speed up audit runs. This will only check resources of the kinds specified in the constraints associated with the policy

• A few non-compliant deletes may happen despite the policy. Enable Enable Delete Operations to audit the non-compliant deletes performed through Gatekeeper's admission webhook

• Click Save Changes

New versions of the profile can be created by clicking New Version and going through the same workflow as above. Parameters for the installation profile can be viewed by clicking the info button under Configuration next to Spec.

Using a Custom Installation Profile

Custom Installation Profiles can be selected as part of enabling OPA Gatekeeper when creating or updating a blueprint.

• Go to the OPA Gatekeeper section to enable the capability
• Expand Advanced section, select the installation profile and the version

OPA Version Upgrade/Downgrade

• The older OPA Gatekeeper version (3.7.1) is not supported on K8s v1.25 or later. On installing the older version 3.7.1 on K8s v1.25, the below error message is shown

• Upgrading the OPA version from 3.7.1 to 3.11.0 on the older K8s version is supported. While downgrading the OPA version from v3.11.0 to v3.7.1 on older K8s version (lower than K8s v1.25), the below error message appears

As mentioned in the error message, uninstall OPA (remove OPA config from Blueprint), delete CRDs using Kubectl manually and again update the blueprint with OPA v3.7.1. This will successfully downgrade the OPA version

The list of CRDs to be deleted are given below:

• assign.mutations.gatekeeper.sh
• assignmetadata.mutations.gatekeeper.sh
• configs.config.gatekeeper.sh
• constraintpodstatuses.status.gatekeeper.sh
• constrainttemplatepodstatuses.status.gatekeeper.sh
• constrainttemplates.templates.gatekeeper.sh
• expansiontemplate.expansion.gatekeeper.sh
• modifyset.mutations.gatekeeper.sh
• mutatorpodstatuses.status.gatekeeper.sh
• providers.externaldata.gatekeeper.sh