Audit constraint violations via status

Read offending resources from a constraint's audit status without re-scanning

kubectl get k8srequiredlabels <name> -o jsonpath='{.status.totalViolations} {range .status.violations[*]}{"\n"}{.kind}/{.name}: {.message}{end}'
tool
opa-gatekeeper3 commands
tags
opa-gatekeepersecurityobservabilitytroubleshooting

More opa-gatekeeper commands

  • Offline policy test with gator
    gator test -f policy/ && gator verify ./suite

    Validate templates+constraints against fixtures with no cluster; modern: shift-left in CI

  • List templates and live constraints
    kubectl get constrainttemplates && kubectl get constraints -A

    Enumerate ConstraintTemplates and every instantiated constraint kind across namespaces

all 3 opa-gatekeeper commands