List templates and live constraints

Enumerate ConstraintTemplates and every instantiated constraint kind across namespaces

kubectl get constrainttemplates && kubectl get constraints -A
tool
opa-gatekeeper3 commands
tags
opa-gatekeepersecurityk8sgitops

More opa-gatekeeper commands

  • Audit constraint violations via status
    kubectl get k8srequiredlabels <name> -o jsonpath='{.status.totalViolations} {range .status.violations[*]}{"\n"}{.kind}/{.name}: {.message}{end}'

    Read offending resources from a constraint's audit status without re-scanning

  • Offline policy test with gator
    gator test -f policy/ && gator verify ./suite

    Validate templates+constraints against fixtures with no cluster; modern: shift-left in CI

all 3 opa-gatekeeper commands