Offline policy test with gator

Validate templates+constraints against fixtures with no cluster; modern: shift-left in CI

gator test -f policy/ && gator verify ./suite
tool
opa-gatekeeper3 commands
tags
opa-gatekeepercisecuritytroubleshooting

More opa-gatekeeper commands

  • List templates and live constraints
    kubectl get constrainttemplates && kubectl get constraints -A

    Enumerate ConstraintTemplates and every instantiated constraint kind across namespaces

  • Audit constraint violations via status
    kubectl get k8srequiredlabels <name> -o jsonpath='{.status.totalViolations} {range .status.violations[*]}{"\n"}{.kind}/{.name}: {.message}{end}'

    Read offending resources from a constraint's audit status without re-scanning

all 3 opa-gatekeeper commands