Lab 02 — Gatekeeper Policies

Mission Information

Item	Details
Lab ID	K8S-COMPLIANCE-LAB-02
Difficulty	Intermediate to Advanced
Estimated Time	5–6 Hours
Environment	Kubernetes Training Cluster
Platform	Kubernetes, OPA Gatekeeper, Helm, kubectl
Cost	Free
Primary Role	Kubernetes Security Engineer
Supporting Roles	DevSecOps Engineer, Cloud Security Engineer, Platform Engineer, Compliance Analyst
Module	Kubernetes Benchmarks & Compliance
Previous Lab	Lab 01 — CIS Kubernetes Benchmark Assessment
Next Lab	Lab 03 — Kyverno Policies

Mission Scenario

CloudNova Technologies has successfully completed a CIS Kubernetes Benchmark assessment.

Although the cluster is reasonably hardened, security engineers discover an operational challenge.

Developers are still able to deploy workloads that violate organisational security standards.

Examples include:

Privileged containers
Root containers
Missing resource limits
Containers without security contexts
Images from public registries
Missing labels
HostPath volumes
Host networking
Dangerous Linux capabilities

The security team currently identifies these issues only after deployments have already reached production.

The CISO has therefore mandated preventive governance, ensuring that non-compliant workloads are rejected before they are created.

CloudNova Technologies has selected Open Policy Agent (OPA) Gatekeeper as the enterprise policy engine.

Your mission is to deploy Gatekeeper, create enterprise policies, validate compliance, and demonstrate how Kubernetes admission control prevents insecure workloads from entering the cluster.

Learning Objectives

By completing this lab you will learn how to:

Understand OPA Gatekeeper
Understand Constraint Templates
Understand Constraints
Deploy Gatekeeper
Validate Gatekeeper installation
Create governance policies
Enforce required labels
Prevent privileged containers
Prevent root containers
Block HostPath volumes
Restrict Linux capabilities
Enforce resource requests and limits
Audit existing workloads
Review Gatekeeper violations
Produce enterprise governance reports

Enterprise Governance Architecture

Developer

      │

kubectl apply

      │

      ▼

Kubernetes API Server

      │

      ▼

OPA Gatekeeper

      │

 ┌────┴───────────────┐

 ▼                    ▼

Constraint       Constraint
Template          Policy

      │

      ▼

Policy Decision

      │

 ┌────┴─────┐

 ▼          ▼

ALLOW     DENY

Enterprise Policy Workflow

Developer

      │

Deployment YAML

      │

      ▼

Admission Request

      │

      ▼

Gatekeeper

      │

      ▼

Constraint Evaluation

      │

      ▼

Compliant?

      │

 ┌────┴─────┐

 ▼          ▼

YES        NO

 │          │

 ▼          ▼

Deploy   Reject

Lab Outcomes

By the end of this lab you will have:

Installed Gatekeeper
Verified admission webhooks
Created Constraint Templates
Created Constraints
Tested policy enforcement
Audited existing workloads
Blocked insecure deployments
Reviewed violations
Produced governance evidence

Prerequisites

Before beginning ensure you have:

Kubernetes Cluster
kubectl
Helm
Cluster Administrator permissions
Linux or Windows terminal
Internet connectivity

Tools Used

Tool	Purpose
Kubernetes	Cluster
Gatekeeper	Policy Enforcement
Helm	Installation
kubectl	Administration
jq	JSON Parsing
VS Code	Policy Development

Recommended Lab Structure

lab-02-gatekeeper-policies/

├── templates/
│   ├── k8srequiredlabels.yaml
│   ├── k8srequiredresources.yaml
│   ├── k8snonroot.yaml
│   ├── k8snoprivileged.yaml
│   ├── k8snohostpath.yaml
│   └── k8snocapabilities.yaml
│
├── constraints/
│   ├── required-labels.yaml
│   ├── required-resources.yaml
│   ├── non-root.yaml
│   ├── no-privileged.yaml
│   ├── no-hostpath.yaml
│   └── capability-restrictions.yaml
│
├── manifests/
│   ├── compliant-pod.yaml
│   ├── privileged-pod.yaml
│   ├── root-user.yaml
│   ├── missing-labels.yaml
│   └── hostpath-pod.yaml
│
├── reports/
│   ├── violations.md
│   ├── audit-results.md
│   ├── remediation.md
│   └── governance-report.md
│
└── evidence/

Task 01 — Verify Cluster Access

Verify connectivity.

kubectl cluster-info

Confirm:

Cluster reachable
API Server available
Administrator permissions

Task 02 — Install Gatekeeper

Add repository.

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts

Update repositories.

helm repo update

Install.

helm install gatekeeper gatekeeper/gatekeeper \
--namespace gatekeeper-system \
--create-namespace

Task 03 — Verify Installation

Review Pods.

kubectl get pods \
-n gatekeeper-system

Expected:

Controller Manager
Audit Controller

Task 04 — Verify Webhooks

kubectl get validatingwebhookconfigurations

Confirm.

Gatekeeper webhook exists.

Task 05 — Review Gatekeeper CRDs

kubectl get crds | grep gatekeeper

Review:

ConstraintTemplates
Constraints

Task 06 — Create Required Labels Template

Create.

templates/k8srequiredlabels.yaml

Purpose.

Every workload must contain:

app
owner
environment

Apply.

kubectl apply \
-f templates/k8srequiredlabels.yaml

Task 07 — Create Required Labels Constraint

Create.

constraints/required-labels.yaml

Apply.

kubectl apply \
-f constraints/required-labels.yaml

Task 08 — Test Missing Labels

Deploy.

manifests/missing-labels.yaml

Expected.

Admission Denied

Review.

Violation message.

Task 09 — Create Non-Root Template

Create.

templates/k8snonroot.yaml

Purpose.

Reject.

runAsUser: 0

Apply.

Task 10 — Create Non-Root Constraint

Apply.

kubectl apply \
-f constraints/non-root.yaml

Task 11 — Test Root Container

Deploy.

root-user.yaml

Expected.

Rejected.

Task 12 — Create Privileged Container Template

Reject.

privileged: true

Task 13 — Create Privileged Constraint

Apply.

kubectl apply \
-f constraints/no-privileged.yaml

Task 14 — Test Privileged Container

Deploy.

privileged-pod.yaml

Expected.

Rejected.

Task 15 — Block HostPath Volumes

Create template.

Reject.

hostPath:

Apply.

Constraint.

Task 16 — Test HostPath

Deploy.

hostpath-pod.yaml

Expected.

Rejected.

Task 17 — Restrict Linux Capabilities

Create template.

Reject.

SYS_ADMIN
NET_ADMIN
SYS_MODULE

Apply.

Constraint.

Task 18 — Test Linux Capabilities

Deploy.

Container requesting.

SYS_ADMIN

Expected.

Rejected.

Task 19 — Enforce Resource Requests

Require.

resources:

Requests.

Limits.

Apply.

Task 20 — Test Missing Resources

Deploy Pod.

Without.

Requests.

Expected.

Rejected.

Task 21 — Audit Existing Workloads

Run.

kubectl get constraints

Review audit status.

Task 22 — Review Constraint Violations

kubectl describe constraint

Review.

Violations.

Task 23 — Review Audit Logs

Review.

kubectl logs \
deployment/gatekeeper-audit \
-n gatekeeper-system

Analyse.

Violations
Namespace
Resource
Policy

Task 24 — Deploy Compliant Workload

Deploy.

compliant-pod.yaml

Expected.

Allowed.

Task 25 — Review Admission Events

kubectl get events -A

Review.

Policy enforcement.

Task 26 — Build Governance Matrix

Create.

Policy

Constraint

Risk

Owner

Task 27 — Produce Compliance Report

Document.

Policies
Violations
Exceptions
Recommendations

Task 28 — Evidence Collection

Collect.

Templates
Constraints
Violations
Audit Results
Admission Events
Screenshots
Reports

Task 29 — Cleanup

Delete.

Test resources.

Retain:

Templates
Constraints
Reports

Enterprise Governance Checklist

Control	Status
Gatekeeper Installed	☐
Webhooks Active	☐
Constraint Templates Created	☐
Constraints Applied	☐
Required Labels Enforced	☐
Root Containers Blocked	☐
Privileged Containers Blocked	☐
HostPath Blocked	☐
Linux Capabilities Restricted	☐
Resource Limits Required	☐
Audit Completed	☐
Violations Reviewed	☐
Governance Report Produced	☐

Risk Classification

Critical

Privileged Containers Allowed
Root Containers Allowed
HostPath Access Allowed
Gatekeeper Disabled

High

Missing Resource Limits
Missing Labels
Dangerous Linux Capabilities
Policy Bypass

Medium

Weak Documentation
Missing Owners
Manual Reviews

Low

Naming Standards
Labels Formatting
Metadata Improvements

Skills Developed

After completing this lab you will be able to:

Deploy OPA Gatekeeper
Build Constraint Templates
Create Constraints
Enforce Kubernetes governance
Prevent insecure deployments
Audit existing workloads
Analyse policy violations
Produce enterprise governance reports
Strengthen Kubernetes compliance posture

Knowledge Check

Question 1

What is the primary purpose of OPA Gatekeeper?

Answer: To enforce Kubernetes admission policies that prevent non-compliant resources from being created.

Question 2

What is the difference between a Constraint Template and a Constraint?

Answer: A Constraint Template defines the policy logic, while a Constraint applies that policy to Kubernetes resources with specific enforcement settings.

Question 3

Why should privileged containers be restricted?

Answer: Privileged containers have elevated access to the host and significantly increase the risk of container escape and host compromise.

Question 4

Can Gatekeeper audit existing resources as well as enforce new ones?

Answer: Yes. Gatekeeper can audit existing resources for policy violations while also enforcing policies on new admission requests.

Question 5

Does Gatekeeper replace RBAC or Pod Security Admission?

Answer: No. Gatekeeper complements Kubernetes security controls by providing policy-based governance alongside RBAC, Pod Security Admission, network policies, and other security mechanisms.

Lab Summary

In this lab, you deployed Open Policy Agent (OPA) Gatekeeper and implemented enterprise governance policies to enforce Kubernetes security standards before workloads were admitted into the cluster.

You created Constraint Templates and Constraints to require mandatory labels, prevent privileged and root containers, block HostPath volumes, restrict dangerous Linux capabilities, and enforce resource requests and limits. You validated policy enforcement by testing compliant and non-compliant workloads, reviewed audit results, analysed violations, and produced governance documentation.

This lab demonstrates how preventive policy enforcement helps organisations reduce configuration drift, strengthen compliance, and ensure that Kubernetes workloads consistently meet enterprise security requirements before reaching production.

What’s Next?

Next Lab: Lab 03 — Kyverno Policies

In the next lab, you will deploy Kyverno and implement policy-as-code using native Kubernetes resources, enforce security controls, automatically mutate workloads, validate compliance, generate governance reports, and compare Kyverno’s capabilities with OPA Gatekeeper in enterprise Kubernetes environments.