Lion Cipher Lab
Enforce Kubernetes policy at admission with OPA Gatekeeper
- Cloud Security
- Advanced
- ~60 min
- Free · no account required
Why it matters
Scanning manifests in CI catches bad config early, but it's advisory — anyone with cluster access can `kubectl apply` around it. Admission control is the hard gate: a policy that runs inside the API server's request path, so a Pod without the required labels, a container running as root, or a namespace missing an owner tag never enters the cluster at all. Gatekeeper is the OPA-based way to do that, and knowing how to author, test, and safely roll out an admission policy — including the audit-first path onto an already-messy cluster and the webhook-reliability footgun — is core cloud-security…
What you'll learn
- OPA Gatekeeper
- Kubernetes admission control
- ConstraintTemplate and Constraint CRDs
- writing Rego policy
- policy enforcement modes (deny / dryrun / warn)
- cluster audit of noncompliant resources
Steps in this lab
- What admission control is, and where Gatekeeper sits
- Spin up a disposable kind cluster (and pin the node version)
- Install Gatekeeper
- Write the ConstraintTemplate (this is where the Rego lives)
- Create the Constraint and prove the deny
- The enforcementAction knob, and auditing what's already there
- Pick the right tool — and respect the webhook footgun