Gatekeeper policy

constraint.yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNsAuth
metadata:
  name: block-deployment-prohibit-namespaces
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["*"]
  parameters:
          namespaces:
                  - "default"    

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: default
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

template.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8snsauth
spec:
  crd:
    spec:
      names:
        kind: K8sNsAuth
      validation:
        openAPIV3Schema:
          properties:
            namespaces:
              type: array
              items: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
       package k8sroleauth

       violation[{ "msg": msg}]{

         ### following line will not work for "deployment" kind since the debug output is "Pod" not "Deployment"
         #input.review.object.kind == "Deployment"
         
         namespace := input.review.object.metadata.namespace 
         disallowed_namespace := input.parameters.namespaces[_]
         contains(disallowed_namespace,namespace)

         debug := input.review.object.kind
         msg := sprintf("create resources under default namespace is not allowed on envoy prod cluster", [debug])}             

ᐅ kubectl get k8snsauth -o yaml

   totalViolations: 83
    violations:
    - enforcementAction: deny
      kind: Secret
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Secret)
      name: default-token-8m5wt
      namespace: default
    - enforcementAction: deny
      kind: Endpoints
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Endpoints)
      name: kubernetes
      namespace: default
    - enforcementAction: deny
      kind: ServiceAccount
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=ServiceAccount)
      name: default
      namespace: default
    - enforcementAction: deny
      kind: Service
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Service)
      name: kubernetes
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-2zs8c.16ba0d5d6d0de29d
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-2zs8c.16ba0d5da9529add
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-2zs8c.16ba0d5daac8b159
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-2zs8c.16ba0d5daf1dd471
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-2zs8c.16ba0d62f14e6d89
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d2f9f2aa60e
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d2feccd1aa0
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d303abd3dcb
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d303c747f36
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d3041de2a41
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-445wg.16ba0d357f556bd6
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-46z48.16ba0dd4909111ae
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-46z48.16ba0dd4c92dc1a2
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-46z48.16ba0dd4cb41d597
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-46z48.16ba0dd4d244e854
      namespace: default
    - enforcementAction: deny
      kind: Event
      message: create resources under default namespace is not allowed on envoy prod
        cluster%!(EXTRA string=Event)
      name: nginx-deployment-66b6c48dd5-46z48.16ba0de19a15b579
      namespace: default

│ status:                                                                                                                                                                                                              │
│   conditions:                                                                                                                                                                                                        │
│   - lastTransitionTime: "2021-11-23T03:18:06Z"                                                                                                                                                                       │
│     lastUpdateTime: "2021-11-23T03:18:06Z"                                                                                                                                                                           │
│     message: Created new replica set "nginx-deployment-66b6c48dd5"                                                                                                                                                   │
│     reason: NewReplicaSetCreated                                                                                                                                                                                     │
│     status: "True"                                                                                                                                                                                                   │
│     type: Progressing                                                                                                                                                                                                │
│   - lastTransitionTime: "2021-11-23T03:18:06Z"                                                                                                                                                                       │
│     lastUpdateTime: "2021-11-23T03:18:06Z"                                                                                                                                                                           │
│     message: Deployment does not have minimum availability.                                                                                                                                                          │
│     reason: MinimumReplicasUnavailable                                                                                                                                                                               │
│     status: "False"                                                                                                                                                                                                  │
│     type: Available                                                                                                                                                                                                  │
│   - lastTransitionTime: "2021-11-23T03:18:06Z"                                                                                                                                                                       │
│     lastUpdateTime: "2021-11-23T03:18:06Z"                                                                                                                                                                           │
│     message: 'admission webhook "validation.gatekeeper.sh" denied the request: [block-deployment-prohibit-namespaces]                                                                                                │
│       create deployment under default ns is not allowed on envoy prod cluster%!(EXTRA                                                                                                                                │
│       string=Pod)'                                                                                                                                                                                                   │
│     reason: FailedCreate                                                                                                                                                                                             │
│     status: "True"                                                                                                                                                                                                   │
│     type: ReplicaFailure                                                                                                                                                                                             │
│   observedGeneration: 1                                                                                                                                                                                              │
│   unavailableReplicas: 3