OPA Gatekeeper特权Pod拦截策略失效问题求助

你的策略不生效核心是两个逻辑错误，下面逐个说明并给出修复方案：

1. 命名空间判断逻辑错误 #

Rego里写的input.request.namespace == ["alpha", "beta"]完全不对——单个字符串和数组做相等比较永远不会成立。正确的写法是用in操作符：

input.request.namespace in ["alpha", "beta"]

不过更高效的是直接删掉这行，因为你已经在Constraint的spec.match.namespaces里指定了目标命名空间，Gatekeeper会自动过滤其他命名空间的请求，Rego里没必要重复判断。

2. SecurityContext位置判断错误 #

你的测试Pod把privileged: true放在了容器级的securityContext里，但Rego规则只检查了Pod级的spec.securityContext.privileged，相当于漏看了实际配置的位置。必须遍历所有容器来检查：

container := input.request.object.spec.containers[_]
container.securityContext.privileged == true

修复后的完整配置 #

修正后的ConstraintTemplate #

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: disallowprivilegedpods
  annotations:
    description: "Disallow creation of privileged pods in alpha and beta namespaces"
spec:
  crd:
    spec:
      names:
        kind: DisallowPrivilegedPods
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package disallow_privileged_pods

        # 拦截容器级特权配置
        violation[{"msg": msg}] {
          input.request.operation == "CREATE"
          container := input.request.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged container '%s' is blocked - alpha/beta namespaces prohibit privileged pods.", [container.name])
        }

        # 额外拦截Pod级特权配置（防止有人在Pod层面设置）
        violation[{"msg": msg}] {
          input.request.operation == "CREATE"
          input.request.object.spec.securityContext.privileged == true
          msg := "Pod-level privileged mode is blocked - alpha/beta namespaces prohibit privileged pods."
        }

Constraint配置保持不变 #

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DisallowPrivilegedPods
metadata:
  name: disallow-privileged-pods-alpha-beta
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - alpha
      - beta

验证方法 #

重新应用这两个资源后，再尝试创建测试Pod，Gatekeeper会直接拦截。如果还是有问题，查看Gatekeeper控制器日志确认规则加载情况：

kubectl logs -n gatekeeper-system -l control-plane=gatekeeper-controller-manager

内容的提问来源于stack exchange，提问作者Christian K.