[Kubernetes] 🛡️ OPA Gatekeeper vs Kyverno: 쿠버네티스 정책 관리 완전 가이드

1kubectl apply
2    ↓
3API Server
4    ↓
5Authentication → Authorization → Admission Control → etcd 저장
6                                       ↑
7                            Mutating / Validating Webhook
8                          (Gatekeeper / Kyverno 가 여기서 동작)

 1API Server
 2    │ AdmissionReview 요청
 3    ▼
 4Gatekeeper Webhook
 5    │ Rego 정책 평가
 6    ▼
 7OPA (정책 평가 엔진)
 8    │ allow / deny 반환
 9    ▼
10API Server (요청 허용 or 거부)

 1apiVersion: templates.gatekeeper.sh/v1beta1
 2kind: ConstraintTemplate
 3metadata:
 4  name: k8srequiredlabels
 5spec:
 6  crd:
 7    spec:
 8      names:
 9        kind: K8sRequiredLabels
10      validation:
11        openAPIV3Schema:
12          properties:
13            labels:
14              type: array
15              items:
16                type: string
17  targets:
18    - target: admission.k8s.gatekeeper.sh
19      rego: |
20        package k8srequiredlabels
21
22        deny[{"msg": msg, "details": {"missing_labels": missing}}] {
23          provided := {label | input.review.object.metadata.labels[label]}
24          required := {label | label := input.parameters.labels[_]}
25          missing := required - provided
26          count(missing) > 0
27          msg := sprintf("필수 레이블이 누락되었습니다: %v", [missing])
28        }

 1apiVersion: constraints.gatekeeper.sh/v1beta1
 2kind: K8sRequiredLabels
 3metadata:
 4  name: ns-must-have-owner
 5spec:
 6  match:
 7    kinds:
 8      - apiGroups: [""]
 9        kinds: ["Namespace"]
10  parameters:
11    labels: ["owner", "env"]

1Error from server ([ns-must-have-owner] 필수 레이블이 누락되었습니다: {"env", "owner"})

1# Helm으로 설치
2helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
3helm install gatekeeper/gatekeeper \
4  --name-template=gatekeeper \
5  --namespace gatekeeper-system \
6  --create-namespace

1# 또는 manifest로 설치
2kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

1kubectl get pods -n gatekeeper-system
2# NAME                                             READY   STATUS
3# gatekeeper-audit-xxxxxxxxx                       1/1     Running
4# gatekeeper-controller-manager-xxxxxxxxx          1/1     Running

1# 정책 위반 리소스 확인
2kubectl get k8srequiredlabels ns-must-have-owner -o yaml
3# status.violations 필드에 위반 리소스 목록이 표시됩니다

 1apiVersion: config.gatekeeper.sh/v1alpha1
 2kind: Config
 3metadata:
 4  name: config
 5  namespace: gatekeeper-system
 6spec:
 7  sync:
 8    syncOnly:
 9      - group: ""
10        version: "v1"
11        kind: "Namespace"

1API Server
2    │ AdmissionReview 요청
3    ▼
4Kyverno Webhook
5    │ ClusterPolicy / Policy 평가
6    ├── Mutate  → 리소스 자동 수정 후 허용
7    ├── Validate → 검증 실패 시 거부
8    └── Generate → 새 리소스 자동 생성

1# Helm으로 설치 (권장)
2helm repo add kyverno https://kyverno.github.io/kyverno/
3helm repo update
4helm install kyverno kyverno/kyverno \
5  -n kyverno \
6  --create-namespace

1# 또는 manifest로 설치
2kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/main/config/install.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-app-label
 5spec:
 6  validationFailureAction: Enforce   # Audit으로 변경하면 감사 모드
 7  rules:
 8    - name: check-app-label
 9      match:
10        any:
11          - resources:
12              kinds:
13                - Pod
14      validate:
15        message: "레이블 'app.kubernetes.io/name' 이 필요합니다."
16        pattern:
17          metadata:
18            labels:
19              app.kubernetes.io/name: "?*"

1Error from server: admission webhook "validate.kyverno.svc-fail" denied the request:
2resource Pod was blocked due to the following policies: require-app-label

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: add-default-resources
 5spec:
 6  rules:
 7    - name: add-resource-limits
 8      match:
 9        any:
10          - resources:
11              kinds:
12                - Pod
13      mutate:
14        patchStrategicMerge:
15          spec:
16            containers:
17              - (name): "*"
18                resources:
19                  limits:
20                    +(memory): "256Mi"
21                    +(cpu): "500m"

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: default-network-policy
 5spec:
 6  rules:
 7    - name: default-deny-ingress
 8      match:
 9        any:
10          - resources:
11              kinds:
12                - Namespace
13      generate:
14        apiVersion: networking.k8s.io/v1
15        kind: NetworkPolicy
16        name: default-deny-ingress
17        namespace: "{{request.object.metadata.name}}"
18        synchronize: true
19        data:
20          spec:
21            podSelector: {}
22            policyTypes:
23              - Ingress