rh-registry-gatekeeper-provider

Repository provides an example of using the externaldata functionality of Gatekeeper to wrap the Red Hat Registry and other Red Hat tools.

Examples provided below will use the Red Hat Registry API(Pyxis) to validate:

If an Image being pulled from the Registry is Deprecated
if an Image being pulled from the Regisry is End of Life
If an Image being pulled from the Registry has a poor freshness grade

Example provided below will wrap the skopeo cli to:

Mutate a deployment image if it has a tag to using a digest.

Requirements

Requires Gatekeeper 3.11+
Was tested on OpenShift 4.13
The OCP Gatekeeper operator does not seem to create the Provider CRD. That has to be manually added/created.
Gatekeeper Installed

Optional Steps

As mentioned above the OCP Gatekeeper operator does not seem to create the Provider CRD. You can build your own version of the operator from the github link and include the provider CRD. I also provide mine(Gatekeeper 3.11)

To create operator using my edited image

oc adm new-project openshift-gatekeeper-system
oc create -f ./operator/install
oc create -f ./operator/gatekeeper

Steps

We will be enabling our Providers with mTLS and using the Internal OpenShift Service CA to generate the provider certificates.

Create Provider Services. Our service is annotated with the service-ca annotation for cert generation.This should create a Configmap with the service-ca called openshift-service-ca.crt and tls certs in a secret called rh-registry-gatekeeper-provider-tls.
```
oc create -f ./manifest/service/service.yaml
```

Obtain the Service CA and use it to create the Provider

export SERVICE_CA_BUNDLE=$(oc extract -n openshift-gatekeeper-system configmap/openshift-service-ca.crt --to=- | base64 | tr -d '\n')

cat manifest/provider-mutate.yaml | envsubst | oc create -f -

cat manifest/provider-validate.yaml | envsubst | oc create -f -

unset SERVICE_CA_BUNDLE

Create our provider deployment. Deployments the gatekeeper-webhook-server-cert CA cert from the gatekeeper install example. If CA is different please change secret.
```
oc create -f ./manifest/deployment.yaml -n openshift-gatekeeper-system
```

With our provider installed we can try a few use cases

1 Don't allow Deprecated Images to Run

Create Our Gatekeeper Template.

oc create -f ./policy/validate/template.yaml

Create Our Gatekeeper Constraint

oc create -f ./policy/validate/constraint.yaml

With Our Constraint and Template Created, Creating a deployment with a deprecated image from a Red Hat Registry should cause violations
```
oc create -f ./policy/validate/test/deployment-deprecated.yaml
```
UI Violation

CLI Violation
Provider/Template were written in way to still work if image is not from RH registry. So creating below deployment should work fine.
```
oc create -f ./policy/validate/test/deployment-not-rh-registry.yaml
```

2 Mutating tag to digest's. As an example our Provider also embeds the skopeo command line and will use attempt to use that to obtain the digest.

Please delete the validation Policies first.

oc delete -f ./policy/validate/constraint.yaml
oc delete -f ./policy/validate/template.yaml

Create our Gatekeeper mutation template

oc create -f ./policy/mutate/assign.yaml

Confirm Image Name from sample deployment

cat ./policy/validate/test/deployment-not-rh-registry.yaml | grep -i "image:"

Create Deployment from sample deployment

oc create -f ./policy/validate/test/deployment-not-rh-registry.yaml

Confirm Mutation worked by checking image name

oc get deploy/not-depr -o jsonpath='{.spec.template.spec.containers[0].image}'

Clean Up Deployed Artifacts

 oc delete -f ./policy/validate
 oc delete -f ./manifest/deployment.yaml -n openshift-gatekeeper-system
 cat manifest/provider-validate.yaml | envsubst | oc delete -f -
 cat manifest/provider-mutate.yaml | envsubst | oc delete -f -
 oc delete -f ./manifest/service/service.yaml

Notes