open-policy-agent / open-policy-agent/gatekeeper
allow selecting constraints by label
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4.3k
- Forks
- 883
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 45
Description
I want to have:
- some constraints that are only audited and not enforced (trialing them or only using them to gather data)
- some constraints that are only enforced and not audited (because they are too expensive or I don't care about their audits)
so something like --constraint-label-selector enforced=true would be nice for both auditing and webhook to support
it looks like I could use target: admission.k8s.gatekeeper.sh for this, but I could not find a list of valid targets (is audit.k8s.gatekeeper.sh a target) ?
- it only allows targeting of ConstraintTemplates and not Constraints
- it still works for auditing even though I have everything set to
target: admission.k8s.gatekeeper.sh
... some docs for that would be nice
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the auditing and webhook paths for Constraints and ConstraintTemplates, focusing on how labels and targets are currently interpreted. The work is done when constraints can be selected independently for auditing and enforcement/webhook behavior, and the valid target options and their audit behavior are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100