Enforcing Pod Security Policies using OPA

In Chapter 10, Creating Pod Security Policies, we discussed the fact that the existing Pod security policy implementation for Kubernetes would never become "GA". One of the alternatives to using the Kubernetes implementation was to use OPA and GateKeeper to enforce the same policies, but in OPA instead of on the API server. This process works differently to the standard implemented by Kubernetes, but using it can keep your clusters more vendor-independent and less susceptible to the changes that will eventually arise with whatever comes next for Kubernetes' Pod security policies.

GateKeeper's policies are all published at https://github.com/open-policy-agent/gatekeeper/tree/master/library/pod-security-policy. They're built as a series of ConstraintTemplate objects and example constraints. This approach to Pod security policies makes for some specific differences in how policies are implemented.

The first major...