---
id: policy-opa-gatekeeper-image-allowlist
name: "OPA Gatekeeper image allowlist enforcement"
description: >-
  Installs OPA Gatekeeper, creates k8sallowedrepos ConstraintTemplate + Constraint allowing only nginx + public.ecr.aws images. Verifies non-allowlisted image denied, allowlisted image accepted.
labels: {customer: any, profile: policy}
cluster:
  provider: kind
  k8s_version: v1.36.1
  preinstall:
    - kind: helm
      chart: gatekeeper/gatekeeper
      version: "3.17.1"
      release: gatekeeper
      namespace: gatekeeper-system
      repo:
        name: gatekeeper
        url: "https://open-policy-agent.github.io/gatekeeper/charts"
      values:
        auditInterval: 10
        constraintViolationsLimit: 20
        enableExternalData: false
        postInstall:
          labelNamespace:
            enabled: false
        validatingWebhookFailurePolicy: Fail
      wait: pods-ready
      wait_timeout: 4m
    - kind: raw_manifest
      path: chart-test/fixtures/policy/k8sallowedrepos-template.yaml
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.27-alpine"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: gatekeeper-system
    timeout: 4m
    selector: app.kubernetes.io/instance=gatekeeper
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: smoke-script
    path: chart-test/assertions/opa-gatekeeper-image-allowlist.sh
tags: [nightly]
mechanisms: ['addon:opa-gatekeeper']
category: policy
integration: opa-gatekeeper
tier: live