---
id: policy-opa-gatekeeper-required-labels
name: "OPA Gatekeeper required labels enforcement (gap-probe)"
description: >-
  Installs OPA Gatekeeper + NGINX Ingress, creates k8srequiredlabels ConstraintTemplate + Constraint targeting Deployments and Ingresses. Verifies non-compliant resources denied, compliant accepted. Cross-feature compose with M4 nginx-ingress. Then runs a gap-probe: the chart's Ingress template uses selectorLabels (just app: <release>) instead of the full common labels (which include app.kubernetes.io/name), so the chart's Ingress fails the required-labels constraint — an honest gap (red cell); do NOT over-engineer the chart.
labels: {customer: any, profile: policy}
cluster:
  provider: kind
  k8s_version: v1.30.0
  preinstall:
    - kind: helm
      chart: gatekeeper/gatekeeper
      version: "3.17.1"
      release: gatekeeper
      namespace: gatekeeper-system
      repo:
        name: gatekeeper
        url: "https://open-policy-agent.github.io/gatekeeper/charts"
      values:
        auditInterval: 10
        constraintViolationsLimit: 20
        enableExternalData: false
        postInstall:
          labelNamespace:
            enabled: false
        validatingWebhookFailurePolicy: Fail
      wait: pods-ready
      wait_timeout: 4m
    - kind: helm
      chart: ingress-nginx/ingress-nginx
      version: "4.10.0"
      release: ingress-nginx
      namespace: ingress-nginx
      repo:
        name: ingress-nginx
        url: "https://kubernetes.github.io/ingress-nginx"
      values:
        controller:
          service:
            type: NodePort
          allowSnippetAnnotations: true
          ingressClassResource:
            name: nginx
            enabled: true
            default: false
            controllerValue: "k8s.io/ingress-nginx"
          watchIngressWithoutClass: true
        admissionWebhooks:
          enabled: false
      wait: pods-ready
      wait_timeout: 3m
    - kind: raw_manifest
      path: ./fixtures/k8srequiredlabels-template.yaml
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.27-alpine"
    ingress.enabled: "false"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: gatekeeper-system
    timeout: 4m
  - type: pods-ready
    namespace: ingress-nginx
    timeout: 3m
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: smoke-script
    path: chart-test/assertions/opa-gatekeeper-required-labels.sh
tags: [nightly, curated-live]
mechanisms: ['addon:opa-gatekeeper', 'addon:nginx-ingress']
category: policy
integration: opa-gatekeeper
tier: live