CKS — OPA Gatekeeper
Chapter 7 — OPA Gatekeeper
CKS Exam Domain: Minimize Microservice Vulnerabilities (20%)
OPA Gatekeeper is the primary policy-enforcement mechanism tested on the CKS exam. It intercepts every admission request through a ValidatingAdmissionWebhook, evaluates it against Rego-based policies, and blocks resources that violate your security standards — before they ever land in etcd.
This chapter covers the full OPA Gatekeeper stack from architecture through hands-on labs, plus the Kyverno alternative that is gaining traction in the Kubernetes ecosystem.
What You Will Learn
| # | Topic | Description |
|---|---|---|
| 1 | OPA Introduction | OPA architecture, Gatekeeper components, admission webhook flow |
| 2 | Constraint Templates | Define reusable policy schemas with Rego logic |
| 3 | Constraints | Enforce templates across namespaces, kinds, and labels |
| 4 | Rego Policies | Write and debug Rego rules for common CKS scenarios |
| 5 | Kyverno Alternative | YAML-native policies — validate, mutate, generate |
| 6 | Hands-On Lab | End-to-end exercises: install, enforce, audit, test |
Why OPA Gatekeeper Matters for CKS
The CKS exam expects you to:
- Install Gatekeeper into a cluster.
- Create ConstraintTemplates and matching Constraints.
- Block non-compliant workloads (privileged containers, missing labels, unauthorized registries).
- Audit existing resources for policy violations.
- Understand the difference between deny, dryrun, and warn enforcement actions.
Policy enforcement is a direct defence against supply-chain attacks, privilege escalation, and configuration drift — all core CKS themes.
CKS Exam Weight
| Domain | Weight |
|---|---|
| Minimize Microservice Vulnerabilities | 20% |
OPA Gatekeeper falls squarely within this domain. Expect at least one question requiring you to write or fix a ConstraintTemplate/Constraint, or to verify that a policy correctly blocks a non-compliant resource.
Prerequisites
You should be comfortable with:
- Kubernetes admission controllers (CKA-level)
- RBAC and ServiceAccounts
kubectl apply,kubectl get,kubectl describe- Reading YAML manifests
Start Chapter 7 — OPA Introduction →
| Previous | Next |
|---|---|
| ← Supply Chain Security | OPA Introduction → |
