Compliance Management (Alpha)

Gatekeeper Component Introduction

Gatekeeper is an open-source component built on top of Kubernetes’ Custom Resource Definitions (CRDs) and Policy Controller mechanism. It ensures the security and compliance of the cluster by using a declarative approach to define and deploy rules and constraints.

With Gatekeeper, administrators can easily enforce compliance requirements and security policies, such as restricting container image sources, prohibiting the use of specific permissions, and controlling resource quotas. Gatekeeper also provides real-time alerts and reporting capabilities for non-compliant operations, as well as the ability to identify and handle non-compliant resources in the cluster.

Function Background

The platform’s cluster configuration management feature can synchronize configuration files from a Git repository to a specified cluster. However, these configuration files often do not meet the company or organization’s compliance requirements. The platform implements compliance management functionality based on the compliance management tool Gatekeeper. By installing this plugin in each cluster, the platform can centrally manage the configuration resources deployed to multiple clusters, and verify the security and compliance of the deployed resources based on defined security policies and compliance policies.

Compliance Management

Flow of use

1. Deploy the Gatekeeper component in the target cluster. Link to the deployment guide .

2. Refer to the official community documentation to write compliance policies and store them in a code repository.

3. On the left navigation bar, click Clusters > Cluster Configuration Management and create a synchronization rule to configure compliance policies and resources to be deployed to the target cluster.

4. On the left navigation bar, click Clusters > Compliance Management to view the details of compliance policies in the target cluster, including non-compliant resources and compliance rules.

Panel Overview

Title	Description
Cluster with Compliance Plugin Installed	Statistics of clusters with or without the Gatekeeper plugin installed. Click to view the names of clusters without the Gatekeeper plugin installed.
Clusters with Violations	Statistics of clusters with or without violations. Note: Only clusters with the Gatekeeper plugin installed are counted.
Total Number of Violations	The total number of violations in clusters with the Gatekeeper plugin installed.

Violation Issues

1. The platform divides compliance policies based on cluster resources. Click on Cluster Name to view the security mode and number of violations for the compliance policy. The platform supports three security modes: dryrun, warn, and deny.

• In dryrun mode, Gatekeeper will detect and report resources that do not comply with the policy rules, but it will not prevent their deployment or modification. It is mainly used to provide an auditing mechanism that allows you to view resources that violate the rules while still allowing them to exist in the cluster. This mode is suitable for testing and debugging policies.

• In warn mode, Gatekeeper will also detect and report resources that do not comply with policy rules, but it will issue a warning to alert you of the violation. Compared to dryrun mode, warn mode emphasizes the existence of violations and draws your attention to them. This mode is suitable for alerting and reporting configuration file violations in a cluster to adhere to standards and best practices.

• In deny mode, Gatekeeper detects resources that do not comply with policy rules and prevents their deployment or modification. It enforces rules to ensure that resources in the cluster adhere to specifications. When a resource violates a policy rule, Gatekeeper rejects its operation and returns an error message, preventing non-compliant resources from entering the cluster. This mode is suitable for strict security and compliance requirements to ensure that resources and behavior in the cluster align with expected rules.

2. Click on the Compliance Policy Name to view details, such as resource type, namespace, error message, etc.