Why it is showing error while applying constraint.yaml for a rego policy?

8/29/2021

https://github.com/redhat-cop/rego-policies/blob/master/POLICIES.md#rhcop-ocp_bestpract-00021-pod-replica-below-1 The above link is the rego policy for pod replica below one.

I created constrainttemplate.yaml and constraint.yaml for podreplicabelowone rego policy

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: podreplicasbelowone
spec:
  crd:
    spec:
      names:
        kind: PodReplicasBelowOne
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package ocp.bestpractices.pod_replicas_below_one
        violation[{"msg": msg}] {
          openshift.is_policy_active("RHCOP-OCP_BESTPRACT-00021")
          openshift.pod
          replicas := konstraint_core.resource.spec.replicas
          replicas <= 1
          msg := konstraint_core.format_with_id(sprintf("%s/%s: replicas is %d - expected replicas to be greater than 1 for HA guarantees.", [konstraint_core.kind, konstraint_core.name, replicas]), "RHCOP-OCP_BESTPRACT-00021")
          }

below is the constraint.yaml for podreplicasbelowone

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: PodReplicasBelowOne
metadata:
  name: podreplicasbelowone
spec:
  match:
kinds:
  - apiGroups: [""]
    kinds: ["Pod"]

I applied constrainttemplate and constraint.yaml

nny@nn:~/Documents/new/podreplica$ kubectl apply -f template.yaml
constrainttemplate.templates.gatekeeper.sh/podreplicasbelowone created   
nny@nn:~/Documents/new/podreplica$ kubectl apply -f constraint.yaml
error: unable to recognize "constraint.yaml": no matches for kind     "PodReplicasBelowOne" in version "constraints.gatekeeper.sh/v1beta1"

why it is showing this error? Are the above two yaml files are correct? What i need to change? What i need to specify in example.yaml so that it shows violations for the rego policy?

-- thara
kubernetes
minikube
opa
rego

0 Answers