OPA & Gatekeeper

Narrow the Constraint's match block: list kinds, restrict namespaces or add excludedNamespaces, or select by label. For system namespaces that must never be evaluated at all, exempt them engine-wide in Gatekeeper's Config rather than per rule.

Memory multiplied by replica count, and policy-fetch fan-out. Each sidecar holds its own copy of the policy and any base data, and polls for updates independently, so 3,000 replicas mean 3,000 copies and 3,000 pollers.

Write a positive allow over an explicit default deny: match the first parsed_path segment, check the method is a write, and compare input.attributes.source.principal, the peer identity the proxy authenticated, against the one permitted value.

OPA requires bundle roots to be disjoint. It refuses to activate a bundle whose roots overlap another configured bundle's, records the error and keeps serving what it had, so the new rules silently never take effect.

Gatekeeper's audit normally reads each constrained kind from the API server every cycle. With --audit-from-cache it evaluates Gatekeeper's replicated object cache instead: far cheaper, but unreplicated kinds are invisible and silently report zero violations.

Usual causes: the constraint is set to dryrun or warn, so violations print without failing the exit code; the rule files were never in the input set; the match block selects nothing; or the CI step discards the status.

The location is a dotted path from the object's root, with list entries picked by a key filter such as spec.containers[name:*]. Missing intermediate fields are created on the way; a glob only matches list entries that already exist.

A rate-limited or sampled OPA decision log is telemetry, not a ledger. You can show the entries that survived, but rate-limited, dropped and buffer-lost decisions leave no trace at all, so a missing entry proves nothing about whether the policy ran.

Every OPA instance holds the whole data document in memory, so the cost is paid per replica and per sidecar. Shrink it: ship only the fields rules read, scope bundle roots per consumer, and key the document by the lookup value.

Through the ConstraintTemplate's libs field: each helper is Rego source shipped inside the same object, under the lib package namespace and imported as data.lib.<name>. A template is self-contained, so every one carries its own copy.

A Provider registers an HTTPS service Gatekeeper may call during evaluation, letting a rule resolve a fact no cluster object holds — an image tag to its digest. The call runs inside the admission request, so provider latency becomes request latency.

Put the invariant in the template body and the values that vary between teams in parameters, declared with types in the openAPIV3Schema. Fork into a second template only when the logic differs, not when a number does.

When you cannot supply every fact at query time. /v1/data needs a complete input and answers with a value; /v1/compile takes a query plus the references you name as unknown and answers with the conditions that are still left to check.

Every query's input document. A rule can only judge facts it is given, so the input carries account, tenant and requester identifiers, and centralizing sends all of it across a boundary on every call and usually into a decision-log store.

The proxy must be the only way in, and the caller must not be able to set that header themselves. Any route around the gate hands the upstream a subject nobody authenticated.