|
1 | 1 | # gatekeeper-vscode
|
2 | 2 |
|
3 |
| -Rapidly develop and test Gatekeeper policies |
| 3 | +Rapidly develop, test and deploy Gatekeeper policies for your Kubernetes cluster. |
4 | 4 |
|
5 | 5 | ## Features
|
6 | 6 |
|
| 7 | +* Install Gatekeeper into a development cluster |
| 8 | +* Browse constraints and constraint templates in the Kubernetes cluster explorer |
| 9 | +* See which constraints have violations, and view violation details |
| 10 | +* Deploy a constraint template directly from a Rego file and a JSON schema |
| 11 | +* Scaffold a constraint from a constraint template |
| 12 | +* Scaffold a JSON schema from constraint template Rego |
| 13 | +* See a warning if template Rego uses a parameter not defined in the schema |
| 14 | +* Switch a constraint's enforcement action between Deny and Dry Run |
| 15 | +* View the constraint and template YAML definitions, and template Rego |
| 16 | + |
| 17 | +## Authoring Constraint Templates and Constraints |
| 18 | + |
| 19 | +**NOTE: This workflow is an alpha proposal, and may change based on feedback!** |
| 20 | + |
| 21 | +A constraint template consists of some Rego, defining the policy, and a CRD definition, |
| 22 | +specifying the names (e.g. the manifest kind) and validation schema for constraint |
| 23 | +resources, all bundled together into a YAML resource declaration. You probably don't |
| 24 | +want to have to work directly on such YAML: you'd rather, for example, create your Rego |
| 25 | +in a separate where the OPA extension can give you syntax highlighting and testing features. |
| 26 | + |
| 27 | +The Gatekeeper extension addresses this by allowing you to author your constraint template |
| 28 | +in two separate files, which are linked by a naming convention: |
| 29 | + |
| 30 | +* `<name>.rego` - the Rego policy definition for the constraint template |
| 31 | +* `<name>.schema.json` - the JSON schema for the parameters |
| 32 | + |
| 33 | +With this convention in place, you can right-click in the Rego file and choose |
| 34 | +**Deploy as Gatekeeper Constraint Template**. The extension will merge the Rego and |
| 35 | +the parameter schema to create a YAML resource declaration, and display the |
| 36 | +resulting YAML for you to confirm and deploy. |
| 37 | + |
| 38 | +The `.rego/.schema.json` convention is also used for checks of the Rego file - for |
| 39 | +example if the Rego refers to `input.parameters.<name>` then the extension will |
| 40 | +warn if the `.schema.json` does not contain a declaration for `<name>`. |
| 41 | + |
| 42 | +**Please give me feedback on this convention through [GitHub issues](https://github.com/deislabs/gatekeeper-vscode/issues)!** |
| 43 | +Let me know if it causes problems, runs into limitations or is just fiddly to work with. Thanks! |
| 44 | + |
7 | 45 | ## Requirements
|
8 | 46 |
|
9 |
| -## Extension Settings |
| 47 | +You will need the following VS Code extensions: |
10 | 48 |
|
11 |
| -## Known Issues |
| 49 | +* Kubernetes (https://marketplace.visualstudio.com/items?itemName=ms-kubernetes-tools.vscode-kubernetes-tools) |
| 50 | +* OPA (https://marketplace.visualstudio.com/items?itemName=ms-kubernetes-tools.kubernetes-opa-vscode) |
12 | 51 |
|
13 |
| -## Release Notes |
| 52 | +These are automatically installed if you install this extension from the Visual Studio Marketplace. |
14 | 53 |
|
15 | 54 | ## Contributing
|
16 | 55 |
|
|
0 commit comments