Create a template in the Tanzu Mission Control console that you can use to apply custom policies.
ConstraintTemplateobject, which contains the schema of the constraint and the Rego code that defines how it is enforced.
Tanzu Mission Control provides some sample preconfigured policy templates that you can use as a starting place.
- You can use the
tmc-require-labelstemplate to enforce labels with a key and optional value on specified Kubernetes resources (for example, ensuring that all pods and namespaces in a cluster have a label with the key
- You can use
tmc-https-ingressthe template to enforce that all ingress objects created on a cluster have
tlsconfiguration and that the
allow-httpannotation set to
For more information about defining a
ConstraintTemplate object, see Constraint Templates in the OPA Gatekeeper documentation on GitHub.
Make sure you have the appropriate permissions to create policy templates.
- To create a policy template, you must be associated with the .admin role or the organization.policytemplate.edit role on the organization.
- Click Policies in the left navigation pane of the Tanzu Mission Control console to show the subpages, and then click Templates.
- On the Custom policy templates page, click Create Template.
- On the Create page, you can optionally provide a description for the template.
- Define the template.
You can write the template definition directly in the code box provided, or click Import to use a YAML file that you have already written.
- You can optionally define Kubernetes resources to be cached for the policy.
To enforce a custom policy, OPA might need access to more state than just the object under test. For example, if the policy calculates the number of pods running in the namespace, OPA needs access to all those pods. If your template requires such data replicated in OPA cache, specify the group, version, and kind of each Kubernetes resource that needs to be cached. For more information about cached resources, see Replicating Data in the OPA Gatekeeper documentation.
- Click Create.