OPA Gatekeeper
Terraform module for Kubernetes

OPA Gatekeeper is a Kubernetes admission controller to meet governance and legal requirements and ensure adherence to best practices and institutional conventions for manifests applied to a cluster.

This Terraform module provisions OPA Gatekeeper on Kubernetes. It fully integrates the Kubernetes resources into the Terraform workflow and allows configuring OPA Gatekeeper using native Terraform syntax.

The OPA Gatekeeper module is continuously updated and tested when new upstream versions are released.

TL;DR:

  • Call the module once per desired target cluster.
  • The provider alias you pass into the module determines the cluster.
  • Customize the Kubernetes resources per environment using Terraform syntax.

Use the module

To provision the OPA Gatekeeper Terraform module on a Kubernetes cluster, call the module, set source and version, and pass an aliased kustomization provider into the module. The provider configuration determines what cluster the Kuberneters resources are provisioned on. Framework documentation includes a complete example of how the kubeconfig output of a cluster module can be used to configure a kustomization provider alias.

module "eks_zero_opa_gatekeeper" {
providers = {
kustomization = kustomization.eks_zero
}
source = "kbst.xyz/catalog/opa-gatekeeper/kustomization"
version = "3.7.2-kbst.0"
}
module "aks_zero_opa_gatekeeper" {
providers = {
kustomization = kustomization.aks_zero
}
source = "kbst.xyz/catalog/opa-gatekeeper/kustomization"
version = "3.7.2-kbst.0"
}
module "gke_zero_opa_gatekeeper" {
providers = {
kustomization = kustomization.gke_zero
}
source = "kbst.xyz/catalog/opa-gatekeeper/kustomization"
version = "3.7.2-kbst.0"
}

Customize resources

All Kubestack cluster service modules support the same module attributes and per environment configuration. The module configuration is a Kustomization set in the per environment configuration map following Kubestack's inheritance model.

This example overwrites the metadata.namespace of all Kubernetes resources provisioned by the OPA Gatekeeper module using a Terraform variable.

module "example_opa_gatekeeper" {
providers = {
kustomization = kustomization.example
}
source = "kbst.xyz/catalog/opa-gatekeeper/kustomization"
version = "3.7.2-kbst.0"
configuration = {
apps = {
namespace = var.example_opa_gatekeeper_namespace
}
ops = {}
loc = {}
}
}

Full documentation how to customize a module's Kubernetes resources is available in the cluster service module configuration section of the framework documentation.