<p>Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with &quot;privileged:true&quot; for some namespaces.</p>
<p>Some more details:</p>
<p>Im using opa-gatekeeper in version 3.13 installed by following <a href="https://open-policy-agent.github.io/gatekeeper/website/docs/install" rel="nofollow noreferrer">these instructions</a>.</p>
<p>To enable the policy, first I created a ConstraintTemplate:</p>
<pre><code>apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: disallowprivilegedpods
  annotations:
    description: &quot;Disallow creation of privileged pods in alpha and beta namespaces&quot;
spec:
  crd:
    spec:
      names:
        kind: DisallowPrivilegedPods
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package disallow_privileged_pods

        violation[{&quot;msg&quot;: msg}] {
          input.request.kind.kind == &quot;Pod&quot;
          input.request.operation == &quot;CREATE&quot;
          input.request.namespace == [&quot;alpha&quot;, &quot;beta&quot;]
          input.request.object.spec.securityContext.privileged == true
          msg := &quot;Privileged pods are not allowed in the Alpha and Beta namespaces.&quot;
        }
</code></pre>
<p>Next I created the constraint:</p>
<pre><code>apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DisallowPrivilegedPods
metadata:
  name: disallow-privileged-pods-alpha-beta
spec:
  match:
    kinds:
      - apiGroups: [&quot;&quot;]
        kinds: [&quot;Pod&quot;]
    namespaces:
      - alpha
      - beta
</code></pre>
<p>To test if the policy is working correctly, I tried to deploy this pod in one of these namespaces:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
  namespace: alpha
spec:
  containers:
    - name: my-container
      image: nginx
      securityContext:
        privileged: true
  restartPolicy: Never
</code></pre>
<p>Unfortunately the policy doesnt seem to work and the pod can be created.</p>
<p>Can anyone give me some hints, whats wrong with the policy?</p>
<p>Cheers,</p>
<p>Christian</p>

<p>This check - <code>input.request.namespace == [&quot;alpha&quot;, &quot;beta&quot;]</code> will evaluate to true only if the <code>input.request.namespace</code> field is exactly identical to the array it is being compared to. i.e. - Only if <code>input.request.namespace</code> is an array with exactly two values, the first one being &quot;alpha&quot; and the second one &quot;beta&quot;</p>
<p>To check if an array input field holds one of two values, use <a href="https://www.eknert.com/tech/2020/02/04/incremental-rules-in-opa.html" rel="nofollow noreferrer">incremental rules</a> and <a href="https://www.openpolicyagent.org/docs/latest/policy-reference/#arrays" rel="nofollow noreferrer">array lookups</a>:</p>
<pre><code>namespace_alpha_or_beta {
    &quot;alpha&quot; = input.request.namespace[_]
}

namespace_alpha_or_beta {
    &quot;beta&quot; = input.request.namespace[_]
}
</code></pre>
