<p>We are trying to replace our existing PSPs in kubernetes with OPA policies using Gatekeeper. I'm using the default templates provided by Gatekeeper <a href="https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/pod-security-policy" rel="nofollow noreferrer">https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/pod-security-policy</a> and defined corresponding constraints.</p>
<p>However, I can't figure out how I can apply a policy to a specific <code>ServiceAccount</code>.
For eg. how to define <code>allow-privilege-escalation</code> policy only to a ServiceAccount named awsnode?</p>
<p>In PSPs I create a Role/ClusterRole for required <code>podsecuritypolicies</code> and create a RoleBinding to allow awsnode ServiceAccount to use required PSP. I'm struggling to understand how to achieve the same using Gatekeeper OPA policies?</p>
<p>Thank you.</p>

autobot
<p>I think a possible solution to applying an OPA Gatekeeper policy (a ConstraintTemplate) to a specific ServiceAccount, is to make the OPA/Rego policy code reflect that filter / selection logic.  Since you said you're using pre-existing policies from the gatekeeper-library, maybe changing the policy code isn't an option for you.  But if changing it <em>is</em> an option, I think your OPA/Rego policy can take into account the pod's serviceAccount field.  Keep in mind with OPA Gatekeeper, the input to the Rego policy code is the entire admission request, including the spec of the pod (assuming it's pod creations that you're trying to check).</p>
<p>So part of the input to the Rego policy code might be like</p>
<pre><code>      &quot;spec&quot;: {
        &quot;volumes&quot;: [...        ],
        &quot;containers&quot;: [
          {
            &quot;name&quot;: &quot;apache&quot;,
            &quot;image&quot;: &quot;docker.io/apache:latest&quot;,
            &quot;ports&quot;: [...            ],
            &quot;env&quot;: [...            ],
            &quot;resources&quot;: {},
            &quot;volumeMounts&quot;: [...            ],
            &quot;imagePullPolicy&quot;: &quot;IfNotPresent&quot;,
            &quot;securityContext&quot;: {...            }
          }
        ],
        &quot;restartPolicy&quot;: &quot;Always&quot;,
        &quot;terminationGracePeriodSeconds&quot;: 30,
        &quot;dnsPolicy&quot;: &quot;ClusterFirst&quot;,
        &quot;serviceAccountName&quot;: &quot;apache-service-account&quot;,
        &quot;serviceAccount&quot;: &quot;apache-service-account&quot;,
</code></pre>
<p>So gatekeeper-library's <a href="https://github.com/open-policy-agent/gatekeeper-library/blob/master/library/pod-security-policy/allow-privilege-escalation/template.yaml#L57" rel="nofollow noreferrer">allow-privilege-escalation</a> references <code>input.review.object.spec.containers</code> and finds an array of containers like &quot;apache&quot;.  Similarly, you could modify the policy code to reference <code>input.review.object.spec.serviceAccount</code> and find &quot;apache-service-account&quot;.  From there, it's a matter of using that information to make sure the rule &quot;violation&quot; only matches if the service account is one you want to apply to.</p>
<p>Beyond that, it's possible to then take the expected service account name and make it a ConstraintTemplate <a href="https://open-policy-agent.github.io/gatekeeper/website/docs/howto#the-parameters-field" rel="nofollow noreferrer">parameter</a>, to make your new policy more flexible/useable.</p>
<p>Hope this helps!</p>
