<p>I'm using gatekeeper/OPA to create constraints for various services I have running in specific namespaces. To do so, I'm relying on namespaceSelectors to match the constraint to only a set of namespaces. My CI/CD process is responsible for labeling all my custom namespaces with the required labels that my constraint will be looking for.</p>

<p>However I now need to make sure that no new namespace is created without the required labels (otherwise this namespace will ignore all my constraints). The fact that my CI/CD tooling applies these labels does not allow me to be certain that no other namespace has been created in my cluster without these labels.</p>

<p>If I apply the k8srequiredlabels[2] constraint template on all namespaces, this will find a violation on system namespaces such as kube-system. The gatekeeper constraints allow you to specify either of the following to match your constraint[1]:</p>

<pre><code>labelSelector
namespaceSelector
namespaces list
</code></pre>

<p>Ideally <strong>I'd like to be able to say that I want to ensure that all namespaces have x labels on them, except the namespaces in an exclusion list (e.g kube-system)</strong>. However there's no option to use the above 'Namespaces' list in an exclusive way and the other 2 options require someone to manually add labels to the newly created namespaces (which opens up room for error).</p>

<ul>
<li>Any suggestions on how you can ensure that a subset of your clusters
namespace's have x labels without having to manually label them and
use a label/namespaceSelector?</li>
<li>How would you prevent a namespace from being created using OPA &amp;
Gatekeeper if it does not meet certain criteria such as having x
label on it?</li>
</ul>

<p>[1] <a href="https://github.com/open-policy-agent/gatekeeper/pull/131/files" rel="nofollow noreferrer">https://github.com/open-policy-agent/gatekeeper/pull/131/files</a></p>

<p>[2] <a href="https://github.com/open-policy-agent/gatekeeper/blob/master/demo/agilebank/templates/k8srequiredlabels_template.yaml" rel="nofollow noreferrer">https://github.com/open-policy-agent/gatekeeper/blob/master/demo/agilebank/templates/k8srequiredlabels_template.yaml</a></p>

georgthebub
<p>Problem 1 can be solved by using OPA itself. You can write mutating webhook using OPA (<a href="https://github.com/open-policy-agent/opa/issues/943" rel="nofollow noreferrer">https://github.com/open-policy-agent/opa/issues/943</a>) to add labels to your newly created namespaces or you can write a mutating controller (using Golang). Underneath both does the same thing.</p>

<p>For 2nd problem, you need to add validation rule in your rego files on namespace creation and verify if the label exists.</p>

<p>Extra relevant information: To perform actions on specific namespaces based on the label, you can add namesapceSelector in your validating/mutating webhook configuration.</p>
