<p>We are looking to use OPA gatekeeper to audit K8s PodDisruptionBudget (PDB) objects. In particular, we are looking to audit the number of <code>disruptionsAllowed</code> within the <code>status</code> field.</p>
<p>I believe this field will not be available at point of admission since it is calculated and added by the apiserver once the PDB has been applied to the cluster.</p>
<p>It appears that for e.g Pods, the <code>status</code> field is passed as part of the <code>AdmissionReview</code> object [1]. In that particular example it appears that only the pre-admission status fields make it into the <code>AdmissionReview</code> object.</p>
<p>1.) Is it possible to audit on the current in-cluster status fields in the case of PDBs?</p>
<p>2.) Given the intended use of OPA Gatekeeper as an admission controller, would this be considered an anti-pattern?</p>
<p>[1] <a href="https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/" rel="nofollow noreferrer">https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/</a></p>

Howard Jones
<p>This is actually quite reasonable, and is one of the use cases of <a href="https://open-policy-agent.github.io/gatekeeper/website/docs/audit" rel="nofollow noreferrer">Audit</a>. You just need to make sure audit is enabled and <code>spec.enforcementAction: dryrun</code> is set in the Constraint.</p>
<p>Here is an example of what the ConstratintTemplate's Rego would look like. <a href="https://play.openpolicyagent.org/p/nioYvNyN4N" rel="nofollow noreferrer">OPA Playground</a>.</p>
<pre><code>deny[msg] {
    value := input.request.object.status.disruptionsAllowed
    value &gt; maxDisruptionsAllowed

    msg := sprintf(&quot;status.disruptionsAllowed must be &lt;%v&gt; or fewer; found &lt;%v&gt;&quot;, [maxDisruptionsAllowed, value])
}
</code></pre>
<p>In the specific Constraint, make sure to set <code>enforcementAction</code> to <code>dryrun</code> so the Constraint does not prevent k8s from updating the status field. For example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedPodDisruptions
metadata:
  name: max-disruptions
spec:
  enforcementAction: dryrun
  match:
    kinds:
      - apiGroups: [&quot;&quot;]
        kinds: [&quot;PodDisruptionBudget&quot;]
    namespaces:
      - &quot;default&quot;
  parameters:
    maxDisruptionsAllowed:
      - 10
</code></pre>
<p>If you forget to set <code>enforcementAction</code>, k8s will be unable to update the status field of the PodDisruptionBudget.</p>
