[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF9WTMJKCSQW8A6RKWPXQG":3,"skill-same:01M6AF9WTMJKCSQW8A6RKWPXQG":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AF9WTMJKCSQW8A6RKWPXQG","implementing-opa-gatekeeper-for-policy-enforcement",null,"Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"implementing opa gatekeeper for policy enforcement","policy","opa","container-security","rego","admission-control","gatekeeper","constraints","pod-security","controller","policy-as-code","kubernetes","audit","code","pr","validate","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-opa-gatekeeper-for-policy-enforcement\ndescription: >-\n  Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes\n  ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny\n  resource requests at admission time. Use when enforcing custom policy-as-code at admission\n  on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a\n  rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint,\n  Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles\n  that Pod Security Admission already covers - use\n  implementing-pod-security-admission-controller.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- opa\n- gatekeeper\n- kubernetes\n- admission-control\n- policy-as-code\n- rego\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n---\n\n# Implementing OPA Gatekeeper for Policy Enforcement\n\n## Overview\n\nOPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.\n\n\n## When to Use\n\n- When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+\n- Helm 3\n- kubectl with cluster-admin access\n- Familiarity with Rego policy language\n\n## Installing Gatekeeper\n\n```bash\n# Install via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm repo update\n\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.logLevel=INFO\n\n# Verify\nkubectl get pods -n gatekeeper-system\nkubectl get crd | grep gatekeeper\n```\n\n### Verify Installation\n\n```bash\n# Check webhook\nkubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration\n\n# Check CRDs\nkubectl get crd constrainttemplates.templates.gatekeeper.sh\nkubectl get crd configs.config.gatekeeper.sh\n```\n\n## ConstraintTemplate Examples\n\n### 1. Require Labels on Resources\n\n```yaml\n# template-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n\n        violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n```\n\n```yaml\n# constraint-require-team-label.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-label\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\"]\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n```\n\n### 2. Block Privileged Containers\n\n```yaml\n# template-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n```yaml\n# constraint-block-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"production\"\n      - \"staging\"\n```\n\n### 3. Restrict Container Image Registries\n\n```yaml\n# template-allowed-repos.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Init container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        image_matches(image) {\n          repo := input.parameters.repos[_]\n          startswith(image, repo)\n        }\n```\n\n```yaml\n# constraint-allowed-repos.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sAllowedRepos\nmetadata:\n  name: restrict-image-repos\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n  parameters:\n    repos:\n      - \"gcr.io\u002Fmy-project\u002F\"\n      - \"ghcr.io\u002Fmy-org\u002F\"\n      - \"registry.k8s.io\u002F\"\n```\n\n### 4. Enforce Resource Limits\n\n```yaml\n# template-require-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequirelimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequireLimits\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequirelimits\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n```\n\n### 5. Block Latest Image Tag\n\n```yaml\n# template-block-latest-tag.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblocklatesttag\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockLatestTag\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblocklatesttag\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          endswith(container.image, \":latest\")\n          msg := sprintf(\"Container %v uses ':latest' tag. Use specific version tags.\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not contains(container.image, \":\")\n          msg := sprintf(\"Container %v has no tag (defaults to latest). Use specific version tags.\", [container.name])\n        }\n```\n\n### 6. Enforce Read-Only Root Filesystem\n\n```yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sreadonlyroot\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sReadOnlyRoot\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sreadonlyroot\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.securityContext.readOnlyRootFilesystem\n          msg := sprintf(\"Container %v must have readOnlyRootFilesystem set to true\", [container.name])\n        }\n```\n\n## Audit and Enforcement Modes\n\n```yaml\n# Dry-run mode (audit only, don't block)\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-dryrun\nspec:\n  enforcementAction: dryrun   # dryrun | deny | warn\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n```\n\n### Check Audit Violations\n\n```bash\n# List all constraint violations\nkubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations\n\n# Check all constraints audit status\nkubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations \u002F\u002F [] | length)}'\n```\n\n## Gatekeeper Config (Exempt Namespaces)\n\n```yaml\napiVersion: config.gatekeeper.sh\u002Fv1alpha1\nkind: Config\nmetadata:\n  name: config\n  namespace: gatekeeper-system\nspec:\n  match:\n    - excludedNamespaces:\n        - kube-system\n        - gatekeeper-system\n        - calico-system\n      processes:\n        - \"*\"\n```\n\n## Monitoring\n\n```bash\n# Check Gatekeeper metrics\nkubectl port-forward -n gatekeeper-system svc\u002Fgatekeeper-webhook-service 8443:443\n\n# Prometheus metrics\nkubectl get --raw \u002Fmetrics | grep gatekeeper\n```\n\n## Best Practices\n\n1. **Start with dryrun** - Deploy constraints in `dryrun` mode first, review violations, then switch to `deny`\n2. **Use the policy library** - Leverage https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fgatekeeper-library for pre-built templates\n3. **Exempt system namespaces** - Always exclude kube-system and gatekeeper-system\n4. **Version control policies** - Store ConstraintTemplates and Constraints in Git\n5. **Monitor audit results** - Check constraint `.status.violations` regularly\n6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying\n7. **Combine with admission webhooks** - Layer Gatekeeper with Pod Security Admission for defense in depth\n","# Implementing OPA Gatekeeper for Policy Enforcement\n\n## Overview\n\nOPA Gatekeeper is a Kubernetes admission controller that enforces policies written in Rego. It uses ConstraintTemplates (policy blueprints with Rego logic) and Constraints (instantiated policies with parameters) to validate, mutate, or deny Kubernetes resource requests at admission time.\n\n\n## When to Use\n\n- When deploying or configuring implementing opa gatekeeper for policy enforcement capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+\n- Helm 3\n- kubectl with cluster-admin access\n- Familiarity with Rego policy language\n\n## Installing Gatekeeper\n\n```bash\n# Install via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm repo update\n\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.logLevel=INFO\n\n# Verify\nkubectl get pods -n gatekeeper-system\nkubectl get crd | grep gatekeeper\n```\n\n### Verify Installation\n\n```bash\n# Check webhook\nkubectl get validatingwebhookconfigurations gatekeeper-validating-webhook-configuration\n\n# Check CRDs\nkubectl get crd constrainttemplates.templates.gatekeeper.sh\nkubectl get crd configs.config.gatekeeper.sh\n```\n\n## ConstraintTemplate Examples\n\n### 1. Require Labels on Resources\n\n```yaml\n# template-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n\n        violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n```\n\n```yaml\n# constraint-require-team-label.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-label\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\"]\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n```\n\n### 2. Block Privileged Containers\n\n```yaml\n# template-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n```yaml\n# constraint-block-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"production\"\n      - \"staging\"\n```\n\n### 3. Restrict Container Image Registries\n\n```yaml\n# template-allowed-repos.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sallowedrepos\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sAllowedRepos\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            repos:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sallowedrepos\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          not image_matches(container.image)\n          msg := sprintf(\"Init container image %v is not from an allowed registry. Allowed: %v\", [container.image, input.parameters.repos])\n        }\n\n        image_matches(image) {\n          repo := input.parameters.repos[_]\n          startswith(image, repo)\n        }\n```\n\n```yaml\n# constraint-allowed-repos.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sAllowedRepos\nmetadata:\n  name: restrict-image-repos\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n  parameters:\n    repos:\n      - \"gcr.io\u002Fmy-project\u002F\"\n      - \"ghcr.io\u002Fmy-org\u002F\"\n      - \"registry.k8s.io\u002F\"\n```\n\n### 4. Enforce Resource Limits\n\n```yaml\n# template-require-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequirelimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequireLimits\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequirelimits\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n```\n\n### 5. Block Latest Image Tag\n\n```yaml\n# template-block-latest-tag.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblocklatesttag\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockLatestTag\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblocklatesttag\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          endswith(container.image, \":latest\")\n          msg := sprintf(\"Container %v uses ':latest' tag. Use specific version tags.\", [container.name])\n        }\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not contains(container.image, \":\")\n          msg := sprintf(\"Container %v has no tag (defaults to latest). Use specific version tags.\", [container.name])\n        }\n```\n\n### 6. Enforce Read-Only Root Filesystem\n\n```yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sreadonlyroot\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sReadOnlyRoot\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sreadonlyroot\n\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.securityContext.readOnlyRootFilesystem\n          msg := sprintf(\"Container %v must have readOnlyRootFilesystem set to true\", [container.name])\n        }\n```\n\n## Audit and Enforcement Modes\n\n```yaml\n# Dry-run mode (audit only, don't block)\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-dryrun\nspec:\n  enforcementAction: dryrun   # dryrun | deny | warn\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n```\n\n### Check Audit Violations\n\n```bash\n# List all constraint violations\nkubectl get k8sblockprivileged block-privileged-containers -o yaml | grep -A 20 violations\n\n# Check all constraints audit status\nkubectl get constraints -o json | jq '.items[] | {name: .metadata.name, violations: (.status.violations \u002F\u002F [] | length)}'\n```\n\n## Gatekeeper Config (Exempt Namespaces)\n\n```yaml\napiVersion: config.gatekeeper.sh\u002Fv1alpha1\nkind: Config\nmetadata:\n  name: config\n  namespace: gatekeeper-system\nspec:\n  match:\n    - excludedNamespaces:\n        - kube-system\n        - gatekeeper-system\n        - calico-system\n      processes:\n        - \"*\"\n```\n\n## Monitoring\n\n```bash\n# Check Gatekeeper metrics\nkubectl port-forward -n gatekeeper-system svc\u002Fgatekeeper-webhook-service 8443:443\n\n# Prometheus metrics\nkubectl get --raw \u002Fmetrics | grep gatekeeper\n```\n\n## Best Practices\n\n1. **Start with dryrun** - Deploy constraints in `dryrun` mode first, review violations, then switch to `deny`\n2. **Use the policy library** - Leverage https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fgatekeeper-library for pre-built templates\n3. **Exempt system namespaces** - Always exclude kube-system and gatekeeper-system\n4. **Version control policies** - Store ConstraintTemplates and Constraints in Git\n5. **Monitor audit results** - Check constraint `.status.violations` regularly\n6. **Test Rego policies** - Use `opa test` or Rego Playground before deploying\n7. **Combine with admission webhooks** - Layer Gatekeeper with Pod Security Admission for defense in depth\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"nist_csf":55,"subdomain":32,"description":7,"mitre_attack":60},[31,35,40,34,39,33],"mahipal","1.0",[56,57,58,59],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[61,62,63,64],"T1610","T1611","T1609","T1525","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-opa-gatekeeper-for-policy-enforcement",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-opa-gatekeeper-for-policy-enforcement",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-opa-gatekeeper-for-policy-enforcement","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",1445,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1134,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",2129,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",2767,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",4292,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",6805,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-opa-gatekeeper-for-policy-enforcement\u002Fscripts\u002Fprocess.py",[125,151,174,202,228,255],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":134,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[135,136,137,138,46,45,139,140,43,42,141,142,143,144,145,146,147,148,149,150],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[157],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[159,147,160,161,46,30,45,43,162,163,164,165,166,167,168,169,170,171,172,173],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[168,185,186,187,188,45,189,190,162,191,192,193,194,195,196,197,198,199,200,201],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[208],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[210,211,212,45,213,214,215,216,217,218,219,220,221,222,223,224,165,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,45,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[46,263,45,264,265,266,267,268,269,270,271,197,272,198,273,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]