> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# An Admission Policy Engine Should Enforce Workload Policy

### More Info:

Advisory: an admission controller (Pod Security Admission, Kyverno, or OPA Gatekeeper) should enforce workload best practices at admission time, not only detect them after the fact.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify how the cluster is provisioned (console vs. IaC)**
           * On any machine with access to your OCI tenancy, determine whether OKE clusters are managed via Terraform/Resource Manager, OCI CLI, or manually in the OCI Console.
           * If using Terraform/Resource Manager, locate the codebase that defines your OKE clusters and note any modules related to “gatekeeper”, “kyverno”, or “psa/pod-security”.

        2. **Check for an admission policy engine deployed to the cluster**
           * On any machine with `kubectl` access (this is read-only discovery; remediation will be in console/CLI/IaC):
             ```bash theme={null}
             kubectl get pods -A | egrep -i 'gatekeeper|kyverno'
             kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations \
               -A -o wide | egrep -i 'gatekeeper|kyverno'
             kubectl get ns --show-labels | egrep 'pod-security.kubernetes.io/(enforce|audit|warn)'
             ```
           * Interpretation:
             * Presence of `gatekeeper-system` or `kyverno` namespaces and matching webhook configurations indicates OPA Gatekeeper or Kyverno is installed.
             * `pod-security.kubernetes.io/enforce` labels on namespaces indicate Pod Security Admission (PSA) is being used to enforce baseline/restricted policies.

        3. **Review current enforcement scope and strength**
           * Still on a `kubectl`-enabled machine, inspect policies to see if they cover the benchmark’s workload best practices (C1–C5) and are set to *enforce* (not only audit):
             ```bash theme={null}
             # Gatekeeper constraints (if present)
             kubectl get k8sallowedrepos,ksymlinks, -A 2>/dev/null
             kubectl get constraints.constraints.gatekeeper.sh -A

             # Kyverno ClusterPolicies and Policies (if present)
             kubectl get clusterpolicies -A 2>/dev/null
             kubectl get policies -A 2>/dev/null

             # Pod Security Admission labels (if used)
             kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.metadata.labels}{"\n"}{end}'
             ```
           * Manually compare existing constraints/policies/PSA levels to your required C1–C5 workload controls (e.g., run-as-nonroot, privileged/hostNetwork restrictions, image registry controls, resource limits).

        4. **Decide on the admission strategy and update configuration via OCI Console/CLI/IaC**
           * If no enforcement engine exists, or current policies are only auditing/not aligned with C1–C5:
             * Choose one primary mechanism for enforcement:
               * Enable and standardize **Pod Security Admission** via namespace labels (for baseline/restricted pods), and/or
               * Deploy and manage **OPA Gatekeeper** or **Kyverno** using your standard provisioning path (Terraform module, Helm chart invoked by Terraform or OCI DevOps, or manual setup documented in your OKE runbooks).
           * Apply changes through your chosen control-plane management surface (Terraform/OCI Resource Manager templates or documented OCI Console procedure). Do not make ad‑hoc kubectl changes if your organization mandates IaC.

        5. **Verify enforcement is active (not just audit)**
           * On a `kubectl`-enabled machine, attempt to create a known-bad workload that violates one of your C1–C5 rules (for example, privileged pod without required labels):
             ```bash theme={null}
             cat > /tmp/privileged-pod.yaml << 'EOF'
             apiVersion: v1
             kind: Pod
             metadata:
               name: test-privileged
               namespace: default
             spec:
               containers:
               - name: c
                 image: nginx
                 securityContext:
                   privileged: true
             EOF

             kubectl apply -f /tmp/privileged-pod.yaml
             ```
           * Confirm that the request is **rejected** with an error message from PSA, Gatekeeper, or Kyverno, and that it is not merely recorded in audit logs while still allowing creation.

        6. **Document and standardize the configuration for future clusters**
           * In your OCI/OKE provisioning pipeline (Terraform modules, OCI Resource Manager stacks, or standard console build runbooks), add explicit steps/variables to:
             * Always deploy and configure the chosen admission controller(s).
             * Apply default namespace PSA labels and/or default Gatekeeper/Kyverno policies for C1–C5.
           * Keep this documentation with your OKE cluster standard so future clusters automatically enforce workload policy at admission.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot configure or enable admission policy engines on Oracle OKE, because this is managed in the OKE control plane via the OCI Console, OCI CLI, or IaC (Terraform/Resource Manager). To plan and implement enforcement with Pod Security Admission, Kyverno, or OPA Gatekeeper, follow the guidance in the Manual Steps section instead.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report admission policy enforcement state for an OKE cluster
        # Requirements: kubectl configured with cluster-admin access

        set -euo pipefail

        echo "=== 1. Check for Pod Security Admission (PSA) enforcement via namespace labels ==="
        echo
        echo "# Namespaces with Pod Security labels (none may mean PSA not effectively used):"
        kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.pod-security\.kubernetes\.io/enforce}{"\t"}{.metadata.labels.pod-security\.kubernetes\.io/enforce-version}{"\n"}{end}' \
          2>/dev/null | column -t || echo "Failed to list namespaces or PSA labels."

        echo
        echo "# Namespaces with NO PSA enforce label (these are not covered by Pod Security Admission):"
        kubectl get ns -o json | jq -r '
          .items[]
          | select(.metadata.labels["pod-security.kubernetes.io/enforce"] == null)
          | .metadata.name
        ' 2>/dev/null || echo "jq not available or failed to parse output."

        echo
        echo "=== 2. Check for Kyverno (workload policy engine) ==="
        echo
        echo "# Kyverno deployment in kyverno namespace:"
        kubectl get deployment -n kyverno kyverno 2>/dev/null || echo "Kyverno deployment not found."

        echo
        echo "# Kyverno ClusterPolicies (cluster-wide workload policies):"
        kubectl get clusterpolicies.kyverno.io 2>/dev/null || echo "No Kyverno ClusterPolicies found or Kyverno CRDs not installed."

        echo
        echo "# Kyverno Policies (namespaced workload policies):"
        kubectl get policies.kyverno.io -A 2>/dev/null || echo "No Kyverno Policies found or Kyverno CRDs not installed."

        echo
        echo "# Kyverno policies that are not in enforce mode (audit / dryrun only):"
        kubectl get clusterpolicies.kyverno.io -o json 2>/dev/null | jq -r '
          .items[]
          | select(.spec.validationFailureAction != "enforce")
          | "\(.metadata.name)\t\(.spec.validationFailureAction)"
        ' 2>/dev/null || echo "No Kyverno ClusterPolicies in non-enforce mode or Kyverno not present."

        echo
        echo "=== 3. Check for OPA Gatekeeper (constraint-based enforcement) ==="
        echo
        echo "# Gatekeeper deployment in gatekeeper-system namespace:"
        kubectl get deployment -n gatekeeper-system gatekeeper-controller-manager 2>/dev/null \
          || echo "Gatekeeper controller-manager deployment not found."

        echo
        echo "# Gatekeeper ConstraintTemplates (kinds of checks available):"
        kubectl get constrainttemplates.templates.gatekeeper.sh 2>/dev/null \
          || echo "No ConstraintTemplates found or Gatekeeper CRDs not installed."

        echo
        echo "# Gatekeeper Constraints (actual enforcing instances) across all types:"
        for kind in $(kubectl api-resources --api-group='constraints.gatekeeper.sh' -o name 2>/dev/null | cut -d. -f1); do
          echo "## Constraints of kind: ${kind}"
          kubectl get "${kind}.constraints.gatekeeper.sh" -A 2>/dev/null || echo "  (none)"
        done

        echo
        echo "=== 4. Spot-check: are example constraints/policies effectively enforcing? ==="
        echo "# This section does not perform mutations; it just counts key policy objects."

        echo
        echo "# Count of namespaces without PSA enforce label (potentially unprotected):"
        kubectl get ns -o json | jq '
          .items
          | map(select(.metadata.labels["pod-security.kubernetes.io/enforce"] == null))
          | length
        ' 2>/dev/null || echo "jq not available or failed to count."

        echo
        echo "# Count of Kyverno ClusterPolicies in enforce mode:"
        kubectl get clusterpolicies.kyverno.io -o json 2>/dev/null | jq '
          .items
          | map(select(.spec.validationFailureAction == "enforce"))
          | length
        ' 2>/dev/null || echo "Kyverno not present or jq not available."

        echo
        echo "# Count of Gatekeeper Constraints (all types):"
        total_constraints=0
        for kind in $(kubectl api-resources --api-group='constraints.gatekeeper.sh' -o name 2>/dev/null | cut -d. -f1); do
          count=$(kubectl get "${kind}.constraints.gatekeeper.sh" -A --no-headers 2>/dev/null | wc -l | tr -d ' ')
          echo "${kind}: ${count}"
          total_constraints=$((total_constraints + count))
        done
        echo "Total Gatekeeper constraints: ${total_constraints}"

        echo
        echo "=== Interpretation guidance ==="
        cat <<'EOF'
        Potential problems indicated by this report:

        - Pod Security Admission:
          - Many or all namespaces appear without the label:
              pod-security.kubernetes.io/enforce
            This generally means Pod Security Admission is not configured to enforce
            workload policy, or enforcement is not applied to most workloads.

        - Kyverno:
          - The Kyverno deployment or CRDs are missing: Kyverno is not installed.
          - There are zero ClusterPolicies / Policies: no Kyverno-based workload policies.
          - All policies show validationFailureAction != "enforce" (e.g., "audit"):
            policies are only auditing, not enforcing.

        - OPA Gatekeeper:
          - The gatekeeper-controller-manager deployment or CRDs are missing:
            Gatekeeper is not installed.
          - There are zero ConstraintTemplates / Constraints:
            no constraint-based admission policies are in place.

        This script only reports state; it does not configure OKE. If you see any of the
        conditions above and you require enforcement, you must design and enable an
        admission policy engine (PSA, Kyverno, or Gatekeeper) via OKE-compatible
        manifests and/or OCI/OKE configuration and IaC.
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>