How To Install or Upgrade OPA Gatekeeper

5. Verify the OPA Gatekeeper components are running:
   Example: kubectl get pods -n gatekeeper-system
6. Create a simple constraint to test the installation.
   Example:

7. Apply the constraint.
   Example: kubectl apply -f test-constraint.yaml
8. Create a pod without the required label to verify OPA Gatekeeper enforces the test constraint.
   Example:

9. Apply the pod yaml.
   Example: kubectl apply -f pod-without-label.yaml
   You should see a constraint violation error.

Procedure Using the YAML Manifest

To install OPA Gatekeeper:

1. Create the Custom Resource Definitions (CRDs) required by OPA Gatekeeper.
   Example: kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constraintpodstatuses.yaml kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constrainttemplatepodstatuses.yaml kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constraints.yaml
2. Create a namespace for OPA Gatekeeper.
   Example: kubectl create namespace gatekeeper-system
3. Deploy the OPA Gatekeeper components.
   Example:
   kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/gatekeeper.yaml
4. Verify the OPA Gatekeeper components are running:
   Example:
   kubectl get pods -n gatekeeper-system
5. Create a simple constraint to test the installation.
   Example:

6. Apply the constraint.
   Example:
   kubectl apply -f test-constraint.yaml
7. Create a pod without the required label to verify OPA Gatekeeper enforces the test constraint.
   Example:

8. Apply the pod yaml.
   Example:
   kubectl apply -f pod-without-label.yaml
   You should see a constraint violation error.

Solution - Upgrade

If a specific version of OPA Gatekeeper is required in your Kubernetes environment, it is most likely that the manifest files or an OPA Gatekeeper Helm chart already exist. Contact your Operations or DevOps team to determine if there are company resources for installing OPA Gatekeeper BEFORE using either of the following procedures.

Procedure Using HELM Chart Package Manager

To upgrade OPA Gatekeeper:

1. Use the Helm Installation Guide to install Helm (if not already installed).
2. Do one of the following:

• • To upgrade to the latest version, use the following command:
    helm upgrade gatekeeper gatekeeper/gatekeeper --namespace gatekeeper-system
  • To upgrade to a specific version, use the following command:
    helm upgrade gatekeeper gatekeeper/gatekeeper --namespace gatekeeper-system --version <version>
    where <version> is the version number of OPA Gatekeeper you want to upgrade to.

3. Verify the OPA Gatekeeper components are running and have been updated:
   Example:
   kubectl get pods -n gatekeeper-system

Procedure Using YAML Manifest

To upgrade OPA Gatekeeper:

1. Upgrade the Custom Resource Definitions (CRDs) required by OPA Gatekeeper.
   Example:
   kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constraintpodstatuses.yaml kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constrainttemplatepodstatuses.yaml kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/crds/gatekeeper.openpolicyagent.org_constraints.yaml
2. Upgrade the OPA Gatekeeper deployment.
   Example: kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.7/deploy/gatekeeper.yaml
3. Verify the OPA Gatekeeper components are running and have been updated:
   Example: kubectl get pods -n gatekeeper-system