feat: Add NodePort namespace range policy example #4320
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
elhamafzalizadeh
changed the title
added 2 commits
December 31, 2025 15:20
Signed-off-by: Elham Afzalizadeh <[email protected]>
…b.com/elhamafzalizadeh/gatekeeper-opa into nodeport-namespace-port-range-example
Contributor
|
@elhamafzalizadeh https://github.com/open-policy-agent/gatekeeper-library is a good place to contribute new policies. Please raise a PR in the library repo and close this PR once you raise the one for library repo. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Gatekeeper Policy: K8sNodePortNamespaceRange
This is a Gatekeeper constraint that restricts the NodePort ranges based on team namespaces. Its purpose is to prevent accidental or uncoordinated NodePort assignments in the cluster.
Policy Details
constraints.gatekeeper.sh/v1beta1K8sNodePortNamespaceRangeenforce-nodeport-namespace-rangedeny(any Service violating this policy will be denied)