-
Book Overview & Buying
-
Table Of Contents
The Platform Engineer's Handbook
By :
Gatekeeper validates policy at admission time. However, developers shouldn't have to push their code to a cluster to find out if their manifests are compliant.
Figure 11.2 shows the progressive changes in the environments as you try and audit and enforce the policies.

Figure 11.2 - Policy enforcement layers from development to production.
Shift-left testing solves this by catching policy violations in the development process before they ever reach the cluster. Conftest [2] is a utility built on top of OPA that lets you test your Kubernetes manifest locally against policies. Developers can run it in their editor, in pre-commit hooks or in their CI/CD pipeline. As always, check the solutions section in the appendix, companion website or the GitHub repo to see how to install conftest. Once you have conftest, you can proceed to the next step of testing this out. Now, write a Rego policy file. Create a directory structure for your policies...