validate ConstraintTemplate via admission

[grosser]

Describe the solution you'd like
the validation webhook should block invalid ConstraintTemplate
because otherwise a deploy via for example kubectl apply will succeed but the reconcile will fail forever

Anything else you would like to add:

I have this config for my validation webhook, so afaik ConstraintTemplate is covered

  - apiGroups:
    - config.gatekeeper.sh
    - constraints.gatekeeper.sh
    - templates.gatekeeper.sh
    apiVersions:
    - '*'
    operations:
    - CREATE
    - UPDATE
    resources:
    - '*'
    scope: '*'

when editing a ConstraintTemplate to be invalid kubernetes does not complain,
but the reconciler fails

Environment:

• Gatekeeper version: v3.17.1
• Kubernetes version: (use kubectl version): 1.30.1

[JaydipGabani]

@grosser could you share how to reproduce this exactly?

[grosser]

edit any existing ConstraintTemplate to have invalid rego

[JaydipGabani]

@grosser We used to have validate-tempate-rego flag - https://open-policy-agent.github.io/gatekeeper/website/docs/v3.15.x/constrainttemplates/. But this was depricated and removed in 3.16 in favor of using gator verify to validate templates, and adding CEL engine to support CEL as policy language as well. Hence validation of rego is not supported.

[grosser]

having to use some external tool is a bit cumbersome, especially if that tool is not version-locked with gatekeeper releases, so I have to install the correct version of the tool and trust it does exactly what gatekeeper does

I like the idea of a controller validating their crds so that an invalid crd can't be deployed

[JaydipGabani]

gator is also owned by us and is released/paired with each gatekeeper version. If you haven't looked at it yet, PTAL - https://open-policy-agent.github.io/gatekeeper/website/docs/gator. It's a very good tool to validate resources in shift left, even before deploying to k8s cluster.

[grosser]

I'll take another look, thx.

Still prefer in-cluster validation even if that's just a fail-safe or very crude (did not parse -> denied),
being able to deploy invalid config and then it just sitting there was very confusing and let us roll out a bad change without anyone noticing.

[JaydipGabani]

@grosser were you able to look at gator and satisfy the use case you are looking for?

[grosser]

not yet, but I think it should work
... if the feature is not planned then just close the issue

[JaydipGabani]

Yeah, I dont think we have this in road map. I am interested on what other think. @open-policy-agent/gatekeeper-maintainers PTAL.