feat(gatekeeper-config): security policies

[mikolajkucinski]

Pull Request Details

Add security policies as the next batch of the gatekeeper-config migration.

Differences vs upstream:

Policy	Upstream	This PR
forbidden-clusterwide-objects	Webhook names hardcoded in the chart; gated on cluster_type.	allowedWebhooks is a Constraint parameter.
images-from-approved-registries	images-from-non-keppel: denylist hardcoded to a single registry prefix.	Renamed; allowedRegistries allowlist via startswith(image, prefix).
pci-forbidden-images	Patterns hardcoded; container iteration iro.spec.containers[_] only matched Pods.	patterns is a Constraint parameter; iterates via traversal.find_container_specs (handles all pod owners).
pod-required-labels	pod-labels: hardcoded label key whose value is validated against a fixed whitelist.	Renamed; requiredLabels is a list of label keys whose presence is enforced.
pod-security-v2	Allowlist hardcoded in the chart.	allowlist is a Constraint parameter. Dropped 3 orphan top-level Rego rules (dead code).

Breaking Changes

None.

Issues Fixed

• Partial progress on #1420

Other Relevant Information

None.

[Copilot]

Pull request overview

Adds the next batch of OPA Gatekeeper security policies to the gatekeeper-config Helm chart / Greenhouse PluginDefinition, making previously hardcoded upstream settings configurable via Constraint parameters and extending coverage via shared traversal helpers.

Changes:

• Introduces 5 new configurable policies (constrainttemplates + constraints): forbidden clusterwide objects, approved registries, PCI forbidden images, required labels, and pod-security-v2.
• Adds Gatekeeper test suite coverage and fixtures for the new policies.
• Bumps the chart and PluginDefinition version to 0.2.0 and extends default values/options for the new policies.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
gatekeeper-config/tests/values-test.yaml	Enables and configures new policies for the test runs.
gatekeeper-config/tests/suite.yaml	Adds policy test cases validating expected violations/non-violations.
gatekeeper-config/tests/fixtures/pod-security-v2/pod-readonly-machine-id-pass.yaml	Fixture for readonly hostPath allow scenario.
gatekeeper-config/tests/fixtures/pod-security-v2/pod-privileged-violation.yaml	Fixture for privileged container violation.
gatekeeper-config/tests/fixtures/pod-security-v2/pod-host-network-violation.yaml	Fixture for hostNetwork violation.
gatekeeper-config/tests/fixtures/pod-security-v2/pod-host-network-allowlisted.yaml	Fixture for allowlisted hostNetwork scenario.
gatekeeper-config/tests/fixtures/pod-security-v2/pod-capability-violation.yaml	Fixture for capability-add violation.
gatekeeper-config/tests/fixtures/pod-required-labels/pod-with-label.yaml	Fixture where required label exists.
gatekeeper-config/tests/fixtures/pod-required-labels/pod-missing-label.yaml	Fixture where required label is missing.
gatekeeper-config/tests/fixtures/pod-required-labels/deployment-template-missing.yaml	Fixture ensuring template labels are enforced on workloads.
gatekeeper-config/tests/fixtures/pci-forbidden-images/pod-init-busybox-flagged.yaml	Fixture for initContainer image match.
gatekeeper-config/tests/fixtures/pci-forbidden-images/pod-busybox-flagged.yaml	Fixture for main container image match.
gatekeeper-config/tests/fixtures/pci-forbidden-images/pod-allowed.yaml	Fixture for allowed image.
gatekeeper-config/tests/fixtures/images-from-approved-registries/pod-unapproved.yaml	Fixture for unapproved registry image.
gatekeeper-config/tests/fixtures/images-from-approved-registries/pod-mixed-containers.yaml	Fixture for mixed approved/unapproved images.
gatekeeper-config/tests/fixtures/images-from-approved-registries/pod-approved.yaml	Fixture for approved registry image.
gatekeeper-config/tests/fixtures/forbidden-clusterwide-objects/vwc-allowed.yaml	Fixture for allowed validating webhook entry.
gatekeeper-config/tests/fixtures/forbidden-clusterwide-objects/mwc-disallowed.yaml	Fixture for disallowed mutating webhook entry.
gatekeeper-config/tests/fixtures/forbidden-clusterwide-objects/mwc-allowed.yaml	Fixture for allowed mutating webhook entry.
gatekeeper-config/plugindefinition.yaml	Bumps version and adds new configurable policy options.
gatekeeper-config/charts/values.yaml	Adds default values for new policy configurations.
gatekeeper-config/charts/templates/constrainttemplate-pod-security-v2.yaml	New pod-security-v2 template (allowlist-driven privileged feature restrictions).
gatekeeper-config/charts/templates/constrainttemplate-pod-required-labels.yaml	New template enforcing presence of configured label keys.
gatekeeper-config/charts/templates/constrainttemplate-pci-forbidden-images.yaml	New template forbidding images by configurable regex patterns.
gatekeeper-config/charts/templates/constrainttemplate-images-from-approved-registries.yaml	New template enforcing registry allowlist prefixes.
gatekeeper-config/charts/templates/constrainttemplate-forbidden-clusterwide-objects.yaml	New template restricting webhook configurations by allowlist.
gatekeeper-config/charts/templates/constraint-pod-security-v2.yaml	New constraint wiring values into pod-security-v2 parameters/match.
gatekeeper-config/charts/templates/constraint-pod-required-labels.yaml	New constraint wiring values into requiredLabels parameters/match.
gatekeeper-config/charts/templates/constraint-pci-forbidden-images.yaml	New constraint wiring values into patterns parameters/match.
gatekeeper-config/charts/templates/constraint-images-from-approved-registries.yaml	New constraint wiring values into allowedRegistries parameters/match.
gatekeeper-config/charts/templates/constraint-forbidden-clusterwide-objects.yaml	New constraint wiring values into allowedWebhooks parameters/match.
gatekeeper-config/charts/Chart.yaml	Bumps chart/app version to 0.2.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.