kube-mgmt: trouble loading policy, kube-mgmt logs throwing error
I am trying to roll out opa with helm chart. The chart was successfully rolled out but now I am having trouble enforcing the policy.
Version of Kubernetes: k8s- v1.15.6 opa- opa:0.15.1 kube-mgmt- 0.10
What happened: my config map looks like this
Name: admission-control
Namespace: opa-test
Labels: openpolicyagent.org/policy=rego
Annotations: openpolicyagent.org/policy-status: {"status":"ok"}
Data
====
admission-policy.rego:
----
package kubernetes.admission
deny[reason] {
some container
input_containers[container]
not startswith(container.image, "docker-integration.cernerrepos.net")
reason := "container image refers to wrong registry, must be from docker-integration.cernerrepos.net"
}
input_containers[container] {
container := input.request.object.spec.containers[_]
}
input_containers[container] {
container := input.request.object.spec.template.spec.containers[_]
}
Events: <none>
- name: mgmt
image: openpolicyagent/kube-mgmt:0.10
imagePullPolicy: IfNotPresent
resources:
{}
args:
- --opa-auth-token-file=/bootstrap/mgmt-token
- --opa-url=http://127.0.0.1:8181/v1
- --replicate-path=kubernetes
- --enable-data=false
- --enable-policies=true
- --policies=opa-test
- --require-policy-label=true
I went ahead and looked up my kube-mgmt logs and it shows-
time="2020-01-27T22:55:11Z" level=warning msg="First line of log stream."
E0127 23:03:12.799556 1 streamwatcher.go:109] Unable to decode an event from the watch stream: unable to decode watch event: no kind "Status" is registered for version "v1" in scheme "github.com/open-policy-agent/kube-mgmt/pkg/configmap/configmap.go:102"
E0127 23:04:53.804350 1 streamwatcher.go:109] Unable to decode an event from the watch stream: unable to decode watch event: no kind "Status" is registered for version "v1" in scheme "github.com/open-policy-agent/kube-mgmt/pkg/configmap/configmap.go:102"
What you expected to happen:
Expected the policy to be enforced
I am not sure of this logs I am seeing here in kube-mgmt.
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 33 (15 by maintainers)
Ah, that bundle part was really confusing and throwing me out. I tried to remove it but then I was getting a 404 because I was missing main.rego config map. Got it now. Thank you for all your help and time. Really appreciate it!!! This is not very intuitive for a new user, I have seen some other people posting similar questions on their github. So I will make p/r to upadate the helm opa readme with this information.