Example k8scontainerlimits does not throw error for a deployment but does on a plain Pod creation about gatekeeper-library HOT 2 CLOSED

Hi @ujjwal-sophos!

The sample constraint above only applies to Pod, therefore it won't evaluate the Deployment when it is being created. I would suggest you use an ExpansionTemplate to "expand" the deployment's template into a Pod for clearer evaluation.

For example, this expansion template should cause the deployment's template section to be evaluated as if it was a Pod:

apiVersion: expansion.gatekeeper.sh/v1alpha1
kind: ExpansionTemplate
metadata:
  name: expand-apps
spec:
  applyTo:
    - groups: ["apps"]
      kinds: ["DaemonSet", "Deployment", "ReplicaSet", "StatefulSet"]
      versions: ["v1"]
  templateSource: "spec.template"
  generatedGVK:
    kind: "Pod"
    group: ""
    version: "v1"

As you noted, even without the expansion template, your constraint will still apply when the Deployment attempt to (later) schedule pods. But the expansion template will allow for better visibility at admission time when only the deployment itself is being created.

from gatekeeper-library.

Thanks @apeabody I missed this part

from gatekeeper-library.