Report OPA Gatekeeper audit violations in Security Command Center.
APACHE-2.0 License
gatekeeper-securitycenter
allows you to use Security Command Center as a
dashboard for Kubernetes resource policy violations.
gatekeeper-securitycenter
is:
a Kubernetes controller that creates Security Command Center findings for violations reported by the audit controller in Open Policy Agent (OPA) Gatekeeper.
a command-line tool that creates Security Command Center sources and manages the IAM policies of the sources.
gatekeeper-securitycenter
works with both
Security Command Center Standard tier
and
Security Command Center Premium tier.
If you use Policy Controller from Google Cloud, consider using its in-built integration with Security Command Center.
Before installing the gatekeeper-securitycenter
controller, create all the
following resources:
To create these prerequisite resources, choose one of these options:
Use the shell scripts in the scripts
directory. These scripts
create resources using the gcloud
command-line tool from the
Google Cloud SDK.
Follow the step-by-step instructions in the accompanying tutorial.
If you use Security Command Center Standard tier, you must have an appropriate Cloud IAM role for Security Command Center at the organization level, such as Security Center Admin Editor. Your organization administrator can grant you this role.
If your user account is not associated with an organization on Google Cloud, you can create an organization resource by signing up for either Cloud Identity or Google Workspace (formerly G Suite) using a domain you own. Cloud Identity offers a free edition.
gatekeeper-securitycenter
command-line toolDownload the binary for your platform:
VERSION=v0.4.2
curl -Lo gatekeeper-securitycenter "https://github.com/GoogleCloudPlatform/gatekeeper-securitycenter/releases/download/${VERSION}/gatekeeper-securitycenter_$(uname -s)_$(uname -m)"
chmod +x gatekeeper-securitycenter
gatekeeper-securitycenter
controllerInstall the gatekeeper-securitycenter
controller in your cluster by following
the documentation in the manifest directory.
This is not an officially supported Google product.