August 2024 Summaries

In this article, we discuss strings in Terraform, including their definition, interpolation, manipulation with built-in functions, and concatenation. Strings are a fundamental data type used to define configuration values in Terraform. They can be defined using quoted or heredoc syntax. Interpolation allows for dynamic insertion of values from variables, resource attributes, or function calls into strings. Terraform provides several built-in string functions such as base64decode(), join(), regex(), replace(), split(), lower(), substr(), and trim(). These functions enable manipulation and transformation of string values within configurations. Concatenation can be achieved using either string interpolation with ${} or the join() function.

Okta is an identity access management (IAM) service that provides secure, centralized authentication for users within an organization. It offers features such as single sign-on (SSO), multi-factor authentication (MFA), and lifecycle management functionalities to streamline access management, enhance security, and improve the user experience. The Okta Terraform provider allows administrators to automate various tasks related to managing users, groups, policies, roles, and identity providers in their Okta account. By leveraging Terraform for Okta access, organizations can ensure consistency, version control, scalability, and collaboration while minimizing human errors. Spacelift integrates with Okta for SSO and provides features such as contexts, policies, stack dependencies, and blueprints to streamline Okta management workflows.

This tutorial demonstrates how to use autoscaling in Spacelift, an open-source platform that allows you to automatically adjust the number of workers in a cluster based on queue length. The process involves installing a Spacelift Worker Pool Controller, Prometheus Exporter, and KEDA ScaledObject in the cluster. It also requires creating a worker pool in Spacelift using Certificate Signing Request (CSR) files and an API key for authentication. Finally, you need to create a namespace and secrets for the worker pool controller and Prometheus exporter, install the Helm chart, and create a KEDA ScaledObject to monitor queue length and scale the worker pool accordingly.

In this tutorial, we will learn how to use Terraform to deploy Kubernetes resources. We will create a Jenkins CI/CD pipeline that uses Docker containers to run the Terraform commands and then integrate it with our minikube cluster. Additionally, we will explore using Spacelift stack dependencies to deploy an app in Kubernetes with Terraform. Prerequisites: - Jenkins installed on your local machine - Minikube installed on your local machine - GitHub account - Docker installed on your local machine Step 1: Create a Dockerfile for the Jenkins image Create a new file named Dockerfile in your project directory with the following content: ``` FROM jenkins/jenkins:lts RUN apt-get update && apt-get install -yq \ curl \ git \ openssh-client \ zip USER root #Install Terraform and kubectl RUN wget https://releases.hashicorp.com/terraform/1.5.3/terraform_1.5.3_linux_amd64.zip && \ unzip terraform_1.5.3_linux_amd64.zip && \ mv terraform /usr/local/bin/ && \ rm terraform_1.5.3_linux_amd64.zip #Install kubectl RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \ install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl && \ rm kubectl USER jenkins #Access jenkins on port 8080 EXPOSE 8080 CMD ["jenkins.sh"] ``` Step 2: Build the Docker image for Jenkins Now from the directory you created the Dockerfile in, run the following: ``` #To create the docker image docker build . -t jenkins-image:v1 #Validate image exists docker images ``` Step 3: Run the Jenkins instance We will run the Jenkins instance using this image. To ensure Jenkins can communicate with our minikube instance, we will mount our ~/.kube/config and /Users/your username/.minikube directory to the Jenkins container. Note: The directory path for the minikube certificates will be different if you are using Windows, this will work for MacOS. ``` #Create Jenkins container docker run -d -p 8080:8080 -p 50000:50000 -v ~/.kube:/var/jenkins_home/.kube -v jenkins_home:/var/jenkins_home -v /Users/your-username/.minikube:/Users/yourusername/.minikube --name jenkins-instance jenkins-image:v1 #Validate terraform and kubectl are working on container docker exec jenkins kubectl —-help docker exec jenkins terraform —-help #Grab the password, we will need this to login to Jenkins docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword ``` Step 4: Set up the Jenkins instance Follow these steps to set up your Jenkins instance: - Open your web browser and go to http://localhost:8080 to access your Jenkins CI/CD. - Once you are prompted to enter your admin password, enter the password we grabbed from the previous step. - Go through the setup pages to install the recommended plugins and create your admin user, which you will use to log in from then on. - Go to Manage Jenkins > Plugins > Available plugins and install the following plugins: - Kubernetes - Kubernetes CLI - Terraform We should be all set to start creating our Terraform resources and our Jenkins pipeline. Let’s start setting up our Terraform code, which will contain the Kubernetes resources we will deploy to our minikube cluster through Jenkins. You will need to host your Terraform code on a GitHub repository. We will not cover that in this article, but you just need to make sure the repository is public so we can access it from our Jenkins pipeline. In your GitHub repository, create the following main.tf file: ``` provider "kubernetes" { config_path = "~/.kube/config" } #Kubernetes namespace to hold application resource "kubernetes_namespace" "terraform-k8s" { metadata { name = "terraform-k8s" } } resource "kubernetes_deployment" "test-deploy" { metadata { name = "terraform" namespace = "terraform-k8s" labels = { test = "MyApp" } } spec { replicas = 3 selector { match_labels = { test = "MyApp" } } template { metadata { labels = { test = "MyApp" } } spec { container { image = "nginx:1.21.6" name = "nginx-terraform" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initial_delay_seconds = 3 period_seconds = 3 } } } } } } ``` Create the Jenkins pipeline We will now return to our Jenkins instance and create the pipeline. For this example, we will add the pipeline solely to deploy the Kubernetes resources using Terraform. However, this can be used alongside the other CI/CD steps in your pipeline. Go to your Jenkins instance and create a new item, select Pipeline, and name it “k8s-terraform-pipeline”. Add the following pipeline script: ``` pipeline{ agent any stages{ stage('Git Checkout'){ steps{ git branch: 'main', url: 'https://github.com/yourusername/repo_name' } } stage('Terraform init'){ steps{ dir("terraform/spacelift/terraform-k8s"){ sh 'terraform init' } } } stage('Terraform plan'){ steps{ dir("terraform/spacelift/terraform-k8s"){ sh 'terraform plan' } } } stage('Terraform apply'){ steps{ dir("terraform/spacelift/terraform-k8s"){ sh 'terraform apply --auto-approve' } } } } } ``` Now save the pipeline and run the build. Once the pipeline runs successfully, go to your terminal and run the following to ensure the application was deployed successfully to your Kubernetes cluster through the Jenkins CI/CD pipeline: ``` kubectl get deployment -n terraform-k8s NAME READY UP-TO-DATE AVAILABLE AGE nginx 1/1 1 1 9m22s kubectl get service -n terraform-k8s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE nginx LoadBalancer 10.x.x.x 172.170.55.37 80:30302/TCP 9m24s ``` Using Spacelift stack dependencies to deploy an app in Kubernetes with Terraform To simplify your CI/CD processes, you can also leverage Spacelift stack dependencies. The stack dependencies feature allows you to define and manage the relationships between different stacks, ensuring that your pipeline steps run in the correct order and all dependencies are resolved before proceeding to specific steps. This is particularly useful in complex infrastructure environments where multiple components — such as account creation and assignments, networking, databases, compute resources, Kubernetes clusters, monitoring, and alerting — must be provisioned in a precise sequence. You can easily pass information between stacks, which not only minimizes the risk of errors but also streamlines the deployment process, making it more efficient and reliable. When using stack dependencies in CI/CD pipelines, you achieve a smoother and more controlled deployment. In this example, we will demonstrate using stack dependencies to deploy Kubernetes resources to an Azure AKS cluster. We will break this process into two stacks: The first stack will focus on deploying an AKS cluster with Terraform, and the second stack will handle deploying Kubernetes resources into the AKS cluster. We will establish a dependency from stack 1 to stack 2, passing the kube config generated by the AKS cluster (stack 1) as an output to the Kubernetes stack (stack 2). Prerequisites - Spacelift account (you can sign up for a 14-day free trial if needed) - Azure subscription - GitHub repo Configure cloud integration In your Spacelift account, go to the Cloud Integrations side tab, click on Azure and Create Integration. Add your Azure Tenant ID and Subscription ID here, and then click Create Integration. You will get a prompt to Provide Consent. Click that and wait a few minutes. Go to your Azure portal, click on Microsoft Entra ID > Enterprise Applications and search for ‘spacelift’. Confirm you can see the application there. If you do not see the application, validate that you have administrator permissions in this Azure subscription and try again. Now, in your Azure Portal, go to your Subscription > IAM > Add Role Assignment. Select the Privileged administrator roles tab and select Contributor. Assign this role to the enterprise application Spacelift. Review the changes and click on Review and assign. Set up Git repositories for Terraform and Kubernetes resources We will create two separate directories in the GitHub repository. One will have the Terraform code to deploy our Azure AKS cluster deployment (we will use the terraform k8s module). The second directory will include the code for our Kubernetes manifest. From the repository’s root directory, create a directory named ‘tf’. Add the following main.tf file: ``` provider "azurerm" { features {} } resource "azurerm_resource_group" "azrg" { name = "az-rg" location = "centralus" } module "aks" { source = "github.com/flavius-dinu/terraform-az-aks.git?ref=v1.0.12" kube_params = { kube1 = { name = "kube1" rg_name = azurerm_resource_group.azrg.name rg_location = "centralus" dns_prefix = "kube" identity = [{}] enable_auto_scaling = false node_count = 1 np_name = "kube1" export_kube_config = false tags = {} } } } output "kube_config" { value = module.aks.kube_config["kube1"] sensitive = true } ``` Again, in the repository’s root directory, create another directory name it ‘k8s’.Then, add the following nginx.yaml file: ``` apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: replicas: 2 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.21.1 ports: - containerPort: 80 ``` Once you have created the files and set them up in your Git repository, you can start working on creating the stacks that will reference these directories. Set up Terraform (Azure AKS Cluster) and Kubernetes stacks with dependencies Terraform stack creation On Spacelift’s home page, click Create Stack. Name your stack “azure-aks-terraform”. If you already logged in using your Github account to Spacelift, you should see your Github repositories. Select your Repository, Branch, and Project Root, which should point to the ‘tf’ directory we created earlier in your Git repository. If you did not log in to Spacelift using your GitHub account, you can log in here, point to your Git repository, and add your project root. On the Choose Vendor screen, make sure Terraform / OpenTofu is selected, and everything else should be set to default. Keep the rest of the screens as default, and click Confirm. Now, we will trigger this stack to create the outputs for our AKS cluster and insert these outputs into the Kubernetes stack dependencies. Go to the azure-aks-terraform stack and click Trigger. This should start creating all your Azure resources via Terraform. After the Terraform Plan is complete, you will be prompted to Confirm the run (Terraform Approve). Make sure to click Confirm. Once the stack is complete, validate that the Azure resources and outputs are created successfully. You can also check the Azure Portal and make sure the resources were created successfully. Kubernetes stack creation Let’s return to Spacelift’s homepage and create the second stack for Kubernetes resource deployment. You can name this one “Kubernetes.” For the Git source code, we will point this to the same repository and branch as the previous stack, but the project root will point to “k8s”’instead. On the Choose vendor screen, select Kubernetes and leave everything else as default. Let’s skip to the Add hooks screen. We will add a “Before Initialization” workflow step to process the outputs from the first stack. We will explain more later, but for now add the following commands to the Before window: ``` mkdir /mnt/workspace/.kube printf "%s\n" "$kubeconfig" > /mnt/workspace/.kube/config ``` Let’s skip to the summary and click Confirm. Go to your ‘azure-aks-terraform’ stack, click Settings, and click Integrations there. Select your Azure subscription here (you should be able to click the drop-down and have it auto-populate the Subscription ID) and make sure to assign it read/write permissions. Output/dependencies In the ‘azure-aks-terraform’ stack, go to the Dependencies tab and under Depended on by, click Add Dependencies. Select Kubernetes and click Add. On the same screen, click Add output reference. Select ‘kube_config’ and enter ‘kubeconfig’ as the Input name. This will insert the Terraform Azure AKS cluster output we placed in our Terraform code into the Kubernetes stack. You can now go to the Spacelift homepage. Under stacks select ‘azure-aks-terraform’ stack and click Trigger. This will run the Terraform stack first (it should not add anything new because we ran this earlier) and place the downstream stack for Kubernetes on “Queued” status. You will need to Confirm the Terraform deployment. Once the stack has finished running, the second stack for Kubernetes will get triggered and create the nginx application on the AKS cluster. You can also validate the Kubernetes deployment was successful on the Azure Portal or through kubectl. And that’s it! You have successfully deployed Kubernetes resources to an Azure AKS cluster via Terraform using Spacelift stack dependencies. If you want to learn more about Spacelift, create a free account today, or book a demo with one of our engineers. Let’s review some best practices for using Terraform to deploy Kubernetes resources: - Modularize your Kubernetes Terraform code | By modularizing your resources, such as Kubernetes deployments, services, config maps, roles, and role bindings, you can simplify deployment and enable reusability. | - Utilize variables | Always try to use variables in your Kubernetes instead of hard coding any values. You can also pass in environmental, regional, and other values from your pipeline down to your Kubernetes modules. | - State management | Use the remote backend (Azure Storage Account or AWS S3 Bucket) to store your remote state file. Also, make sure to use state locking to prevent multiple changes to the terraform state at the same time. | - Outputs | Utilize outputs as much as possible during cluster deployments using Terraform to get kubeconfig and other values, such as cluster endpoint, and use them within your Kubernetes resource deployments. | - IAM role management | Use AWS IAM roles for service accounts (IRSA) or Azure Managed Service Identity (MSI) to manage permissions for your Kubernetes workloads. | - Version control | Make sure to version control your Terraform code and use a CI/CD pipeline to automate the deployment process. | By following these best practices, you can ensure that your Kubernetes resources are deployed consistently and securely using Terraform.

An internal developer platform (IDP) is a self-service layer that sits on top of an organization's infrastructure and development tools, abstracting many of these components' underlying complexity. It comprises integrated tools and services designed to enable development teams to build, deploy, and manage applications more efficiently. IDPs provide a unified interface for developers to interact with the entire software lifecycle, from code to production, while automating many routine tasks, enforcing best practices, and ensuring a consistent experience across an organization and its different environments. Key components of internal developer platforms include a self-service developer portal, automated workflows and integration with existing systems, infrastructure management, environment management and application configuration, and deployment management and monitoring.

Ansible and Kubernetes are industry-standard tools for automation in infrastructure and software development. Ansible is an open-source tool that simplifies configuration management across various platforms, while Kubernetes is a container orchestration tool that automates the deployment, scaling, and management of containerized applications. Both tools have unique features and serve different purposes, but they can be used together effectively to streamline IT operations and improve efficiency in software development, delivery, and deployment processes.

Platform engineering involves building internal toolchains to support software development teams, consolidated into a self-service internal developer platform (IDP). The role of a platform engineer is to architect, build, and maintain an IDP on behalf of developers. They listen to developers to identify DevOps problems and create solutions. Key responsibilities include developing IDPs, setting up CI/CD pipelines, creating new APIs, CLIs, web apps, and other interfaces for developers to interact with, monitoring deployed environments, writing documentation, cooperating with developers and operators, debugging and resolving reported issues, and assessing the opportunities offered by new tools. The platform engineering role requires a combination of technical ability and soft skills, including coding proficiency in various languages, interest in integrating different tools, product-oriented mindset, ability to coordinate different teams and disciplines, and awareness of emerging trends and best practices.

The Terraform lock file (.terraform.lock.hcl) is used to record the provider selections made by Terraform during initialization. It ensures that the same provider version is used across different systems and different Terraform runs, providing consistent behavior for your infrastructure. You should keep this file together with your Terraform configuration in your version control repository.

Spacelift, a platform that focuses on secure infrastructure management, has added multi-factor authentication (MFA) to enhance security posture. MFA involves using multiple authentication mechanisms when logging into an application and acts as the last line of defense by adding an additional layer of security. This feature is especially important in light of recent security incidents at Okta and Microsoft Azure accounts where hackers accessed systems through phishing techniques. Spacelift's MFA implementation requires users to have a second form of verification, such as one-time passwords, biometric authentication, or hardware security keys, making it more difficult for unauthorized access even if passwords are compromised. Additionally, implementing MFA is cost-effective and helps organizations stay compliant with industry rules and regulations that require protection of sensitive data.

Platform engineering focuses on designing, building, and maintaining the foundational infrastructure that supports the entire software development lifecycle by allowing developers to accelerate while maintaining control. Key areas of platform engineering include infrastructure as code, configuration management, continuous integration and delivery, container orchestration, monitoring and observability, security and compliance, and infrastructure management platforms. A successful platform engineering team often includes roles such as platform engineers, site reliability engineers, cloud architects, and security engineers. When hiring for these positions, it is crucial to find candidates with strong automation skills, problem-solving abilities, and the capacity to collaborate effectively with other teams. Additionally, creating focused job descriptions and implementing effective onboarding processes can help attract and retain top talent in platform engineering roles.

The article provides a step-by-step guide to creating a self-hosted WordPress instance using Terraform and Google Cloud Platform (GCP). The process involves configuring the Terraform provider, setting up networking, DNS, firewall rules, and deploying a MySQL database. Additionally, it covers integrating Spacelift, an automation tool that manages infrastructure-as-code workflows, including Terraform configuration. The guide emphasizes the importance of security best practices and encourages readers to secure their WordPress site with an SSL certificate in their next step.

Terraform is a powerful tool for managing infrastructure at scale by handling the full lifecycle of resources, including creating new ones, updating existing ones, and tearing down those that are no longer needed. It maintains a state file to record the current status of the infrastructure, enabling it to determine the necessary changes to reach the desired state. The terraform state list command is used to efficiently navigate, filter, and identify specific resources in the state file, making it easier to troubleshoot, plan, and maintain your infrastructure. This command can be used with various options and flags to filter by module type, resource name, IDs, or even run against a remote state backend. Spacelift is an additional tool that enhances Terraform's capabilities by providing features such as policies, multi-IaC workflows, self-service infrastructure, and integrations with third-party tools.

In this tutorial, we will learn about variables in Terraform. Variables are used to parameterize your configurations so that you can make them more flexible and reusable. We will cover the following topics: 1. Introduction to Variables 2. Declaring Variables 3. Providing Values for Variables 4. Default Values for Variables 5. Using Variables in Configurations 6. Output Variables 7. Variable Validations and Sensitivity 8. Example: Creating Multiple Subnets with Variables 9. Best Practices for Using Terraform Variables 10. Conclusion By the end of this tutorial, you will have a good understanding of how to use variables in your Terraform configurations.

Using Terraform on Google Cloud Platform (GCP) simplifies the process of managing cloud infrastructure by defining resources as code. This approach allows for version control, collaboration, and automated provisioning. GCP offers a global network of data centers and focuses on AI and machine learning tools integrated into many services. Terraform has a GCP provider plugin that enables interaction with all Google Cloud services directly through Terraform configuration files. Spacelift enhances Terraform workflows by integrating with version control systems like GitHub, automating the CI/CD process, and managing complex infrastructure configurations.

Ansible is a powerful open-source tool for automating infrastructure management and configuration tasks. GitHub Actions is a robust CI/CD platform that allows users to automate software development and deployment tasks directly from their GitHub repository. By combining these two tools, developers can automate and streamline their Ansible deployments, leveraging continuous integration and continuous delivery (CI/CD) principles. This results in consistent and reproducible deployments, audit trail and traceability, and scalability and parallelization benefits.

Kubectl contexts allow users to work with multiple Kubernetes clusters using one kubectl installation. Contexts are stored in the kubeconfig file, which contains cluster URLs, user credentials, and default namespaces for each context. The kubectl config commands can be used to manage these contexts, including getting the current context, listing all available contexts, setting a specific context, adding new contexts, deleting contexts, and displaying the contents of the kubeconfig file. Overriding context settings is also possible using regular Kubectl flags. Spacelift can be used for managing Kubernetes projects with features like GitOps flow, custom policies, plan policies, approval policies, and more.

In the IaC world, Terraform and OpenTofu are popular projects that allow engineers to define, provision, and manage infrastructure lifecycles. Both tools offer modularity, declarative configuration, state management, CI/CD integrations, and ecosystem support. However, key differences include licensing (OpenTofu is open-source under MPL 2.0 while Terraform is source-available under BSL), community-driven development (OpenTofu has a ranking system for feature implementation), state encryption (Offered by OpenTofu but not Terraform), and early variable evaluation (Available in OpenTofu 1.8). Spacelift supports both tools, offering features like policy enforcement, stack dependencies, cloud integrations, contexts, drift detection, and enhanced observability. As time passes, the two tools will likely diverge further.

Spacelift has launched new features to help organizations manage their infrastructure, accelerate developer velocity, and improve security. The Dashboard provides a single pane of glass for visibility into infrastructure status and workflow activity, while the Kubernetes Operator allows developers to manage Spacelift resources using Kubernetes custom resources. Additionally, OpenTofu 1.8 offers features such as variable usage in terraform blocks and support for .tofu file extension. These updates aim to streamline and de-risk infrastructure transitions and improve overall efficiency.

GitHub Copilot is a powerful AI-based code completion tool that assists developers in writing code faster and with less effort. It offers features such as code autocompletion, integration with various development environments, multi-language support, context-aware suggestions, and a chat interface. To use it with Terraform, ensure the GitHub Copilot extension is installed and enabled in your code editor. While Copilot can suggest infrastructure code, developers must review, understand, and integrate it effectively into their projects.

Open Policy Agent (OPA) is an open-source engine that allows declarative writing of policies as code and their use in decision-making processes. It uses a policy language called Rego, which can be used to write policies for different services. OPA has various applications, including authorization of REST API endpoints, allowing or denying Terraform changes based on compliance or safety rules, integrating custom authorization logic into applications, and implementing Kubernetes Admission Controllers to validate API requests. It was originally created by Styra and is now part of the Cloud Native Computing Foundation (CNCF). OPA can serve many purposes, but this article focuses on how it can be used alongside Infrastructure as Code.

This guide explains how to provision an AWS EKS Kubernetes cluster using Terraform. It covers the installation of necessary tools like Terraform, AWS CLI, and kubectl. The process involves configuring AWS CLI with access credentials, cloning a repository containing the required files for setting up EKS, initializing the Terraform workspace, running a dry run to view changes, applying the plan to provision resources, updating kubeconfig with cluster credentials, deploying an Nginx instance to test the cluster, and finally destroying the created resources. The guide also mentions Spacelift as a tool for managing Terraform state files and building more complex workflows based on Terraform.

This article discusses Kubernetes Secrets, which are a secure way to store sensitive information like passwords, API or Oauth tokens, SSH keys, and certificates used within your Kubernetes applications. It explains how to set up Terraform with the Kubernetes provider so that secrets can be managed using examples. The article also covers why you might want to use Terraform to manage Secrets, including its centralized approach to managing Secrets, where you can create, update, and delete them within the same workflow. Additionally, it highlights features like secret rotation and integration with external tools like Vault for enhanced security.

On August 10th, 2023, HashiCorp announced a licensing change for Terraform from the open-source Mozilla Public License v2.0 (MPL v2) to the Business Source License v1.1 (BSL 1.1). This change sparked mixed reactions from the open-source community and led to the creation of an alternative project, OpenTofu, which forked the legacy MPL-licensed Terraform. The new license prevents direct HashiCorp competitors from incorporating BSL-licensed code into their services. While most users are not affected by this change, it has caused uncertainty in the community and ecosystem that relies on Terraform. OpenTofu is a completely open-source fork of Terraform that works as a drop-in replacement for version 1.6 and is backward-compatible with earlier versions. It offers new features, enhancements, and bug fixes designed to improve the user experience and overall functionality.

Open Policy Agent (OPA) is a general-purpose policy engine that evaluates inputs against expressions you configure, commonly used to enforce security policies in cloud resources and infrastructure components. OPA integrates with Kubernetes through the use of admission controllers, allowing for continuous enforcement of policies without manual intervention. Policies are written in Rego query language, which is designed to be expressive and approachable for human readers. Using OPA with Kubernetes provides benefits such as ensuring authorized configurations, applying consistent controls across all teams and apps, maintaining compliance with regulatory standards, enabling granular security policy enforcement, and centrally managing policies as code. The OPA Gatekeeper project simplifies the process of integrating OPA with Kubernetes by automating the configuration of admission controllers and providing a set of Kubernetes CRDs for configuring policies.