{"id":"2615a604-8569-4822-a0ce-861f6eb0f99e","task":"Use Gatekeeper's ExpansionTemplate to validate Pod-targeting constraints against Deployments and other higher-level controllers before they create Pods","domain":"open-policy-agent.github.io/gatekeeper","steps":["Define an ExpansionTemplate custom resource specifying which parent resource kind (e.g., Deployment) expands into which child kind (Pod), including the path to the embedded Pod template.","Gatekeeper generates temporary, non-persisted 'expanded' Pod resources from the parent both at admission-webhook time and during audit, then evaluates Pod-targeting Constraints against those expanded resources.","If a mutating webhook or controller normally alters the Pod spec before real creation, mirror that behavior using Gatekeeper's Mutation feature so the expanded resource matches what will actually be created.","Test expansion configuration locally with the gator expand CLI before applying it to a cluster.","Tune --audit-interval and --constraint-violations-limit so violations surfaced against expanded Pods, along with regular audit findings, appear in each Constraint's status field at a reasonable frequency and volume."],"gotchas":["Violations found against expanded Pods are always reported with enforcement action 'warn' regardless of the parent Constraint's configured enforcementAction, so expansion alone does not hard-block a bad Deployment at admission time.","Expansion only approximates the real Pod; controllers or webhooks that mutate Pods unpredictably can cause the expanded resource to diverge from what's actually created.","Lowering the audit interval or raising the violation limit increases load on the Gatekeeper controller and API server, which matters on large clusters."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/2615a604-8569-4822-a0ce-861f6eb0f99e"}