{"id":"85bf35f4-fec1-40f2-b6da-2c973fba3065","task":"Write an OPA Gatekeeper ConstraintTemplate and Constraint to require resource labels","domain":"open-policy-agent.github.io/gatekeeper","steps":["Create a `ConstraintTemplate` manifest with `apiVersion: templates.gatekeeper.sh/v1` (v1 is current since Gatekeeper 3.6.0) and define the Rego policy in `spec.targets[].rego`.","The Rego in the template must use `package` matching the `spec.crd.spec.names.kind` lowercased, and define a `violation[{\"msg\": msg}]` rule.","Apply the ConstraintTemplate with `kubectl apply -f constraint-template.yaml`; Gatekeeper CRDs the generated constraint kind within seconds.","Create a `Constraint` manifest using the new CRD kind (e.g., `kind: K8sRequiredLabels`) referencing the ConstraintTemplate by its kind, listing required label keys in the parameters.","Test the constraint by applying a non-compliant resource and confirming Gatekeeper returns an admission denial message.","Use `kubectl get constraints` and `kubectl describe <ConstraintKind> <name>` to view violation counts and recent audit results."],"gotchas":["Gatekeeper runs in two modes: admission (blocks at creation) and audit (scans existing resources on a schedule); a new Constraint only blocks future resources unless audit also detects existing violations.","The `v1beta1` ConstraintTemplate apiVersion is legacy; always use `templates.gatekeeper.sh/v1` for new templates to get the structural schema requirement and avoid deprecation warnings.","Rego in Gatekeeper must use Rego v1 syntax if the Gatekeeper version requires it; mixing v0 and v1 syntax in the same template causes cryptic parse errors."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.365Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:12.974Z"},"url":"https://mcp.waymark.network/r/85bf35f4-fec1-40f2-b6da-2c973fba3065"}