Write and test an OPA Gatekeeper ConstraintTemplate with Rego v1 syntax

Steps

1. Create a ConstraintTemplate YAML with apiVersion: templates.gatekeeper.sh/v1, kind: ConstraintTemplate, and spec.crd.spec.names.kind matching the constraint CRD name you want (e.g., K8sRequiredLabels).
2. Under spec.targets, declare target: admission.k8s.gatekeeper.sh and a code block with engine: Rego and source.version: v1 to use Rego v1 syntax without needing an import rego.v1 statement.
3. Write your Rego policy inside source.rego; use violation contains {"msg": msg} if ... pattern and reference input.review.object for the admission request object.
4. Create a corresponding Constraint resource (the CRD generated by the template) with a match block scoping it to the desired resource kinds and namespaces.
5. Use the gator CLI (gator verify) with a test suite YAML to run unit tests against the ConstraintTemplate locally before applying to a cluster.
6. Apply both the ConstraintTemplate and the Constraint to the cluster and verify enforcement with kubectl describe constraint <name> to inspect violations.