---
# System prepended metadata

title: Untitled

---

**Test Case**

Objective: Throubleshooting OPA Gatekeeper

**Description**

OPA Gatekeeper prevents resources to be created

**Environment**

Cluster: kubernetes-admin@poc-p1-2platform-mars-os

**Date**

S: 2021-06-23T10:00:00+03:00
E: 2021-06-23T11:30:00+03:00

**Prerequisites**

* [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper)

**Resources**

* https://open-policy-agent.github.io/gatekeeper/website/docs/
* https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/

**Attendees**

- Hazar Güney
- Necatican Yıldırım
- Fatih Sarhan
- Batuhan Apaydın
- Furkan Türkal

**Test Scenarios**

**Scenario 1:** Create some Kubernetes Resources except for Namespace

We notice that Gatekeeper should not deny the requests if they are not related to creating or updating namespaces.

So, we created a Pod called `alpine` within the default namespace. We expected it to work because the value of the field called `failurePolicy` is `Ignore` for all the resources except for namespace.

```shell
$ kubectl run alpine --namespace default --image=alpine --restart='Never' -- sh -c "sleep 600"
pod/alpine created
```

Then, we tried to create the namespace, and we expected it not to work.
```shell
$ kubectl create namespace testing
Error from server (InternalError): Internal error occurred: failed calling webhook "check-ignore-label. gatekeeper.sh": Post https://gatekeeper-webhook-service.gatekeeper-system.svc:443/v1/admitlabel?timeout=3s: no endpoints available for service "gatekeeper-webhook-service"
```

As a result, at the end of this scenario, no problem was observed. Everything worked as we expected.


**Scenario 2:** Reboot one of the Master Nodes and wait for them to work properly

We selected one of the master nodes and made an ssh connection to that machine to run the `reboot` command.

```shell
$ ssh user@node
# reboot
``` 

We watched the processes that belong to the Master Node from another terminal to see what will happen.
```shell
$ watch kubectl get pods --namespace kube-system
```

As a result, at the end of this scenario, no problem was observed. Everything worked as we expected.

**Scenario 3:** Restart all the nodes within the cluster

We restarted all the nodes that belong to the cluster and watched the state of the cluster to see what will happen.

As a result, at the end of this scenario, no problem was observed. Everything worked as we expected.