# Kubernetes OPA Gatekeeper bypass

{{#include ../../../banners/hacktricks-training.md}}

**The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)

## Abusing misconfiguration

### Enumerate rules

Having an overview may help to know which rules are active, on which mode and who can bypass it.

#### With the CLI

```bash
$ kubectl api-resources | grep gatekeeper
k8smandatoryannotations                                                             constraints.gatekeeper.sh/v1beta1                  false        K8sMandatoryAnnotations
k8smandatorylabels                                                                  constraints.gatekeeper.sh/v1beta1                  false        K8sMandatoryLabel
constrainttemplates                                                                 templates.gatekeeper.sh/v1                         false        ConstraintTemplate
```

**ConstraintTemplate** and **Constraint** can be used in Open Policy Agent (OPA) Gatekeeper to enforce rules on Kubernetes resources.

```bash
$ kubectl get constrainttemplates
$ kubectl get k8smandatorylabels
```

#### With the GUI

A Graphic User Interface may also be available to access the OPA rules with **Gatekeeper Policy Manager.** It is "a simple _read-only_ web UI for viewing OPA Gatekeeper policies' status in a Kubernetes Cluster."

<figure><img src="../../../images/05-constraints.png" alt=""><figcaption></figcaption></figure>

Search for the exposed service :

```bash
$ kubectl get services -A | grep gatekeeper
$ kubectl get services -A | grep 'gatekeeper-policy-manager-system'
```

### Excluded namespaces

As illustrated in the image above, certain rules may not be applied universally across all namespaces or users. Instead, they operate on a whitelist basis. For instance, the `liveness-probe` constraint is excluded from applying to the five specified namespaces.

### Bypass

With a comprehensive overview of the Gatekeeper configuration, it's possible to identify potential misconfigurations that could be exploited to gain privileges. Look for whitelisted or excluded namespaces where the rule doesn't apply, and then carry out your attack there.

{{#ref}}
../abusing-roles-clusterroles-in-kubernetes/
{{#endref}}

## Abusing ValidatingWebhookConfiguration

Another way to bypass constraints is to focus on the ValidatingWebhookConfiguration resource :

{{#ref}}
../kubernetes-validatingwebhookconfiguration.md
{{#endref}}

## References

- [https://github.com/open-policy-agent/gatekeeper](https://github.com/open-policy-agent/gatekeeper)
- [https://github.com/sighupio/gatekeeper-policy-manager](https://github.com/sighupio/gatekeeper-policy-manager)



{{#include ../../../banners/hacktricks-training.md}}
