Tanzu Mission Control – Using custom policies to ensure Kasten protects a deployed application
Tags: vmware, kubernetes, custompolicies, kasten
Published: 2021-07-13 22:50:45

---
title: Tanzu Mission Control – Using custom policies to ensure Kasten protects a deployed application
published: true
date: 2021-07-12 17:51:19 UTC
tags: VMware,Kubernetes,CustomPolicies,Kasten
canonical_url: https://veducate.co.uk/tanzu-mission-control-custom-policy-kasten/?utm_source=rss&utm_medium=rss&utm_campaign=tanzu-mission-control-custom-policy-kasten
---

###### The Issue

A while ago I was chatting to Michael Cade, and we pondered the question “How do we ensure Kasten is protecting a newly deployed application in our Kubernetes environment”.

We chatted about how one of the best ways to make your Kasten protection policy flexible is by using metadata labels.

We came up with the simple idea: “What if something forces a known label on the metadata of any applications deployed by our developers in the future?”

This blog post covers this use case using Tanzu Mission Control with custom policies.

###### The Solution

One of the products we can use to enforce labels on a Kubernetes resource is [Open Policy Agent](https://www.openpolicyagent.org/) Gatekeeper. Which is an external admission controller which allows you to create policies for the admission of resource creation/changes/updates based on a criteria.

- OPA policies are expressed in a high-level declarative language called Rego. (Pronounced “ray-go”.)

Tanzu Mission Control, the fleet management SaaS tool for managing your Kubernetes platforms, provides you the ability to create policies of various types to manage the operation and security posture of your Kubernetes clusters and other organizational objects, implemented by using the OPA [Gatekeeper](https://github.com/open-policy-agent/gatekeeper).

###### Implementing The Solution

For this solution “art of the possible” blog post, we are going to keep it really simple, and implement a policy which covers the following:

- For any Namespaces deployed by our developers which have the label “app: production” we also want to ensure that there is a label with the key value “kasten”
- Our Kasten protection policy will be configured to protect resources identified with the label key “kasten” and a specified value.

First let’s create our Kasten protection policy first, I won’t go through this step by step but here you can see it is created to protect resources with the label “kasten: backup-default”

[![Kasten - Policy - Select Applications By Labels](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kasten-Policy-Select-Applications-By-Labels.jpg?resize=604%2C310&ssl=1)](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kasten-Policy-Select-Applications-By-Labels.jpg?ssl=1)

In Tanzu Mission Control, I am going to create a custom policy against my TKG cluster (other Kubernetes clusters will also work).

- Click Policie
- Custom Policies tab
- You can select to create the policy at either: organisation level, cluster group level, or cluster level
- Click to create the custom policy

[![Tanzu Mission Control - Create custom policy](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy.jpg?resize=604%2C264&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy.jpg?ssl=1)

Handily, Tanzu Mission Control provides you an out of the box “Require labels” example to use. However, under the Templates sections on the left hand navigation pane, you can create your own OPA Rego templates to be used for any type of custom policy you need.

- Select the custom policy “tmc-require-labels”
- Provide a name for the policy
- Set the targeted resource as necessary
  - For my example I’ve used the namespace
  - Make sure you click the “Add Resource” button

[![Tanzu Mission Control - Create custom policy - Configure](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy-Configure.jpg?resize=604%2C584&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy-Configure.jpg?ssl=1)

- Under Parameters
  - Set the Labels you expect to be present
  - An associated value is optional
- Select which Namespaces to include or exclude from the policies
  - In my test, I just wanted to include label selectors which identified my production applications
- Click to create the policy

[![Tanzu Mission Control - Create custom policy - Configure 2](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy-Configure-2.jpg?resize=604%2C637&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Tanzu-Mission-Control-Create-custom-policy-Configure-2.jpg?ssl=1)

On my Kubernetes cluster I can see the deployed gatekeeper under the namespace “gatekeeper-system”.

[![kubectl get all -n gatekeeper-system](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-get-all-n-gatekeeper-system.jpg?resize=604%2C237&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-get-all-n-gatekeeper-system.jpg?ssl=1)

And I can run “kubectl get constraints” to see the configured constraints on my cluster.

[![kubectl get contraint](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-get-contraint.jpg?resize=604%2C1165&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-get-contraint.jpg?ssl=1)

###### Testing The Solution

With this custom policy configured, any namespace that I create with a label of “app: production” will not be created unless it also as a label where the key is “kasten”.

In the below example outputs, I’m using this [test application](https://github.com/lamw/vmware-k8s-app-demo), I have altered it slightly to create the namespace as part of the YAML. Below is my first attempt.

[![Application deployment without kasten label](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Application-deployment-without-kasten-label.jpg?resize=294%2C300&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Application-deployment-without-kasten-label.jpg?ssl=1)

You can see when I deploy the YAML file, it fails due to the missing expected label key in the metadata, and the error output from the admission controller is quite detailed as well.

[![kubectl apply yelb fails](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-apply-yelb-fails.jpg?resize=604%2C42&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/kubectl-apply-yelb-fails.jpg?ssl=1)

```
Error from server ([denied by tmc.cp.kasten-label-required] You must provide labels with keys: {"kasten"}): error when creating "yelb.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [denied by tmc.cp.kasten-label-required] You must provide labels with keys: {"kasten"}
```

If I now alter my YAML file, to add in the additional label, the creation of the application will be successful.

[![Application deployment with kasten label](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Application-deployment-with-kasten-label.jpg?resize=300%2C184&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Application-deployment-with-kasten-label.jpg?ssl=1)

[![Kubectl apply yelb successful](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kubectl-apply-yelb-successful.jpg?resize=597%2C205&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kubectl-apply-yelb-successful.jpg?ssl=1)

Now if I go into my Kasten dashboard and run the protection policy, it will be successful capturing the components under the Yelb namespace, identified from the label.

[![Kasten policy backup successful](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kasten-policy-backup-successful.jpg?resize=604%2C356&ssl=1)](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/07/Kasten-policy-backup-successful.jpg?ssl=1)

I can also see the webhook failures for trying to create the application in my l[ogs on vRealize Log Insight Cloud](https://blogs.vmware.com/management/2020/06/configure-log-forwarding-from-vmware-tanzu-kubernetes-cluster-to-vrealize-log-insight-cloud.html), so these items can be captured centrally as well.

[![vRealize Log Insight - Tanzu - Gatekeeper audit log](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/vRealize-Log-Insight-Tanzu-Gatekeeper-audit-log.jpg?resize=604%2C304&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/07/vRealize-Log-Insight-Tanzu-Gatekeeper-audit-log.jpg?ssl=1)

###### Wrap Up

This was a simple idea to concept “how can we ensure Kasten is protecting our applications”. But hopefully it shows you some of the power of TMC custom policies, and you can also achieve the same outcome by running OPA on your Kubernetes cluster, however you don’t get the nice UI.

From a Kasten perspective, it ensures your developers are aligning resource deployments to match your backup selection policies as well.

Some resources you might find useful:

- Kasten
  - [Application Selections and Exemptions](https://docs.kasten.io/latest/usage/protect.html#application-selection-and-exceptions)
- Tanzu Mission Control Documentation:
  - Blog Series – [Getting started with Tanzu Missing Control](https://veducate.co.uk/vmware-tanzu-mission-control-getting-started/)
  - [Policy-Driven Cluster Management](https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-concepts/GUID-847414C9-EF54-44E5-BA62-C4895160CE1D.html)
  - 
[Creating Custom Policies](https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-1FF7A1E5-8456-4EF4-A532-9CF31BE88EAA.html)
- Open Policy Agent Documentation:
  - [OPA introduction](https://www.openpolicyagent.org/docs/latest/)
  - [Understanding OPA Policy Language](https://www.openpolicyagent.org/docs/latest/policy-language/)
  - [Rego Playground](https://play.openpolicyagent.org/)
<section>
<div>
<ul>
<li>Blogs:
<ul>
<li><a href="https://www.fugue.co/blog/5-tips-for-using-the-rego-language-for-open-policy-agent-opa"><span id="hs_cos_wrapper_name" data-hs-cos-general-type="meta_field" data-hs-cos-type="text">5 tips for using the Rego language for Open Policy Agent (OPA)</span></a></li>
<li><a href="https://www.magalix.com/blog/introducing-policy-as-code-the-open-policy-agent-opa"><span id="hs_cos_wrapper_name" data-hs-cos-general-type="meta_field" data-hs-cos-type="text">Introducing Policy As Code: The Open Policy Agent (OPA)</span></a></li>
<li>Blog Series – <a href="https://alesnosek.com/blog/2019/10/08/open-policy-agent-part-i-the-introduction/">Open Policy Agent, Part I — The Introduction</a>
</li>
<li><a href="https://www.kubermatic.com/blog/opa-rego-in-a-nutshell/">OPA Rego in a nutshell</a></li>
<li><a href="https://thenewstack.io/5-things-you-didnt-know-about-open-policy-agent/">5 Things You Didn’t Know About Open Policy Agent</a></li>
</ul>
</li>
</ul>
</div>
</section>

Regards

[Follow @Saintdle](https://twitter.com/saintdle)<script async="" src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

[Dean Lewis](https://uk.linkedin.com/in/saintdle?trk=profile-badge)

 

The post [Tanzu Mission Control – Using custom policies to ensure Kasten protects a deployed application](https://veducate.co.uk/tanzu-mission-control-custom-policy-kasten/) appeared first on [vEducate.co.uk](https://veducate.co.uk).