Is Gatekeeper 3.X the right tool to implement policies such as image coming from Azure Container registry, not running as root

[navatweb]

We have to implement policies in K8s where the system must check that:

• the image for the microservice comes from Azure Container Repository.
• container does not run as root
• container is not privileged
• container not using host IPC or Network resources.
  I am thinking of using OPA based Gatekeeper using Gatekeeper versions 3.14 and later and assume I have to implement validating admission logic through a webhook.
  Is this the right approach?
  Are there examples that implement some of what I am looking for?
  Thanks

[ritazh]

Yes many of the policies you have listed can be found in this community Gatekeeper library https://open-policy-agent.github.io/gatekeeper-library/website/ PTAL and let us know if you have any questions.

[navatweb]

Thank you Rita. Found a few useful samples there. Thanks