CKS Minimize Microservice Vulnerabilities Practice Question
A security team wants to use OPA/Gatekeeper to enforce that all namespaces must have a label 'security-tier' with value 'high' or 'medium'. What is the correct approach?
⚠ Common exam trap
The key distinction in OPA/Gatekeeper is between mutation (MutatingWebhookConfiguration) and validation (ValidatingWebhookConfiguration), and that policies must be defined via ConstraintTemplates and Constraints, not embedded directly in webhook configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a ConstraintTemplate with Rego that denies namespaces missing the label, then create a Constraint referencing that template.
OPA/Gatekeeper enforces policies via a two-part model: a ConstraintTemplate defines the Rego logic (e.g., denying a namespace if it lacks the required label), and a Constraint instantiates that template with specific parameters (e.g., 'security-tier' with values 'high' or 'medium'). This decouples policy definition from enforcement, allowing Gatekeeper's admission webhook to reject non-compliant resources at creation or update time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Write a MutatingWebhookConfiguration that adds the label automatically.
Why it's wrong here
A MutatingWebhookConfiguration would automatically add the missing label to namespaces instead of rejecting them. Gatekeeper, when enforcing a required-label policy, is conventionally used in validating mode to deny non-compliant resources; mutating would silently alter user intent and hide configuration drift. Moreover, a raw webhook configuration bypasses Gatekeeper's ConstraintTemplate and Constraint abstraction, so it does not fit the requested OPA Gatekeeper pattern.
- ✗
Use kubectl label command with a --validate flag.
Why it's wrong here
kubectl label --validate does not exist as a policy-enforcement mechanism; the --validate flag in kubectl performs client-side schema validation, not admission control. Labels are user-defined fields, so no built-in kubectl validation can require a specific label on a namespace. Enforcement must happen at the API server through an admission controller such as OPA Gatekeeper, which can intercept and deny creation requests before the object is persisted.
- ✗
Create a ValidatingWebhookConfiguration that directly contains the Rego policy.
Why it's wrong here
A ValidatingWebhookConfiguration points to an HTTPS webhook endpoint, but it does not natively embed a Rego policy. Gatekeeper itself registers a validating webhook and then uses its own custom resources—ConstraintTemplate and Constraint—to install and execute Rego policies. Directly placing Rego in a ValidatingWebhookConfiguration is not supported and would require a separate custom webhook server, defeating the purpose of using OPA Gatekeeper.
- ✓
Create a ConstraintTemplate with Rego that denies namespaces missing the label, then create a Constraint referencing that template.
Why this is correct
This is the canonical OPA Gatekeeper workflow. A ConstraintTemplate defines a reusable Rego policy (e.g., detecting a missing required label) and specifies the target resource kind, such as namespaces. A Constraint then instantiates that template, setting the required label parameter and enforcing it against all namespaces. When a label-less namespace creation is attempted, the Gatekeeper admission webhook evaluates the Rego and rejects it, satisfying the 'deny namespaces missing the label' requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.