OPA Gatekeeper GreenOps Sustainability

OPA Gatekeeper GreenOps

OPA Gatekeeper GreenOps Sustainability Policy Kubernetes Admission Controller Rego ConstraintTemplate Resource Limits Carbon Tracking

Policy Implementation

# === OPA Gatekeeper GreenOps Policies ===

# ConstraintTemplate: Require Resource Limits
# apiVersion: templates.gatekeeper.sh/v1
# kind: ConstraintTemplate
# metadata:
#   name: k8srequiredresourcelimits
# spec:
#   crd:
#     spec:
#       names:
#         kind: K8sRequiredResourceLimits
#       validation:
#         openAPIV3Schema:
#           type: object
#           properties:
#             maxCPU:
#               type: string
#             maxMemory:
#               type: string
#   targets:
#     - target: admission.k8s.gatekeeper.sh
#       rego: |
#         package k8srequiredresourcelimits
#         violation[{"msg": msg}] {
#           container := input.review.object.spec.containers[_]
#           not container.resources.limits
#           msg := sprintf("Container '%v' must have resource limits", [container.name])
#         }
#         violation[{"msg": msg}] {
#           container := input.review.object.spec.containers[_]
#           cpu := container.resources.limits.cpu
#           max_cpu := input.parameters.maxCPU
#           cpu > max_cpu
#           msg := sprintf("Container '%v' CPU limit %v exceeds max %v", [container.name, cpu, max_cpu])
#         }

# Constraint: Apply to production namespace
# apiVersion: constraints.gatekeeper.sh/v1beta1
# kind: K8sRequiredResourceLimits
# metadata:
#   name: require-limits-production
# spec:
#   enforcementAction: deny
#   match:
#     kinds:
#       - apiGroups: [""]
#         kinds: ["Pod"]
#       - apiGroups: ["apps"]
#         kinds: ["Deployment", "StatefulSet"]
#     namespaces: ["production", "staging"]
#   parameters:
#     maxCPU: "2"
#     maxMemory: "4Gi"

from dataclasses import dataclass

@dataclass
class GreenOpsPolicy:
    name: str
    rego_check: str
    parameters: str
    enforcement: str
    green_impact: str

policies = [
    GreenOpsPolicy("Require Resource Limits",
        "not container.resources.limits → violation",
        "maxCPU: 2, maxMemory: 4Gi",
        "deny (production), warn (dev)",
        "ลด Over-provisioning 30-50%"),
    GreenOpsPolicy("Require Resource Requests",
        "not container.resources.requests → violation",
        "minCPU: 100m, minMemory: 128Mi",
        "deny",
        "Scheduler จัดวาง Pod ได้ดีขึ้น"),
    GreenOpsPolicy("Image Size Limit",
        "image_size > maxSize → violation",
        "maxSize: 500MB",
        "deny (production), audit (dev)",
        "ลด Storage 40-60%, Pull Time ลด"),
    GreenOpsPolicy("No Latest Tag",
        "container.image endsWith ':latest' → violation",
        "-",
        "deny",
        "ป้องกัน Unexpected Image Change"),
    GreenOpsPolicy("Namespace ResourceQuota",
        "not exists ResourceQuota in NS → violation",
        "requiredQuotas: [cpu, memory, pods]",
        "deny",
        "จำกัด Resource ทั้ง Namespace"),
    GreenOpsPolicy("Prefer ARM Nodes",
        "not nodeSelector['arch'] == 'arm64' → warn",
        "-",
        "warn (แนะนำ ไม่บังคับ)",
        "ARM ใช้พลังงานน้อยกว่า x86 30-40%"),
]

print("=== GreenOps Policies ===")
for p in policies:
    print(f"\n  [{p.name}]")
    print(f"    Check: {p.rego_check}")
    print(f"    Params: {p.parameters}")
    print(f"    Enforce: {p.enforcement}")
    print(f"    Impact: {p.green_impact}")

Deployment & Testing

# === Gatekeeper Deployment & Policy Testing ===

# Install Gatekeeper
# helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
# helm install gatekeeper gatekeeper/gatekeeper \
#   --namespace gatekeeper-system \
#   --create-namespace \
#   --set replicas=3 \
#   --set audit.replicas=1 \
#   --set audit.interval=60

# Test Policy - This should be REJECTED
# kubectl apply -f - <

# === GreenOps Metrics Dashboard ===

@dataclass
class GreenMetric:
    metric: str
    formula: str
    target: str
    dashboard: str

metrics = [
    GreenMetric("Resource Efficiency",
        "Actual CPU Used / CPU Requested × 100",
        "60-80% (ไม่ Over-provision)",
        "Prometheus: container_cpu_usage / kube_pod_resource_request"),
    GreenMetric("Policy Compliance Rate",
        "Passed Resources / Total Resources × 100",
        "> 95% (production), > 80% (dev)",
        "Gatekeeper Audit Status → Grafana"),
    GreenMetric("Over-provisioning Rate",
        "Resources where Request > 2× Used / Total",
        "< 10%",
        "VPA Recommendations → Dashboard"),
    GreenMetric("Watt per Pod",
        "Node Power / Pod Count",
        "ลด 10% ต่อ Quarter",
        "Kepler (Kubernetes Energy Metrics)"),
    GreenMetric("CO2 per Namespace",
        "Namespace kWh × Carbon Factor",
        "ลด 15% ต่อปี",
        "Kepler + Cloud Carbon Footprint"),
    GreenMetric("Image Size Average",
        "Sum(Image Size) / Image Count",
        "< 200MB Average",
        "Container Registry Metrics"),
]

print("=== GreenOps Metrics ===")
for m in metrics:
    print(f"  [{m.metric}]")
    print(f"    Formula: {m.formula}")
    print(f"    Target: {m.target}")
    print(f"    Dashboard: {m.dashboard}")