Implementing Policy as Code with Open Policy Agent

Ne Zaman Kullanılır

• enforcing yaparken organizational security policies across Kubernetes clusters programmatically
• requiring yaparken: admission control that blocks non-compliant resources from being created
• implementing yaparken policy governance that can be version-controlled, tested, and audited
• standardizing yaparken: security rules across multiple clusters and environments
• needing yaparken: a flexible policy engine that extends beyond Kubernetes to APIs and CI/CD

Kullanma: for vulnerability scanning (use Trivy/Checkov), for runtime threat Tespit (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).

Ön Gereksinimler

• Kubernetes cluster with admin access for Gatekeeper installation
• Helm for Gatekeeper Dağıt:ment
• OPA CLI or conftest for local policy testing
• Rego knowledge for policy authoring

İş Akışı

Adım 1: Install OPA Gatekeeper

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper \
  --namespace gatekeeper-system --create-namespace \
  --set replicas=3 \
  --set audit.replicas=1 \
  --set audit.writeToRAMDisk=true

Adım 2: Create Constraint Templates

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("Missing required labels: %v", [missing])
        }

---
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8scontainerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sContainerLimits
      validation:
        openAPIV3Schema:
          type: object
          properties:
            cpu:
              type: string
            memory:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerlimits
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := sprintf("Container %v has no CPU limit", [container.name])
        }
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := sprintf("Container %v has no memory limit", [container.name])
        }

---
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sblockprivileged
spec:
  crd:
    spec:
      names:
        kind: K8sBlockPrivileged
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sblockprivileged
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged container not allowed: %v", [container.name])
        }
        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged init container not allowed: %v", [container.name])
        }

Adım 3: Apply Constraints

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-labels
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
      - apiGroups: ["apps"]
        kinds: ["Dağıt:ment", "StatefulSet"]
    excludedNamespaces:
      - kube-system
      - gatekeeper-system
  parameters:
    labels:
      - "team"
      - "environment"
      - "cost-center"

---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
  name: block-privileged-containers
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: ["apps"]
        kinds: ["Dağıt:ment", "DaemonSet", "StatefulSet"]
    excludedNamespaces:
      - kube-system

Adım 4: Test Policies with conftest

brew install conftest

conftest test Dağıt:ment.yaml --policy policies/ --output json

conftest test terraform/main.tf --policy policies/terraform/ --parser hcl2

conftest test Dockerfile --policy policies/docker/

package kubernetes

deny[msg] {
  input.kind == "Dağıt:ment"
  container := input.spec.template.spec.containers[_]
  endswith(container.image, ":latest")
  msg := sprintf("Container %v uses :latest tag. Pin to specific version.", [container.name])
}

deny[msg] {
  input.kind == "Dağıt:ment"
  container := input.spec.template.spec.containers[_]
  not contains(container.image, ":")
  msg := sprintf("Container %v has no tag. Pin to specific version.", [container.name])
}

Adım 5: Integrate Policy Testing in CI/CD

name: Policy Validation

on:
  pull_request:
    paths: ['k8s/**', 'terraform/**', 'policies/**']

jobs:
  conftest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install conftest
        run: |
          wget -q https://github.com/open-policy-agent/conftest/releases/download/v0.50.0/conftest_0.50.0_Linux_x86_64.tar.gz
          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz
          sudo mv conftest /usr/local/bin/
      - name: Test K8s manifests
        run: conftest test k8s/**/*.yaml --policy policies/kubernetes/ --output json
      - name: Test Terraform
        run: conftest test terraform/*.tf --policy policies/terraform/ --parser hcl2

Key Concepts

Term	Definition
OPA	Open Policy Agent — general-purpose policy engine using Rego language for policy decisions
Rego	OPA's declarative query language for writing policy rules
Gatekeeper	Kubernetes-native OPA integration implementing admission control via ConstraintTemplates
ConstraintTemplate	CRD defining the Rego policy logic and parameters schema for a class of constraints
Constraint	Instance of a ConstraintTemplate with specific parameters and scope (which resources to check)
Admission Controller	Kubernetes component that intercepts API requests before persistence and can allow or deny them
conftest	CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies

Tools & Systems

• Open Policy Agent (OPA): General-purpose policy engine for unified policy enforcement
• Gatekeeper: Kubernetes admission controller built on OPA with CRD-based configuration
• conftest: Testing framework for OPA policies against configuration files
• Kyverno: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)
• Styra DAS: Commercial OPA management platform with policy authoring, testing, and distribution

Common Scenarios

Scenario: Enforcing Container Security Standards Across Clusters

Context: Multiple development teams Dağıt: to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.

Approach:

1. Dağıt: Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)
2. Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag
3. Start with enforcementAction: warn to identify violations without blocking Dağıt:ments
4. Notify teams of violations and provide a 2-week remediation window
5. Switch to enforcementAction: deny after the remediation period
6. Add excludedNamespaces for kube-system and monitoring namespaces

Pitfalls: Dağıt:ing Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.

Output Format

OPA Policy Evaluation Report
==============================
Cluster: production-east
Date: 2026-02-23
Gatekeeper Version: 3.16.0

CONSTRAINT SUMMARY:
  K8sRequiredLabels:        12 violations (warn)
  K8sBlockPrivileged:        0 violations (deny)
  K8sContainerLimits:        8 violations (deny)
  K8sBlockLatestTag:         3 violations (deny)

BLOCKED Dağıt:MENTS (deny):
  [K8sContainerLimits] Dağıt:ment/api-server in ns/payments
    - Container 'api' has no memory limit
  [K8sBlockLatestTag] Dağıt:ment/frontend in ns/web
    - Container 'nginx' uses :latest tag

AUDIT VIOLATIONS (warn):
  [K8sRequiredLabels] namespace/staging
    - Missing labels: {cost-center}

<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: b183e80646a28fdf -->