opa-policies
Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.
Informations de source
- Dépôt
- sawrus/agent-guides
- Dernière activité de la source
- 8 mars 2026 à 17:48
- Langue détectée de SKILL.md
- anglais
- Étoiles
- 18
- Forks
- 4
Options d'installation
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Vérifiez les fichiers source
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Affichage de SKILL.md
SKILL.md
Instructions source · Aperçu en lecture seule- name
- opa-policies
- type
- skill
- description
- Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.
- related-rules
- ["policy-as-code.md","container-security.md"]
- allowed-tools
- Read, Write, Edit, Bash
# Skill: OPA Policies & Kyverno
> **Expertise:** Gatekeeper ConstraintTemplates, Kyverno ClusterPolicies, validation + mutation + generation.
## When to load
When writing admission policies, testing policy changes, or debugging policy-blocked deployments.
## Gatekeeper: ConstraintTemplate + Constraint
```yaml
# 1. ConstraintTemplate — defines the policy logic in Rego
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequirenonroot
spec:
crd:
spec:
names: { kind: K8sRequireNonRoot }
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequirenonroot
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not container.securityContext.runAsNonRoot
msg := sprintf("Container '%v' must set runAsNonRoot: true", [container.name])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
container.securityContext.runAsUser == 0
msg := sprintf("Container '%v' must not run as UID 0", [container.name])
}
---
# 2. Constraint — applies the template to specific resources/namespaces
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireNonRoot
metadata:
name: require-non-root-production
spec:
enforcementAction: deny # deny | warn | dryrun
match:
kinds:
- apiGroups: [apps]
kinds: [Deployment, StatefulSet, DaemonSet]
namespaceSelector:
matchExpressions:
- key: environment
operator: In
values: [production, staging]
```
## Gatekeeper: Require Image Digest
```yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequireimagedigest
spec:
crd:
spec:
names: { kind: K8sRequireImageDigest }
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequireimagedigest
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not contains(container.image, "@sha256:")
msg := sprintf(
"Container '%v' image '%v' must reference a digest (@sha256:...), not a mutable tag",
[container.name, container.image]
)
}
```
## Kyverno: Simpler YAML Policies
```yaml
# Disallow privileged containers (Kyverno)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-privileged-containers
spec:
validationFailureAction: Enforce
rules:
- name: check-privileged
match:
any:
- resources:
kinds: [Pod]
namespaces: [production, staging]
validate:
message: "Privileged containers are not allowed in production/staging"
pattern:
spec:
containers:
- =(securityContext):
=(privileged): "false"
```
```yaml
# Kyverno MUTATION — auto-add security context defaults
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-default-securitycontext
spec:
rules:
- name: add-security-context
match:
any:
- resources: { kinds: [Pod] }
mutate:
patchStrategicMerge:
spec:
containers:
- (name): "*"
securityContext:
+(runAsNonRoot): true
+(allowPrivilegeEscalation): false
+(readOnlyRootFilesystem): true
```
## Policy Testing
```bash
# OPA unit tests
cat > policies/test_nonroot.rego << 'REGO'
package k8srequirenonroot
test_deny_root_container {
violation[{"msg": _}] with input as {
"review": {"object": {"spec": {"containers": [
{"name": "app", "securityContext": {"runAsUser": 0}}
]}}}
}
}
test_allow_nonroot_container {
count(violation) == 0 with input as {
"review": {"object": {"spec": {"containers": [
{"name": "app", "securityContext": {"runAsNonRoot": true, "runAsUser": 1000}}
]}}}
}
}
REGO
opa test policies/ -v
# Kyverno test with example manifests
kyverno test . \
--test-case-selector "policy=disallow-privileged-containers"
# Check which policies blocked a recent admission
kubectl get events -n <ns> | grep "denied\|violated"
```
## Debugging Policy Denials
```bash
# See why a deployment was rejected
kubectl describe deploy <n> -n <ns>
# Look at Events section for: "admission webhook ... denied"
# Check active constraints
kubectl get constraints
# Check constraint violations (audit mode)
kubectl get k8srequirenonroot.constraints.gatekeeper.sh -o jsonpath='{.items[*].status.violations}'
```
Voir sur GitHub