This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.
This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.
Implementing Policy as Code with Open Policy Agent
When to Use
When enforcing organizational security policies across Kubernetes clusters programmatically
When requiring admission control that blocks non-compliant resources from being created
When implementing policy governance that can be version-controlled, tested, and audited
When standardizing security rules across multiple clusters and environments
When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI/CD
Do not use for vulnerability scanning (use Trivy/Checkov), for runtime threat detection (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).
Prerequisites
Kubernetes cluster with admin access for Gatekeeper installation
Open Policy Agent — general-purpose policy engine using Rego language for policy decisions
Rego
OPA's declarative query language for writing policy rules
Gatekeeper
Kubernetes-native OPA integration implementing admission control via ConstraintTemplates
ConstraintTemplate
CRD defining the Rego policy logic and parameters schema for a class of constraints
Constraint
Instance of a ConstraintTemplate with specific parameters and scope (which resources to check)
Admission Controller
Kubernetes component that intercepts API requests before persistence and can allow or deny them
conftest
CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies
Tools & Systems
Open Policy Agent (OPA): General-purpose policy engine for unified policy enforcement
Gatekeeper: Kubernetes admission controller built on OPA with CRD-based configuration
conftest: Testing framework for OPA policies against configuration files
Kyverno: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)
Styra DAS: Commercial OPA management platform with policy authoring, testing, and distribution
Common Scenarios
Scenario: Enforcing Container Security Standards Across Clusters
Context: Multiple development teams deploy to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.
Approach:
Deploy Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)
Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag
Start with enforcementAction: warn to identify violations without blocking deployments
Notify teams of violations and provide a 2-week remediation window
Switch to enforcementAction: deny after the remediation period
Add excludedNamespaces for kube-system and monitoring namespaces
Pitfalls: Deploying Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.
