opa-policies
Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.
ソース情報
- リポジトリ
- sawrus/agent-guides
- ソースの最終更新活動
- 2026年3月8日 17:48
- 検出された SKILL.md の言語
- 英語
- スター
- 18
- フォーク
- 4
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- opa-policies
- type
- skill
- description
- Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.
- related-rules
- ["policy-as-code.md","container-security.md"]
- allowed-tools
- Read, Write, Edit, Bash
# Skill: OPA Policies & Kyverno
> **Expertise:** Gatekeeper ConstraintTemplates, Kyverno ClusterPolicies, validation + mutation + generation.
## When to load
When writing admission policies, testing policy changes, or debugging policy-blocked deployments.
## Gatekeeper: ConstraintTemplate + Constraint
```yaml
# 1. ConstraintTemplate — defines the policy logic in Rego
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequirenonroot
spec:
crd:
spec:
names: { kind: K8sRequireNonRoot }
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequirenonroot
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not container.securityContext.runAsNonRoot
msg := sprintf("Container '%v' must set runAsNonRoot: true", [container.name])
}
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
container.securityContext.runAsUser == 0
msg := sprintf("Container '%v' must not run as UID 0", [container.name])
}
---
# 2. Constraint — applies the template to specific resources/namespaces
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireNonRoot
metadata:
name: require-non-root-production
spec:
enforcementAction: deny # deny | warn | dryrun
match:
kinds:
- apiGroups: [apps]
kinds: [Deployment, StatefulSet, DaemonSet]
namespaceSelector:
matchExpressions:
- key: environment
operator: In
values: [production, staging]
```
## Gatekeeper: Require Image Digest
```yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequireimagedigest
spec:
crd:
spec:
names: { kind: K8sRequireImageDigest }
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequireimagedigest
violation[{"msg": msg}] {
container := input.review.object.spec.containers[_]
not contains(container.image, "@sha256:")
msg := sprintf(
"Container '%v' image '%v' must reference a digest (@sha256:...), not a mutable tag",
[container.name, container.image]
)
}
```
## Kyverno: Simpler YAML Policies
```yaml
# Disallow privileged containers (Kyverno)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-privileged-containers
spec:
validationFailureAction: Enforce
rules:
- name: check-privileged
match:
any:
- resources:
kinds: [Pod]
namespaces: [production, staging]
validate:
message: "Privileged containers are not allowed in production/staging"
pattern:
spec:
containers:
- =(securityContext):
=(privileged): "false"
```
```yaml
# Kyverno MUTATION — auto-add security context defaults
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-default-securitycontext
spec:
rules:
- name: add-security-context
match:
any:
- resources: { kinds: [Pod] }
mutate:
patchStrategicMerge:
spec:
containers:
- (name): "*"
securityContext:
+(runAsNonRoot): true
+(allowPrivilegeEscalation): false
+(readOnlyRootFilesystem): true
```
## Policy Testing
```bash
# OPA unit tests
cat > policies/test_nonroot.rego << 'REGO'
package k8srequirenonroot
test_deny_root_container {
violation[{"msg": _}] with input as {
"review": {"object": {"spec": {"containers": [
{"name": "app", "securityContext": {"runAsUser": 0}}
]}}}
}
}
test_allow_nonroot_container {
count(violation) == 0 with input as {
"review": {"object": {"spec": {"containers": [
{"name": "app", "securityContext": {"runAsNonRoot": true, "runAsUser": 1000}}
]}}}
}
}
REGO
opa test policies/ -v
# Kyverno test with example manifests
kyverno test . \
--test-case-selector "policy=disallow-privileged-containers"
# Check which policies blocked a recent admission
kubectl get events -n <ns> | grep "denied\|violated"
```
## Debugging Policy Denials
```bash
# See why a deployment was rejected
kubectl describe deploy <n> -n <ns>
# Look at Events section for: "admission webhook ... denied"
# Check active constraints
kubectl get constraints
# Check constraint violations (audit mode)
kubectl get k8srequirenonroot.constraints.gatekeeper.sh -o jsonpath='{.items[*].status.violations}'
```
GitHubで見る