菜单
Production-ready policy template library: 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Production-grade Go CLI patterns, automated release workflows with Release Please, versioned docs, and coverage enforcement for DevSecOps build pipelines.
Design CLI commands that work independently and compose well for automation. Orchestrator pattern coordinates, subcommands execute discrete tasks.
Implement idiomatic Kubernetes operations with label selectors, strategic merge patches, and proper error handling for production-grade CLI tooling.
Choose the right Go CLI framework for Kubernetes-native tools. Decision matrix compares Cobra, urfave/cli, and Kong for ecosystem alignment and features.
Build Kubernetes-native CLIs in Go with type safety, testability, and complex orchestration logic for deployment tools and cluster automation.
Integrate Go CLIs with Kubernetes using client-go. Automatic config detection works on laptops, CI runners, and cluster pods with minimal RBAC setup.
| name | policy-as-code-template-library |
| description | Production-ready policy template library: 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration. |
48 production-ready policies for Kubernetes security and governance. Reduce the Rego learning curve. Copy, customize, deploy.
Template Library Overview
This library contains 28 Kyverno policies and 20 OPA/Gatekeeper constraint templates covering pod security, image validation, RBAC, resource governance, network security, mutation, and generation. Each template includes complete YAML/Rego, customization variables, validation commands, and real-world use cases.
Deploy in Audit Mode First
Always start with
audit(Kyverno) ordryrun(OPA) mode. Monitor violations for 48 hours before switching to enforcement. Existing workloads may violate policies.
See examples.md for detailed code examples.
See examples.md for detailed code examples.
Choose the right policy engine for your team:
| Feature | Kyverno | OPA/Gatekeeper |
|---|---|---|
| Policies | 28 (validation, mutation, generation) | 20 (validation only) |
| Language | YAML + JMESPath | Rego (Go-like DSL) |
| Learning Curve | < 1 hour | 4-8 hours |
| Best For | Kubernetes-native teams, fast adoption | Multi-platform policies, complex logic |
| Mutation | ✅ Native support | ❌ Validation only |
| Generation | ✅ Auto-create resources | ❌ Validation only |
See Decision Guide → for detailed comparison and recommended starter paths.
See examples.md for code examples.
See reference.md for complete documentation.
