Skip to content

Policy as code

First PublishedByAtif Alam

Policy as code moves guardrails out of tribal knowledge into versioned rules that run in CI, pre-deploy, and optionally at admission time. It complements Security scanning (SAST, SCA, container scans) by focusing on Kubernetes and cloud shape — labels, capabilities, ingress exposure, required annotations.

Where checks run

Section titled “Where checks run”
StageExamplesTradeoff
Pre-commit / localkubeconform, helm template | conftestFast feedback; may drift from cluster CRDs unless pinned
Pull requestOPA Conftest, Kyverno test, chart lintBlocks bad YAML before merge
Pre-sync / CDkubectl apply --dry-run=server in pipelineCatches CRD/schema issues against live API
AdmissionKyverno, GatekeeperStrongest enforcement; must tune timeouts and failurePolicy

Conftest and Rego (OPA)

Section titled “Conftest and Rego (OPA)”

Conftest evaluates Rego policies against arbitrary structured files (Kubernetes YAML, Terraform JSON plans, Dockerfile metadata).

Terminal window
conftest test deployment.yaml -p policy/

Keep policies small and composable; test fixtures live beside rules.

Kyverno in CI

Section titled “Kyverno in CI”

Kyverno can lint manifests with kyverno test using policy + resource fixtures — useful when your runtime enforcement engine is also Kyverno so the same rules run in CI and the cluster.

Schema validation

Section titled “Schema validation”
  • kubectl apply --dry-run=server — authoritative for what the API will accept (requires live cluster credentials in CI).
  • kubeconform — offline validation against OpenAPI schemas; pin Kubernetes version.

Signatures and supply chain

Section titled “Signatures and supply chain”

Pair policy checks with image signing (Cosign) and SBOM gates from the security scanning page — policy-as-code answers “is this manifest shaped correctly?” while signatures answer “is this artifact the one we built?”

Section titled “Related”