Tag
7 items tagged Policy As Code.
Kyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.
Install Kyverno 1.19, write CEL-based ValidatingPolicy, MutatingPolicy and GeneratingPolicy resources for non-root pods, image tags, allowed registries and default-deny networking, and roll them out audit-first.
Static analysis for infrastructure as code: Terraform, CloudFormation, Kubernetes and Dockerfiles.
Kubernetes-native policy engine: validate, mutate, generate and verify images with YAML.
General-purpose policy engine using the Rego language.