[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVCDFR1RN74CA1W3VTACE5":3,"skill-same:01M6EVCDFR1RN74CA1W3VTACE5":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":83,"commitSha":84,"skillDirectory":85,"forksCount":14,"repositoryHtmlUrl":86,"repositoryHomepageUrl":87,"ownerHtmlUrl":88,"ownerBlogUrl":6,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6EVCDFR1RN74CA1W3VTACE5","implementing-policy-as-code-with-open-policy-agent",null,"This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"with","policy","as","open","implementing policy as code with open policy agent","code","Evaluation","CI\u002FCD","enforcement","t1195","controller","policy-as-code","testing","ci","opa","pr","secure","cybersecurity","devsecops","writing","2026-11-10 10:12:30",false,"---\nname: implementing-policy-as-code-with-open-policy-agent\ndescription: 'This skill covers implementing Open Policy Agent (OPA) and Gatekeeper\n  for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing\n  Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing\n  policies in development, and integrating policy evaluation into deployment pipelines.\n\n  '\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- opa\n- gatekeeper\n- policy-as-code\n- kubernetes\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1610\n- T1611\n---\n\n# Implementing Policy as Code with Open Policy Agent\n\n## When to Use\n\n- When enforcing organizational security policies across Kubernetes clusters programmatically\n- When requiring admission control that blocks non-compliant resources from being created\n- When implementing policy governance that can be version-controlled, tested, and audited\n- When standardizing security rules across multiple clusters and environments\n- When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI\u002FCD\n\n**Do not use** for vulnerability scanning (use Trivy\u002FCheckov), for runtime threat detection (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).\n\n## Prerequisites\n\n- Kubernetes cluster with admin access for Gatekeeper installation\n- Helm for Gatekeeper deployment\n- OPA CLI or conftest for local policy testing\n- Rego knowledge for policy authoring\n\n## Workflow\n\n### Step 1: Install OPA Gatekeeper\n\n```bash\n# Install Gatekeeper via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.writeToRAMDisk=true\n```\n\n### Step 2: Create Constraint Templates\n\n```yaml\n# templates\u002Fk8s-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n        violation[{\"msg\": msg}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n\n---\n# templates\u002Fk8s-container-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8scontainerlimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sContainerLimits\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            cpu:\n              type: string\n            memory:\n              type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8scontainerlimits\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n\n---\n# templates\u002Fk8s-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n### Step 3: Apply Constraints\n\n```yaml\n# constraints\u002Frequire-labels.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-labels\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n      - gatekeeper-system\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n      - \"cost-center\"\n\n---\n# constraints\u002Fblock-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"DaemonSet\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n```\n\n### Step 4: Test Policies with conftest\n\n```bash\n# Install conftest\nbrew install conftest\n\n# Test Kubernetes manifests against OPA policies locally\nconftest test deployment.yaml --policy policies\u002F --output json\n\n# Test Terraform against OPA policies\nconftest test terraform\u002Fmain.tf --policy policies\u002Fterraform\u002F --parser hcl2\n\n# Test Dockerfiles\nconftest test Dockerfile --policy policies\u002Fdocker\u002F\n```\n\n```rego\n# policies\u002Fkubernetes\u002Fdeny_latest_tag.rego\npackage kubernetes\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  endswith(container.image, \":latest\")\n  msg := sprintf(\"Container %v uses :latest tag. Pin to specific version.\", [container.name])\n}\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  not contains(container.image, \":\")\n  msg := sprintf(\"Container %v has no tag. Pin to specific version.\", [container.name])\n}\n```\n\n### Step 5: Integrate Policy Testing in CI\u002FCD\n\n```yaml\n# .github\u002Fworkflows\u002Fpolicy-test.yml\nname: Policy Validation\n\non:\n  pull_request:\n    paths: ['k8s\u002F**', 'terraform\u002F**', 'policies\u002F**']\n\njobs:\n  conftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install conftest\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fconftest\u002Freleases\u002Fdownload\u002Fv0.50.0\u002Fconftest_0.50.0_Linux_x86_64.tar.gz\n          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz\n          sudo mv conftest \u002Fusr\u002Flocal\u002Fbin\u002F\n      - name: Test K8s manifests\n        run: conftest test k8s\u002F**\u002F*.yaml --policy policies\u002Fkubernetes\u002F --output json\n      - name: Test Terraform\n        run: conftest test terraform\u002F*.tf --policy policies\u002Fterraform\u002F --parser hcl2\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OPA | Open Policy Agent — general-purpose policy engine using Rego language for policy decisions |\n| Rego | OPA's declarative query language for writing policy rules |\n| Gatekeeper | Kubernetes-native OPA integration implementing admission control via ConstraintTemplates |\n| ConstraintTemplate | CRD defining the Rego policy logic and parameters schema for a class of constraints |\n| Constraint | Instance of a ConstraintTemplate with specific parameters and scope (which resources to check) |\n| Admission Controller | Kubernetes component that intercepts API requests before persistence and can allow or deny them |\n| conftest | CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies |\n\n## Tools & Systems\n\n- **Open Policy Agent (OPA)**: General-purpose policy engine for unified policy enforcement\n- **Gatekeeper**: Kubernetes admission controller built on OPA with CRD-based configuration\n- **conftest**: Testing framework for OPA policies against configuration files\n- **Kyverno**: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)\n- **Styra DAS**: Commercial OPA management platform with policy authoring, testing, and distribution\n\n## Common Scenarios\n\n### Scenario: Enforcing Container Security Standards Across Clusters\n\n**Context**: Multiple development teams deploy to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.\n\n**Approach**:\n1. Deploy Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)\n2. Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag\n3. Start with `enforcementAction: warn` to identify violations without blocking deployments\n4. Notify teams of violations and provide a 2-week remediation window\n5. Switch to `enforcementAction: deny` after the remediation period\n6. Add `excludedNamespaces` for kube-system and monitoring namespaces\n\n**Pitfalls**: Deploying Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.\n\n## Output Format\n\n```\nOPA Policy Evaluation Report\n==============================\nCluster: production-east\nDate: 2026-02-23\nGatekeeper Version: 3.16.0\n\nCONSTRAINT SUMMARY:\n  K8sRequiredLabels:        12 violations (warn)\n  K8sBlockPrivileged:        0 violations (deny)\n  K8sContainerLimits:        8 violations (deny)\n  K8sBlockLatestTag:         3 violations (deny)\n\nBLOCKED DEPLOYMENTS (deny):\n  [K8sContainerLimits] deployment\u002Fapi-server in ns\u002Fpayments\n    - Container 'api' has no memory limit\n  [K8sBlockLatestTag] deployment\u002Ffrontend in ns\u002Fweb\n    - Container 'nginx' uses :latest tag\n\nAUDIT VIOLATIONS (warn):\n  [K8sRequiredLabels] namespace\u002Fstaging\n    - Missing labels: {cost-center}\n```\n","# Implementing Policy as Code with Open Policy Agent\n\n## When to Use\n\n- When enforcing organizational security policies across Kubernetes clusters programmatically\n- When requiring admission control that blocks non-compliant resources from being created\n- When implementing policy governance that can be version-controlled, tested, and audited\n- When standardizing security rules across multiple clusters and environments\n- When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI\u002FCD\n\n**Do not use** for vulnerability scanning (use Trivy\u002FCheckov), for runtime threat detection (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).\n\n## Prerequisites\n\n- Kubernetes cluster with admin access for Gatekeeper installation\n- Helm for Gatekeeper deployment\n- OPA CLI or conftest for local policy testing\n- Rego knowledge for policy authoring\n\n## Workflow\n\n### Step 1: Install OPA Gatekeeper\n\n```bash\n# Install Gatekeeper via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.writeToRAMDisk=true\n```\n\n### Step 2: Create Constraint Templates\n\n```yaml\n# templates\u002Fk8s-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n        violation[{\"msg\": msg}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n\n---\n# templates\u002Fk8s-container-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8scontainerlimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sContainerLimits\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            cpu:\n              type: string\n            memory:\n              type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8scontainerlimits\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n\n---\n# templates\u002Fk8s-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n### Step 3: Apply Constraints\n\n```yaml\n# constraints\u002Frequire-labels.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-labels\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n      - gatekeeper-system\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n      - \"cost-center\"\n\n---\n# constraints\u002Fblock-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"DaemonSet\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n```\n\n### Step 4: Test Policies with conftest\n\n```bash\n# Install conftest\nbrew install conftest\n\n# Test Kubernetes manifests against OPA policies locally\nconftest test deployment.yaml --policy policies\u002F --output json\n\n# Test Terraform against OPA policies\nconftest test terraform\u002Fmain.tf --policy policies\u002Fterraform\u002F --parser hcl2\n\n# Test Dockerfiles\nconftest test Dockerfile --policy policies\u002Fdocker\u002F\n```\n\n```rego\n# policies\u002Fkubernetes\u002Fdeny_latest_tag.rego\npackage kubernetes\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  endswith(container.image, \":latest\")\n  msg := sprintf(\"Container %v uses :latest tag. Pin to specific version.\", [container.name])\n}\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  not contains(container.image, \":\")\n  msg := sprintf(\"Container %v has no tag. Pin to specific version.\", [container.name])\n}\n```\n\n### Step 5: Integrate Policy Testing in CI\u002FCD\n\n```yaml\n# .github\u002Fworkflows\u002Fpolicy-test.yml\nname: Policy Validation\n\non:\n  pull_request:\n    paths: ['k8s\u002F**', 'terraform\u002F**', 'policies\u002F**']\n\njobs:\n  conftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install conftest\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fconftest\u002Freleases\u002Fdownload\u002Fv0.50.0\u002Fconftest_0.50.0_Linux_x86_64.tar.gz\n          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz\n          sudo mv conftest \u002Fusr\u002Flocal\u002Fbin\u002F\n      - name: Test K8s manifests\n        run: conftest test k8s\u002F**\u002F*.yaml --policy policies\u002Fkubernetes\u002F --output json\n      - name: Test Terraform\n        run: conftest test terraform\u002F*.tf --policy policies\u002Fterraform\u002F --parser hcl2\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OPA | Open Policy Agent — general-purpose policy engine using Rego language for policy decisions |\n| Rego | OPA's declarative query language for writing policy rules |\n| Gatekeeper | Kubernetes-native OPA integration implementing admission control via ConstraintTemplates |\n| ConstraintTemplate | CRD defining the Rego policy logic and parameters schema for a class of constraints |\n| Constraint | Instance of a ConstraintTemplate with specific parameters and scope (which resources to check) |\n| Admission Controller | Kubernetes component that intercepts API requests before persistence and can allow or deny them |\n| conftest | CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies |\n\n## Tools & Systems\n\n- **Open Policy Agent (OPA)**: General-purpose policy engine for unified policy enforcement\n- **Gatekeeper**: Kubernetes admission controller built on OPA with CRD-based configuration\n- **conftest**: Testing framework for OPA policies against configuration files\n- **Kyverno**: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)\n- **Styra DAS**: Commercial OPA management platform with policy authoring, testing, and distribution\n\n## Common Scenarios\n\n### Scenario: Enforcing Container Security Standards Across Clusters\n\n**Context**: Multiple development teams deploy to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.\n\n**Approach**:\n1. Deploy Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)\n2. Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag\n3. Start with `enforcementAction: warn` to identify violations without blocking deployments\n4. Notify teams of violations and provide a 2-week remediation window\n5. Switch to `enforcementAction: deny` after the remediation period\n6. Add `excludedNamespaces` for kube-system and monitoring namespaces\n\n**Pitfalls**: Deploying Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.\n\n## Output Format\n\n```\nOPA Policy Evaluation Report\n==============================\nCluster: production-east\nDate: 2026-02-23\nGatekeeper Version: 3.16.0\n\nCONSTRAINT SUMMARY:\n  K8sRequiredLabels:        12 violations (warn)\n  K8sBlockPrivileged:        0 violations (deny)\n  K8sContainerLimits:        8 violations (deny)\n  K8sBlockLatestTag:         3 violations (deny)\n\nBLOCKED DEPLOYMENTS (deny):\n  [K8sContainerLimits] deployment\u002Fapi-server in ns\u002Fpayments\n    - Container 'api' has no memory limit\n  [K8sBlockLatestTag] deployment\u002Ffrontend in ns\u002Fweb\n    - Container 'nginx' uses :latest tag\n\nAUDIT VIOLATIONS (warn):\n  [K8sRequiredLabels] namespace\u002Fstaging\n    - Missing labels: {cost-center}\n```\n",{"name":5,"tags":60,"author":65,"domain":52,"license":15,"version":66,"nist_csf":67,"subdomain":53,"description":72,"nist_ai_rmf":73,"mitre_attack":77},[53,61,49,62,46,63,64],"cicd","gatekeeper","kubernetes","secure-sdlc","mahipal","1.0.0",[68,69,70,71],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04","This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.\n",[74,75,76],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1",[78,79,80,81,82],"T1195","T1554","T1059.004","T1610","T1611","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-policy-as-code-with-open-policy-agent",{"tool":97,"command":98},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-policy-as-code-with-open-policy-agent",{"tool":100,"command":101},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-policy-as-code-with-open-policy-agent","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FSKILL.md",true,[105,111,116,122,126,130,136],{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"assets\u002Ftemplate.md","ASSET","资产文件",1833,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fassets\u002Ftemplate.md",{"path":112,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FLICENSE",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fapi-reference.md","REFERENCE","参考文档",4139,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fapi-reference.md",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fstandards.md",1177,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fstandards.md",{"path":127,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fworkflows.md",1911,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fworkflows.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",9534,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fprocess.py",5954,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fscripts\u002Fprocess.py",[141,179,188,197,219,245],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":160,"publishedAt":55},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[148,151,154,157],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":158,"categoryName":159,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000034","行政与办公人员",[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,35],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":180,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":55},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[183,184,185,186],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":158,"categoryName":159,"taxonomyType":32,"taxonomyTypeDesc":33},[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,35],{"skillNo":189,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":196,"publishedAt":55},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[192,193,194,195],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":158,"categoryName":159,"taxonomyType":32,"taxonomyTypeDesc":33},[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,35],{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":55},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[204,205,206,207,208,209,210,211,212,213,214,215,216,217,218],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":55},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[225],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,230,231,232,233,234,235,236,237,172,173,238,239,240,241,242,243,244],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":261,"publishedAt":55},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[251,254,257,258],{"categoryNo":252,"categoryName":253,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":255,"categoryName":256,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":259,"categoryName":260,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000036","内容创作者",[262,263,264,265,266,267,268,269,169,270,172,173,174,271,272,273,274,275,218,276],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]