[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HM9VE4J46BFCR4FJF447CS":3,"skill-same:01M6HM9VE4J46BFCR4FJF447CS":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":83,"commitSha":84,"skillDirectory":85,"forksCount":86,"repositoryHtmlUrl":87,"repositoryHomepageUrl":6,"ownerHtmlUrl":88,"ownerBlogUrl":6,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6HM9VE4J46BFCR4FJF447CS","implementing-policy-as-code-with-open-policy-agent",null,"This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"implementing","policy","policy as code","with","code","as","open","implementing policy as code with open policy agent","t1195","addresses","CI\u002FCD","enforcement","testing","controller","ci","opa","secure","cybersecurity","devsecops","writing","2026-11-10 10:12:30",false,"---\nname: implementing-policy-as-code-with-open-policy-agent\ndescription: This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing...\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- opa\n- gatekeeper\n- policy-as-code\n- kubernetes\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1610\n- T1611\ncategory: implementing-policy-as-code-with-open-policy-agent\n---\n# Implementing-Policy-As-Code-With-Open-Policy-Agent\n\n## Overview\nThis skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.\n\n\n\n# Implementing Policy as Code with Open Policy Agent\n\n## When to Use\n\n- When enforcing organizational security policies across Kubernetes clusters programmatically\n- When requiring admission control that blocks non-compliant resources from being created\n- When implementing policy governance that can be version-controlled, tested, and audited\n- When standardizing security rules across multiple clusters and environments\n- When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI\u002FCD\n\n**Do not use** for vulnerability scanning (use Trivy\u002FCheckov), for runtime threat detection (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).\n\n## Prerequisites\n\n- Kubernetes cluster with admin access for Gatekeeper installation\n- Helm for Gatekeeper deployment\n- OPA CLI or conftest for local policy testing\n- Rego knowledge for policy authoring\n\n## Workflow\n\n### Step 1: Install OPA Gatekeeper\n\n```bash\n# Install Gatekeeper via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.writeToRAMDisk=true\n```\n\n### Step 2: Create Constraint Templates\n\n```yaml\n# templates\u002Fk8s-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n        violation[{\"msg\": msg}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n\n---\n# templates\u002Fk8s-container-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8scontainerlimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sContainerLimits\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            cpu:\n              type: string\n            memory:\n              type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8scontainerlimits\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n\n---\n# templates\u002Fk8s-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n### Step 3: Apply Constraints\n\n```yaml\n# constraints\u002Frequire-labels.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-labels\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n      - gatekeeper-system\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n      - \"cost-center\"\n\n---\n# constraints\u002Fblock-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"DaemonSet\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n```\n\n### Step 4: Test Policies with conftest\n\n```bash\n# Install conftest\nbrew install conftest\n\n# Test Kubernetes manifests against OPA policies locally\nconftest test deployment.yaml --policy policies\u002F --output json\n\n# Test Terraform against OPA policies\nconftest test terraform\u002Fmain.tf --policy policies\u002Fterraform\u002F --parser hcl2\n\n# Test Dockerfiles\nconftest test Dockerfile --policy policies\u002Fdocker\u002F\n```\n\n```rego\n# policies\u002Fkubernetes\u002Fdeny_latest_tag.rego\npackage kubernetes\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  endswith(container.image, \":latest\")\n  msg := sprintf(\"Container %v uses :latest tag. Pin to specific version.\", [container.name])\n}\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  not contains(container.image, \":\")\n  msg := sprintf(\"Container %v has no tag. Pin to specific version.\", [container.name])\n}\n```\n\n### Step 5: Integrate Policy Testing in CI\u002FCD\n\n```yaml\n# .github\u002Fworkflows\u002Fpolicy-test.yml\nname: Policy Validation\n\non:\n  pull_request:\n    paths: ['k8s\u002F**', 'terraform\u002F**', 'policies\u002F**']\n\njobs:\n  conftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install conftest\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fconftest\u002Freleases\u002Fdownload\u002Fv0.50.0\u002Fconftest_0.50.0_Linux_x86_64.tar.gz\n          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz\n          sudo mv conftest \u002Fusr\u002Flocal\u002Fbin\u002F\n      - name: Test K8s manifests\n        run: conftest test k8s\u002F**\u002F*.yaml --policy policies\u002Fkubernetes\u002F --output json\n      - name: Test Terraform\n        run: conftest test terraform\u002F*.tf --policy policies\u002Fterraform\u002F --parser hcl2\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OPA | Open Policy Agent — general-purpose policy engine using Rego language for policy decisions |\n| Rego | OPA's declarative query language for writing policy rules |\n| Gatekeeper | Kubernetes-native OPA integration implementing admission control via ConstraintTemplates |\n| ConstraintTemplate | CRD defining the Rego policy logic and parameters schema for a class of constraints |\n| Constraint | Instance of a ConstraintTemplate with specific parameters and scope (which resources to check) |\n| Admission Controller | Kubernetes component that intercepts API requests before persistence and can allow or deny them |\n| conftest | CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies |\n\n## Tools & Systems\n\n- **Open Policy Agent (OPA)**: General-purpose policy engine for unified policy enforcement\n- **Gatekeeper**: Kubernetes admission controller built on OPA with CRD-based configuration\n- **conftest**: Testing framework for OPA policies against configuration files\n- **Kyverno**: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)\n- **Styra DAS**: Commercial OPA management platform with policy authoring, testing, and distribution\n\n## Common Scenarios\n\n### Scenario: Enforcing Container Security Standards Across Clusters\n\n**Context**: Multiple development teams deploy to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.\n\n**Approach**:\n1. Deploy Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)\n2. Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag\n3. Start with `enforcementAction: warn` to identify violations without blocking deployments\n4. Notify teams of violations and provide a 2-week remediation window\n5. Switch to `enforcementAction: deny` after the remediation period\n6. Add `excludedNamespaces` for kube-system and monitoring namespaces\n\n**Pitfalls**: Deploying Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.\n\n## Output Format\n\n```\nOPA Policy Evaluation Report\n==============================\nCluster: production-east\nDate: 2026-02-23\nGatekeeper Version: 3.16.0\n\nCONSTRAINT SUMMARY:\n  K8sRequiredLabels:        12 violations (warn)\n  K8sBlockPrivileged:        0 violations (deny)\n  K8sContainerLimits:        8 violations (deny)\n  K8sBlockLatestTag:         3 violations (deny)\n\nBLOCKED DEPLOYMENTS (deny):\n  [K8sContainerLimits] deployment\u002Fapi-server in ns\u002Fpayments\n    - Container 'api' has no memory limit\n  [K8sBlockLatestTag] deployment\u002Ffrontend in ns\u002Fweb\n    - Container 'nginx' uses :latest tag\n\nAUDIT VIOLATIONS (warn):\n  [K8sRequiredLabels] namespace\u002Fstaging\n    - Missing labels: {cost-center}\n```\n","# Implementing-Policy-As-Code-With-Open-Policy-Agent\n\n## Overview\nThis skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI\u002FCD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.\n\n\n\n# Implementing Policy as Code with Open Policy Agent\n\n## When to Use\n\n- When enforcing organizational security policies across Kubernetes clusters programmatically\n- When requiring admission control that blocks non-compliant resources from being created\n- When implementing policy governance that can be version-controlled, tested, and audited\n- When standardizing security rules across multiple clusters and environments\n- When needing a flexible policy engine that extends beyond Kubernetes to APIs and CI\u002FCD\n\n**Do not use** for vulnerability scanning (use Trivy\u002FCheckov), for runtime threat detection (use Falco), or for network policy enforcement (use Kubernetes NetworkPolicy or Calico).\n\n## Prerequisites\n\n- Kubernetes cluster with admin access for Gatekeeper installation\n- Helm for Gatekeeper deployment\n- OPA CLI or conftest for local policy testing\n- Rego knowledge for policy authoring\n\n## Workflow\n\n### Step 1: Install OPA Gatekeeper\n\n```bash\n# Install Gatekeeper via Helm\nhelm repo add gatekeeper https:\u002F\u002Fopen-policy-agent.github.io\u002Fgatekeeper\u002Fcharts\nhelm install gatekeeper gatekeeper\u002Fgatekeeper \\\n  --namespace gatekeeper-system --create-namespace \\\n  --set replicas=3 \\\n  --set audit.replicas=1 \\\n  --set audit.writeToRAMDisk=true\n```\n\n### Step 2: Create Constraint Templates\n\n```yaml\n# templates\u002Fk8s-required-labels.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n        violation[{\"msg\": msg}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"Missing required labels: %v\", [missing])\n        }\n\n---\n# templates\u002Fk8s-container-limits.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8scontainerlimits\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sContainerLimits\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            cpu:\n              type: string\n            memory:\n              type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8scontainerlimits\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.cpu\n          msg := sprintf(\"Container %v has no CPU limit\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          not container.resources.limits.memory\n          msg := sprintf(\"Container %v has no memory limit\", [container.name])\n        }\n\n---\n# templates\u002Fk8s-block-privileged.yaml\napiVersion: templates.gatekeeper.sh\u002Fv1\nkind: ConstraintTemplate\nmetadata:\n  name: k8sblockprivileged\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sBlockPrivileged\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8sblockprivileged\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.containers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged container not allowed: %v\", [container.name])\n        }\n        violation[{\"msg\": msg}] {\n          container := input.review.object.spec.initContainers[_]\n          container.securityContext.privileged == true\n          msg := sprintf(\"Privileged init container not allowed: %v\", [container.name])\n        }\n```\n\n### Step 3: Apply Constraints\n\n```yaml\n# constraints\u002Frequire-labels.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-team-labels\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Namespace\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n      - gatekeeper-system\n  parameters:\n    labels:\n      - \"team\"\n      - \"environment\"\n      - \"cost-center\"\n\n---\n# constraints\u002Fblock-privileged.yaml\napiVersion: constraints.gatekeeper.sh\u002Fv1beta1\nkind: K8sBlockPrivileged\nmetadata:\n  name: block-privileged-containers\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\", \"DaemonSet\", \"StatefulSet\"]\n    excludedNamespaces:\n      - kube-system\n```\n\n### Step 4: Test Policies with conftest\n\n```bash\n# Install conftest\nbrew install conftest\n\n# Test Kubernetes manifests against OPA policies locally\nconftest test deployment.yaml --policy policies\u002F --output json\n\n# Test Terraform against OPA policies\nconftest test terraform\u002Fmain.tf --policy policies\u002Fterraform\u002F --parser hcl2\n\n# Test Dockerfiles\nconftest test Dockerfile --policy policies\u002Fdocker\u002F\n```\n\n```rego\n# policies\u002Fkubernetes\u002Fdeny_latest_tag.rego\npackage kubernetes\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  endswith(container.image, \":latest\")\n  msg := sprintf(\"Container %v uses :latest tag. Pin to specific version.\", [container.name])\n}\n\ndeny[msg] {\n  input.kind == \"Deployment\"\n  container := input.spec.template.spec.containers[_]\n  not contains(container.image, \":\")\n  msg := sprintf(\"Container %v has no tag. Pin to specific version.\", [container.name])\n}\n```\n\n### Step 5: Integrate Policy Testing in CI\u002FCD\n\n```yaml\n# .github\u002Fworkflows\u002Fpolicy-test.yml\nname: Policy Validation\n\non:\n  pull_request:\n    paths: ['k8s\u002F**', 'terraform\u002F**', 'policies\u002F**']\n\njobs:\n  conftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: Install conftest\n        run: |\n          wget -q https:\u002F\u002Fgithub.com\u002Fopen-policy-agent\u002Fconftest\u002Freleases\u002Fdownload\u002Fv0.50.0\u002Fconftest_0.50.0_Linux_x86_64.tar.gz\n          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz\n          sudo mv conftest \u002Fusr\u002Flocal\u002Fbin\u002F\n      - name: Test K8s manifests\n        run: conftest test k8s\u002F**\u002F*.yaml --policy policies\u002Fkubernetes\u002F --output json\n      - name: Test Terraform\n        run: conftest test terraform\u002F*.tf --policy policies\u002Fterraform\u002F --parser hcl2\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OPA | Open Policy Agent — general-purpose policy engine using Rego language for policy decisions |\n| Rego | OPA's declarative query language for writing policy rules |\n| Gatekeeper | Kubernetes-native OPA integration implementing admission control via ConstraintTemplates |\n| ConstraintTemplate | CRD defining the Rego policy logic and parameters schema for a class of constraints |\n| Constraint | Instance of a ConstraintTemplate with specific parameters and scope (which resources to check) |\n| Admission Controller | Kubernetes component that intercepts API requests before persistence and can allow or deny them |\n| conftest | CLI tool for testing structured data (YAML, JSON, HCL) against OPA policies |\n\n## Tools & Systems\n\n- **Open Policy Agent (OPA)**: General-purpose policy engine for unified policy enforcement\n- **Gatekeeper**: Kubernetes admission controller built on OPA with CRD-based configuration\n- **conftest**: Testing framework for OPA policies against configuration files\n- **Kyverno**: Alternative Kubernetes policy engine using YAML-based policies (no Rego required)\n- **Styra DAS**: Commercial OPA management platform with policy authoring, testing, and distribution\n\n## Common Scenarios\n\n### Scenario: Enforcing Container Security Standards Across Clusters\n\n**Context**: Multiple development teams deploy to shared Kubernetes clusters. Some teams run privileged containers and images without resource limits, causing security and stability issues.\n\n**Approach**:\n1. Deploy Gatekeeper on all clusters via GitOps (Helm chart in a FluxCD repository)\n2. Create ConstraintTemplates for: no privileged containers, required resource limits, required labels, no latest tag\n3. Start with `enforcementAction: warn` to identify violations without blocking deployments\n4. Notify teams of violations and provide a 2-week remediation window\n5. Switch to `enforcementAction: deny` after the remediation period\n6. Add `excludedNamespaces` for kube-system and monitoring namespaces\n\n**Pitfalls**: Deploying Gatekeeper with deny mode immediately can break existing workloads. Always start with warn mode. Overly restrictive policies without exemptions for system namespaces can prevent cluster components from functioning.\n\n## Output Format\n\n```\nOPA Policy Evaluation Report\n==============================\nCluster: production-east\nDate: 2026-02-23\nGatekeeper Version: 3.16.0\n\nCONSTRAINT SUMMARY:\n  K8sRequiredLabels:        12 violations (warn)\n  K8sBlockPrivileged:        0 violations (deny)\n  K8sContainerLimits:        8 violations (deny)\n  K8sBlockLatestTag:         3 violations (deny)\n\nBLOCKED DEPLOYMENTS (deny):\n  [K8sContainerLimits] deployment\u002Fapi-server in ns\u002Fpayments\n    - Container 'api' has no memory limit\n  [K8sBlockLatestTag] deployment\u002Ffrontend in ns\u002Fweb\n    - Container 'nginx' uses :latest tag\n\nAUDIT VIOLATIONS (warn):\n  [K8sRequiredLabels] namespace\u002Fstaging\n    - Missing labels: {cost-center}\n```\n",{"name":5,"tags":60,"author":66,"domain":52,"license":15,"version":67,"category":5,"nist_csf":68,"subdomain":53,"description":7,"nist_ai_rmf":73,"mitre_attack":77},[53,61,50,62,63,64,65],"cicd","gatekeeper","policy-as-code","kubernetes","secure-sdlc","mahipal","1.0.0",[69,70,71,72],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04",[74,75,76],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1",[78,79,80,81,82],"T1195","T1554","T1059.004","T1610","T1611","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-policy-as-code-with-open-policy-agent",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-policy-as-code-with-open-policy-agent",{"tool":97,"command":98},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-policy-as-code-with-open-policy-agent",{"tool":100,"command":101},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-policy-as-code-with-open-policy-agent","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FSKILL.md",true,[105,111,116,122,126,130,136],{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"assets\u002Ftemplate.md","ASSET","资产文件",1833,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fassets\u002Ftemplate.md",{"path":112,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002FLICENSE",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fapi-reference.md","REFERENCE","参考文档",4139,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fapi-reference.md",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fstandards.md",1177,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fstandards.md",{"path":127,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fworkflows.md",1911,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Freferences\u002Fworkflows.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",9534,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fprocess.py",5954,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-policy-as-code-with-open-policy-agent\u002Fscripts\u002Fprocess.py",[141,167,192,215,231,252],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":55},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,150,151,152,153,47,52,154,155,156,157,158,159,160,161,162,163,164,165,166],"integrity","backup","recovery","validating backup integrity for recovery","for","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":55},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[174,175,176,177,38,52,178,179,180,181,182,183,184,185,186,187,188,189,190,191],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":55},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[199,200,164,52,201,202,203,160,161,204,205,206,207,208,209,210,211,212,213,214],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":221,"publishedAt":55},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[199,222,223,200,164,38,52,224,202,157,225,226,160,161,227,205,187,228,229,230],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":237,"publishedAt":55},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[199,238,239,240,241,242,52,243,244,245,202,246,160,247,248,249,208,250,164,251],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":258,"publishedAt":55},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[259,260,261,262,52,263,264,265,266,267,268,247,269,270,250,271,251,272,273,274],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]