[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PBSDYEC42FARPW9SWH6F81":3,"skill-same:01M6PBSDYEC42FARPW9SWH6F81":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":30,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":40,"commitSha":66,"skillDirectory":67,"forksCount":13,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":70,"install":71,"resources":84},"01M6PBSDYEC42FARPW9SWH6F81","policy-as-code",null,"Implement policy as code with OPA, Sentinel, and Kyverno. Automate policy enforcement in CI\u002FCD and infrastructure. Use when enforcing compliance through automation.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fpolicy-as-code\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"policy as code","code","as","policy","agent-skills","apply","with","kyverno","controls","main","community","enforcement","use","devops-security","ci","license","opa","change","automation","implement","2026-11-10 10:12:30",false,"---\nname: policy-as-code\ndescription: Implement policy as code with OPA, Sentinel, and Kyverno. Automate policy\n  enforcement in CI\u002FCD and infrastructure. Use when enforcing compliance through automation.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Policy as Code\n\nAutomate policy enforcement through code using OPA\u002FRego, Kyverno, Checkov, and CI\u002FCD integration to prevent compliance violations before they reach production.\n\n## Open Policy Agent (OPA) Rego Policies\n\n```rego\n# deny_public_s3.rego - Deny S3 buckets with public access\npackage terraform.aws.s3\n\nimport rego.v1\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    resource.change.after.acl == \"public-read\"\n    msg := sprintf(\n        \"S3 bucket '%s' has public-read ACL. All buckets must be private. [Policy: no-public-s3]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    resource.change.after.acl == \"public-read-write\"\n    msg := sprintf(\n        \"S3 bucket '%s' has public-read-write ACL. This is strictly prohibited. [Policy: no-public-s3]\",\n        [resource.address]\n    )\n}\n```\n\n```rego\n# require_encryption.rego - Require encryption on data stores\npackage terraform.aws.encryption\n\nimport rego.v1\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_db_instance\"\n    not resource.change.after.storage_encrypted\n    msg := sprintf(\n        \"RDS instance '%s' does not have storage encryption enabled. [Policy: require-rds-encryption]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_ebs_volume\"\n    not resource.change.after.encrypted\n    msg := sprintf(\n        \"EBS volume '%s' is not encrypted. [Policy: require-ebs-encryption]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    not has_encryption(resource)\n    msg := sprintf(\n        \"S3 bucket '%s' does not have default encryption configured. [Policy: require-s3-encryption]\",\n        [resource.address]\n    )\n}\n\nhas_encryption(resource) if {\n    resource.change.after.server_side_encryption_configuration[_]\n}\n```\n\n```rego\n# require_tags.rego - Enforce mandatory tagging\npackage terraform.aws.tags\n\nimport rego.v1\n\nrequired_tags := {\"Environment\", \"Owner\", \"CostCenter\", \"DataClassification\"}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    tags := object.get(resource.change.after, \"tags\", {})\n    missing := required_tags - {key | tags[key]}\n    count(missing) > 0\n    msg := sprintf(\n        \"Resource '%s' is missing required tags: %v. [Policy: required-tags]\",\n        [resource.address, missing]\n    )\n}\n```\n\n```rego\n# restrict_regions.rego - Limit resource deployment to approved regions\npackage terraform.aws.regions\n\nimport rego.v1\n\napproved_regions := {\"us-east-1\", \"us-west-2\", \"eu-west-1\"}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    provider_config := input.configuration.provider_config.aws\n    region := provider_config.expressions.region.constant_value\n    not region in approved_regions\n    msg := sprintf(\n        \"Resource '%s' is in region '%s'. Approved regions: %v. [Policy: approved-regions]\",\n        [resource.address, region, approved_regions]\n    )\n}\n```\n\n```bash\n# Evaluate OPA policies against Terraform plan\nterraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\n\n# Run OPA evaluation\nopa eval \\\n  --data policies\u002F \\\n  --input tfplan.json \\\n  \"data.terraform.aws.s3.deny\" \\\n  --format pretty\n\n# Use conftest for easier CI integration\nconftest test tfplan.json --policy policies\u002F --output table\n```\n\n## Kyverno Kubernetes Policies\n\n```yaml\n# require-labels.yaml - Enforce required labels on all pods\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-labels\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Labels\n    policies.kyverno.io\u002Fcategory: Best Practices\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: check-required-labels\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: >-\n        Labels 'app.kubernetes.io\u002Fname', 'app.kubernetes.io\u002Fversion',\n        and 'team' are required on all Pods.\n      pattern:\n        metadata:\n          labels:\n            app.kubernetes.io\u002Fname: \"?*\"\n            app.kubernetes.io\u002Fversion: \"?*\"\n            team: \"?*\"\n---\n# disallow-privileged.yaml - Block privileged containers\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: disallow-privileged-containers\n  annotations:\n    policies.kyverno.io\u002Ftitle: Disallow Privileged Containers\n    policies.kyverno.io\u002Fcategory: Pod Security\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: deny-privileged\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"Privileged containers are not allowed.\"\n      pattern:\n        spec:\n          containers:\n          - securityContext:\n              privileged: \"false\"\n          =(initContainers):\n          - securityContext:\n              privileged: \"false\"\n---\n# require-resource-limits.yaml - Enforce resource limits\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-resource-limits\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Resource Limits\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: check-resource-limits\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"All containers must have CPU and memory limits defined.\"\n      pattern:\n        spec:\n          containers:\n          - resources:\n              limits:\n                memory: \"?*\"\n                cpu: \"?*\"\n---\n# disallow-latest-tag.yaml - Block usage of 'latest' image tag\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: disallow-latest-tag\n  annotations:\n    policies.kyverno.io\u002Ftitle: Disallow Latest Tag\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: validate-image-tag\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"Images must use a specific tag, not 'latest'.\"\n      pattern:\n        spec:\n          containers:\n          - image: \"!*:latest & *:*\"\n---\n# restrict-image-registries.yaml - Allow only approved registries\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: restrict-image-registries\n  annotations:\n    policies.kyverno.io\u002Ftitle: Restrict Image Registries\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: validate-registries\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: >-\n        Images must come from approved registries:\n        123456789012.dkr.ecr.us-east-1.amazonaws.com or ghcr.io\u002Fyour-org.\n      pattern:\n        spec:\n          containers:\n          - image: \"123456789012.dkr.ecr.*.amazonaws.com\u002F* | ghcr.io\u002Fyour-org\u002F*\"\n---\n# require-networkpolicy.yaml - Ensure namespaces have NetworkPolicies\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-networkpolicy\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Network Policy\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Audit\n  background: true\n  rules:\n  - name: check-networkpolicy\n    match:\n      any:\n      - resources:\n          kinds:\n          - Deployment\n    preconditions:\n      all:\n      - key: \"{{request.object.metadata.namespace}}\"\n        operator: NotIn\n        value: [\"kube-system\", \"kube-public\"]\n    validate:\n      message: \"A NetworkPolicy must exist in namespace '{{request.object.metadata.namespace}}' before deploying workloads.\"\n      deny:\n        conditions:\n          all:\n          - key: \"{{request.object.metadata.namespace}}\"\n            operator: AnyNotIn\n            value: \"{{request.object.metadata.namespace}}\"\n```\n\n## Checkov Custom Checks\n\n```python\n# custom_checks\u002Frequire_s3_versioning.py\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass S3Versioning(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure S3 bucket has versioning enabled\"\n        id = \"CUSTOM_S3_001\"\n        supported_resources = [\"aws_s3_bucket_versioning\"]\n        categories = [CheckCategories.BACKUP_AND_RECOVERY]\n        super().__init__(name=name, id=id,\n                         categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        versioning = conf.get(\"versioning_configuration\", [{}])\n        if isinstance(versioning, list):\n            versioning = versioning[0] if versioning else {}\n        status = versioning.get(\"status\", [\"Disabled\"])\n        if isinstance(status, list):\n            status = status[0]\n        return CheckResult.PASSED if status == \"Enabled\" else CheckResult.FAILED\n\n\ncheck = S3Versioning()\n```\n\n```python\n# custom_checks\u002Frequire_rds_backup.py\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass RDSBackupRetention(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure RDS has backup retention of at least 7 days\"\n        id = \"CUSTOM_RDS_001\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.BACKUP_AND_RECOVERY]\n        super().__init__(name=name, id=id,\n                         categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        retention = conf.get(\"backup_retention_period\", [0])\n        if isinstance(retention, list):\n            retention = retention[0]\n        return CheckResult.PASSED if int(retention) >= 7 else CheckResult.FAILED\n\n\ncheck = RDSBackupRetention()\n```\n\n```bash\n# Run Checkov with custom checks\ncheckov -d .\u002Fterraform \\\n  --framework terraform \\\n  --external-checks-dir .\u002Fcustom_checks \\\n  --output cli \\\n  --compact\n\n# Run specific check IDs\ncheckov -d .\u002Fterraform \\\n  --check CUSTOM_S3_001,CUSTOM_RDS_001,CKV_AWS_18,CKV_AWS_19\n\n# Generate SARIF output for GitHub Advanced Security integration\ncheckov -d .\u002Fterraform \\\n  --framework terraform \\\n  --output sarif \\\n  --output-file checkov-results.sarif\n\n# Skip specific checks with documented justification\ncheckov -d .\u002Fterraform \\\n  --skip-check CKV_AWS_145 \\\n  --skip-check CKV_AWS_79\n```\n\n\n## Contents\n\n- [CI\u002FCD Pipeline Integration](references\u002Fdetails.md)\n- [Policy Exception Management](references\u002Fdetails.md)\n- [Policy Testing](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Enforcing security and compliance policies on infrastructure-as-code changes\n- Preventing misconfigured Kubernetes workloads from deploying\n- Automating guardrails in CI\u002FCD pipelines for Terraform, CloudFormation, or Helm\n- Implementing organizational standards that must be consistently applied\n- Replacing manual approval gates with automated policy checks\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Policy as Code\n\nAutomate policy enforcement through code using OPA\u002FRego, Kyverno, Checkov, and CI\u002FCD integration to prevent compliance violations before they reach production.\n\n## Open Policy Agent (OPA) Rego Policies\n\n```rego\n# deny_public_s3.rego - Deny S3 buckets with public access\npackage terraform.aws.s3\n\nimport rego.v1\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    resource.change.after.acl == \"public-read\"\n    msg := sprintf(\n        \"S3 bucket '%s' has public-read ACL. All buckets must be private. [Policy: no-public-s3]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    resource.change.after.acl == \"public-read-write\"\n    msg := sprintf(\n        \"S3 bucket '%s' has public-read-write ACL. This is strictly prohibited. [Policy: no-public-s3]\",\n        [resource.address]\n    )\n}\n```\n\n```rego\n# require_encryption.rego - Require encryption on data stores\npackage terraform.aws.encryption\n\nimport rego.v1\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_db_instance\"\n    not resource.change.after.storage_encrypted\n    msg := sprintf(\n        \"RDS instance '%s' does not have storage encryption enabled. [Policy: require-rds-encryption]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_ebs_volume\"\n    not resource.change.after.encrypted\n    msg := sprintf(\n        \"EBS volume '%s' is not encrypted. [Policy: require-ebs-encryption]\",\n        [resource.address]\n    )\n}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    not has_encryption(resource)\n    msg := sprintf(\n        \"S3 bucket '%s' does not have default encryption configured. [Policy: require-s3-encryption]\",\n        [resource.address]\n    )\n}\n\nhas_encryption(resource) if {\n    resource.change.after.server_side_encryption_configuration[_]\n}\n```\n\n```rego\n# require_tags.rego - Enforce mandatory tagging\npackage terraform.aws.tags\n\nimport rego.v1\n\nrequired_tags := {\"Environment\", \"Owner\", \"CostCenter\", \"DataClassification\"}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    tags := object.get(resource.change.after, \"tags\", {})\n    missing := required_tags - {key | tags[key]}\n    count(missing) > 0\n    msg := sprintf(\n        \"Resource '%s' is missing required tags: %v. [Policy: required-tags]\",\n        [resource.address, missing]\n    )\n}\n```\n\n```rego\n# restrict_regions.rego - Limit resource deployment to approved regions\npackage terraform.aws.regions\n\nimport rego.v1\n\napproved_regions := {\"us-east-1\", \"us-west-2\", \"eu-west-1\"}\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    provider_config := input.configuration.provider_config.aws\n    region := provider_config.expressions.region.constant_value\n    not region in approved_regions\n    msg := sprintf(\n        \"Resource '%s' is in region '%s'. Approved regions: %v. [Policy: approved-regions]\",\n        [resource.address, region, approved_regions]\n    )\n}\n```\n\n```bash\n# Evaluate OPA policies against Terraform plan\nterraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\n\n# Run OPA evaluation\nopa eval \\\n  --data policies\u002F \\\n  --input tfplan.json \\\n  \"data.terraform.aws.s3.deny\" \\\n  --format pretty\n\n# Use conftest for easier CI integration\nconftest test tfplan.json --policy policies\u002F --output table\n```\n\n## Kyverno Kubernetes Policies\n\n```yaml\n# require-labels.yaml - Enforce required labels on all pods\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-labels\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Labels\n    policies.kyverno.io\u002Fcategory: Best Practices\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: check-required-labels\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: >-\n        Labels 'app.kubernetes.io\u002Fname', 'app.kubernetes.io\u002Fversion',\n        and 'team' are required on all Pods.\n      pattern:\n        metadata:\n          labels:\n            app.kubernetes.io\u002Fname: \"?*\"\n            app.kubernetes.io\u002Fversion: \"?*\"\n            team: \"?*\"\n---\n# disallow-privileged.yaml - Block privileged containers\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: disallow-privileged-containers\n  annotations:\n    policies.kyverno.io\u002Ftitle: Disallow Privileged Containers\n    policies.kyverno.io\u002Fcategory: Pod Security\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: deny-privileged\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"Privileged containers are not allowed.\"\n      pattern:\n        spec:\n          containers:\n          - securityContext:\n              privileged: \"false\"\n          =(initContainers):\n          - securityContext:\n              privileged: \"false\"\n---\n# require-resource-limits.yaml - Enforce resource limits\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-resource-limits\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Resource Limits\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: check-resource-limits\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"All containers must have CPU and memory limits defined.\"\n      pattern:\n        spec:\n          containers:\n          - resources:\n              limits:\n                memory: \"?*\"\n                cpu: \"?*\"\n---\n# disallow-latest-tag.yaml - Block usage of 'latest' image tag\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: disallow-latest-tag\n  annotations:\n    policies.kyverno.io\u002Ftitle: Disallow Latest Tag\n    policies.kyverno.io\u002Fseverity: medium\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: validate-image-tag\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: \"Images must use a specific tag, not 'latest'.\"\n      pattern:\n        spec:\n          containers:\n          - image: \"!*:latest & *:*\"\n---\n# restrict-image-registries.yaml - Allow only approved registries\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: restrict-image-registries\n  annotations:\n    policies.kyverno.io\u002Ftitle: Restrict Image Registries\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n  - name: validate-registries\n    match:\n      any:\n      - resources:\n          kinds:\n          - Pod\n    validate:\n      message: >-\n        Images must come from approved registries:\n        123456789012.dkr.ecr.us-east-1.amazonaws.com or ghcr.io\u002Fyour-org.\n      pattern:\n        spec:\n          containers:\n          - image: \"123456789012.dkr.ecr.*.amazonaws.com\u002F* | ghcr.io\u002Fyour-org\u002F*\"\n---\n# require-networkpolicy.yaml - Ensure namespaces have NetworkPolicies\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-networkpolicy\n  annotations:\n    policies.kyverno.io\u002Ftitle: Require Network Policy\n    policies.kyverno.io\u002Fseverity: high\nspec:\n  validationFailureAction: Audit\n  background: true\n  rules:\n  - name: check-networkpolicy\n    match:\n      any:\n      - resources:\n          kinds:\n          - Deployment\n    preconditions:\n      all:\n      - key: \"{{request.object.metadata.namespace}}\"\n        operator: NotIn\n        value: [\"kube-system\", \"kube-public\"]\n    validate:\n      message: \"A NetworkPolicy must exist in namespace '{{request.object.metadata.namespace}}' before deploying workloads.\"\n      deny:\n        conditions:\n          all:\n          - key: \"{{request.object.metadata.namespace}}\"\n            operator: AnyNotIn\n            value: \"{{request.object.metadata.namespace}}\"\n```\n\n## Checkov Custom Checks\n\n```python\n# custom_checks\u002Frequire_s3_versioning.py\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass S3Versioning(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure S3 bucket has versioning enabled\"\n        id = \"CUSTOM_S3_001\"\n        supported_resources = [\"aws_s3_bucket_versioning\"]\n        categories = [CheckCategories.BACKUP_AND_RECOVERY]\n        super().__init__(name=name, id=id,\n                         categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        versioning = conf.get(\"versioning_configuration\", [{}])\n        if isinstance(versioning, list):\n            versioning = versioning[0] if versioning else {}\n        status = versioning.get(\"status\", [\"Disabled\"])\n        if isinstance(status, list):\n            status = status[0]\n        return CheckResult.PASSED if status == \"Enabled\" else CheckResult.FAILED\n\n\ncheck = S3Versioning()\n```\n\n```python\n# custom_checks\u002Frequire_rds_backup.py\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass RDSBackupRetention(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure RDS has backup retention of at least 7 days\"\n        id = \"CUSTOM_RDS_001\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.BACKUP_AND_RECOVERY]\n        super().__init__(name=name, id=id,\n                         categories=categories,\n                         supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        retention = conf.get(\"backup_retention_period\", [0])\n        if isinstance(retention, list):\n            retention = retention[0]\n        return CheckResult.PASSED if int(retention) >= 7 else CheckResult.FAILED\n\n\ncheck = RDSBackupRetention()\n```\n\n```bash\n# Run Checkov with custom checks\ncheckov -d .\u002Fterraform \\\n  --framework terraform \\\n  --external-checks-dir .\u002Fcustom_checks \\\n  --output cli \\\n  --compact\n\n# Run specific check IDs\ncheckov -d .\u002Fterraform \\\n  --check CUSTOM_S3_001,CUSTOM_RDS_001,CKV_AWS_18,CKV_AWS_19\n\n# Generate SARIF output for GitHub Advanced Security integration\ncheckov -d .\u002Fterraform \\\n  --framework terraform \\\n  --output sarif \\\n  --output-file checkov-results.sarif\n\n# Skip specific checks with documented justification\ncheckov -d .\u002Fterraform \\\n  --skip-check CKV_AWS_145 \\\n  --skip-check CKV_AWS_79\n```\n\n\n## Contents\n\n- [CI\u002FCD Pipeline Integration](references\u002Fdetails.md)\n- [Policy Exception Management](references\u002Fdetails.md)\n- [Policy Testing](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Enforcing security and compliance policies on infrastructure-as-code changes\n- Preventing misconfigured Kubernetes workloads from deploying\n- Automating guardrails in CI\u002FCD pipelines for Terraform, CloudFormation, or Helm\n- Implementing organizational standards that must be consistently applied\n- Replacing manual approval gates with automated policy checks\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":56,"source":57,"license":14,"category":58,"metadata":59,"date_added":62,"description":7,"source_repo":63,"source_type":41,"compatibility":64,"license_source":65},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":60,"version":61},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fpolicy-as-code","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill policy-as-code",{"tool":77,"command":78},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill policy-as-code",{"tool":80,"command":81},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill policy-as-code","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fpolicy-as-code\u002FSKILL.md",true,[85],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fdetails.md","REFERENCE","参考文档",6213,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fpolicy-as-code\u002Freferences\u002Fdetails.md",[92,116,140,163,187,210],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":99,"publishedAt":51},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[98],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[100,101,102,103,104,105,94,106,44,107,108,109,41,40,110,111,112,113,114,115],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","configure","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":51},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[123,124,125,126,127,128,129,130,131,132,133,134,135,109,136,41,137,138,111,139],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":51},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[147,148,149,56,150,151,152,46,153,154,155,156,157,41,40,158,159,160,161,162],"transcript","youtube transcript","youtube","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":176,"publishedAt":51},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[169,172,175],{"categoryNo":170,"categoryName":171,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":173,"categoryName":174,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},[147,148,149,177,56,178,150,151,46,179,180,181,182,155,183,41,40,184,185,186],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":197,"publishedAt":51},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[193,196],{"categoryNo":194,"categoryName":195,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":173,"categoryName":174,"taxonomyType":20,"taxonomyTypeDesc":21},[149,198,199,127,56,200,201,202,32,46,181,203,204,205,206,40,207,158,208,209],"youtube notetaker","notetaker","workflow","official","notes","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":51},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[216],{"categoryNo":170,"categoryName":171,"taxonomyType":20,"taxonomyTypeDesc":21},[218,149,219,220,56,178,179,221,222,180,181,182,155,223,183,41,40,184,224,161],"youtube full","full","google","server","dlp","credits","automatic"]