Security Policy as Code

1. Introduction
2. Open Policy Agent (OPA)
   1. Open Policy Agent in Kubernetes
   2. Open Policy Agent in OpenShift
   3. Open Policy Agent in Cloudflare Workers
   4. Policy as Code in Terraform Cloud
   5. Other OPA based solutions
3. Other Policy as Code Scanning Tools
4. Kyverno
   1. Kyverno E-Learning
5. Cloud Custodian
6. Apolicy
7. Azure Policy

Introduction

• Dzone: DevOps Security at Scale - Security Policy as Code
• searchitoperations.techtarget.com: Kubernetes policy project takes enterprise IT by storm A Kubernetes-friendly compliance as code project hosted by the CNCF has caught on among large enterprises in the first half of 2019, largely through word of mouth.
• amazon.com: Policy-based countermeasures for Kubernetes – Part 1
• medium: Automate policies enforcement with Policy-as-Code 🌟
• blog.gitguardian.com: What is Policy-as-Code? An Introduction to Open Policy Agent Learn the benefits of policy as code and start testing your policies for cloud-native environments.

Open Policy Agent (OPA)

• OPA Open Policy Agent 🌟
• OPA is most often used as an admission controller in Kubernetes. An admission controller is where all the semantic validation of Kubernetes resources occur before resources are persisted to etcd and controllers go off and start doing work.
• magalix.com: Integrating Open Policy Agent (OPA) With Kubernetes 🌟
• fugue.co: 5 tips for using the Rego language for Open Policy Agent (OPA)
• PolicyHub CLI, a CLI tool that makes Rego policies searchable 🌟 a list of community OPA policies
• blog.styra.com: Integrating Identity: OAUTH2 and OPENID CONNECT in Open Policy Agent
• blog.styra.com: Rego Unit Testing
• github.com/instrumenta/policies: A set of shared policies for use with Conftest and other Open Policy Agent tools
• itprotoday.com: Who Needs Open Policy Agent? Open Policy Agent makes it possible to create a single set of configuration rules and deploy them automatically across a large-scale environment.
• blog.styra.com: Dynamic Policy Composition for OPA
• blog.styra.com: 5 OPA Deployment Performance Models for Microservices
• blog.styra.com: Open Policy Agent: The Top 5 Kubernetes Admission Control Policies
  • Trusted Repo
  • Label Safety
  • Privileged Mode
  • Ingress
  • Egress
• thenewstack.io: Getting Open Policy Agent Up and Running
• siegert-maximilian.medium.com: Ensure Content Trust on Kubernetes using Notary and Open Policy Agent A detailed guide to help you to ensure that only signed images can get deployed on the cluster
• blog.styra.com: Policy-based infrastructure guardrails with Terraform and OPA 🌟
• medium: Automated Manifest File Validation Using Open Policy Agent and GitHub Actions | Ravindu Sandeepa Rathugama
• thenewstack.io: Weaveworks Adds Policy as Code to Secure Kubernetes Apps (Magalix) - Magalix
• fugue.co: Securing a Kubernetes pod with Regula and Open Policy Agent
• dev.to: Load external data into OPA: The Good, The Bad, and The Ugly There are several ways to create a data fetching mechanism for the Open Policy Agent - each of them has its pros and cons. In this guide, you will compare and decide which one is the best for you.
• inspektor.cloud: Evaluating open policy agent in rust using wasm
• medium.com/4^th-coffee: What is Policy-as-Code? An Introduction to Open Policy Agent

Open Policy Agent in Kubernetes

• infracloud.io: Kubernetes Pod Security Policies with Open Policy Agent
• banzaicloud.com: Istio and Kubernetes ft. OPA policies
• fugue.co: 5 tips for using the Rego language for Open Policy Agent (OPA)
• medium: Ensure Content Trust on Kubernetes using Notary and Open Policy Agent A detailed guide to help you to ensure that only signed images can get deployed on the cluster. In this blog post you will learn how to enforce image trust on your Kubernetes Cluster by fully relying on two well known CNCF hosted open source solutions: Notary and Open Policy Agent (OPA).
• kubermatic.com: Using Open Policy Agent With Kubermatic Kubernetes Platform
• k8s-security-policies This repository provides a security policies library that is used for securing Kubernetes clusters configurations. The security policies are created based on CIS Kubernetes benchmark and rules defined in Kubesec.io. The policies are written in Rego, a high-level declarative language, its purpose-built for expressing policies over complex hierarchical data structures. For detailed information on Rego see the Policy Language documentation.
• medium: Deploying Open Policy Agent (OPA) on a GKE cluster — Step by Step
• github.com/instrumenta/policies: A set of shared policies for use with Conftest and other Open Policy Agent tools 🌟
• blog.styra.com: Using OPA with GitOps to speed Cloud-Native development
• medium.com/gitguardian: What is Policy-as-Code? An Introduction to Open Policy Agent

Open Policy Agent in OpenShift

• blog.openshift.com: Fine-Grained Policy Enforcement in OpenShift with Open Policy Agent 🌟

Open Policy Agent in Cloudflare Workers

• compile OpenPolicyAgent policies into WebAssembly and run them on the edge

Policy as Code in Terraform Cloud

• hashicorp.com: Securing Infrastructure In Application Pipelines Learn how to use policy as code in Terraform Cloud to securely deliver applications.

Other OPA based solutions

• Fugue: Container and Kubernetes. Runtime infrastructure security - darkreading.com: Fugue Adds Kubernetes Security Checks to Secure Infrastructure-as-Code Developers can apply proper security controls as they programmatically deploy Kubernetes clusters.

Other Policy as Code Scanning Tools

• thenewstack.io: Yor Automates Tagging for Infrastructure as Code
• yor.io Automated IaC tag and trace. Yor is an open-source tool that automatically tags infrastructure as code (IaC) templates with attribution and ownership details, unique IDs that get carried across to cloud resources, and any other need-to-know information. Run Yor as a pre-commit hook or in your CI/CD pipeline for code to cloud traceability and auditability.
• checkov.io policy as code scanning tool
• aws.amazon.com: Policy-based countermeasures for Kubernetes – Part 1 Choosing the right policy-as-code solution for your Kubernetes cluster:
  • OPA
  • Gatekeeper
  • Kyverno
  • k-rail
  • MagTape Policy as code for kubernetes
• Selefra: Selefra is an open-source policy-as-code software that provides analytics for multi-cloud and SaaS. Selefra means “select * from infrastructure”. It is an open-source infrastructure-as-code software that provides analysis for multi-cloud and SaaS environments, including over 30 services such as AWS, GCP, Azure, Alibaba Cloud, Kubernetes, Github, Cloudflare, and Slack.

Kyverno

• Kyverno 🌟 Kubernetes Native Policy Management. Open Policy Agent? That’s old school. Securely manage workloads on your kubernetesio clusters with this handy new tool, Kyverno.Kyverno is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate Kubernetes resources. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline. youtube: The Way of the Future | Kubernetes Policy Management with Kyverno
• venturebeat.com: How Nirmata plans to ‘conquer Kubernetes complexity’ with open source Kyverno
• neonmirrors.net: Kubernetes Policy Comparison: OPA/Gatekeeper vs Kyverno 🌟
• kyverno.io: 56 sample policies 🌟
• dev.to: Using Kyverno To Enforce EKS Best Practices
• Tip: Use kyverno to monitor for usage of deprecated resources ahead of the Kubernetes 1.22 release (validation check to scan and report usage of deprecated resources) - ref - ref2
• aws.amazon.com: Easy as one-two-three policy management with Kyverno on Amazon EKS 🌟
• kyverno.io: Mutating Resources Modify resources during admission control (Kyverno supports mutating resources).
• squadcast.com: Kyverno - Policy Management in Kubernetes 🌟
• neonmirrors.net: Exploring Kyverno: Part 3, Generation
• kyverno.io: Check deprecated APIs 🌟 Kubernetes APIs are sometimes deprecated and removed after a few releases. As a best practice, older API versions should be replaced with newer versions. This policy validates for APIs that are deprecated or scheduled for removal. Note that checking for some of these resources may require modifying the Kyverno ConfigMap to remove filters.
• kyverno.io: Generating resources into existing namespaces
• kyverno.io: Add Pod Proxies A kyverno policy to inject K8s Pod proxy env variables.
• kyverno.io: Auto-Gen Rules for Pod Controllers Automatically generate rules for Pod controllers.
• kyverno.io: Require PodDisruptionBudget Use this kyverno sample to prevent app downtime by requiring all kubernetesio Deployments have a corresponding PodDisruptionBudget.
• nirmata.com: Kubernetes Supply Chain Policy Management with Cosign and Kyverno
• neonmirrors.net: Exploring Kyverno: Introduction 🌟
• nirmata.com: Introducing Kyverno 1.4.2: Trusted And More Efficient!
• searchitoperations.techtarget.com: CNCF policy-as-code project bridges Kubernetes security gaps Kyverno, a CNCF policy-as-code sandbox project, can help platform engineers navigate the transition toward the successor to Kubernetes pod security policies.
• Policy Reporter 🌟 Creates Prometheus Metrics for PolicyReports and ClusterPolicyReports. Ships with an optional Web UI and can send new Results to different Clients like Loki and Elasticsearch. Provides a optional Monitoring Subchart with a ServiceMonitor and Grafana Dashboards for the Prometheus Operator.
• sesin.at: Securing Kubernetes with Kyverno: How to Protect Your Users From Themselves by Ritesh Patel
• movi.hashnode.dev: Simplify Kubernetes Cluster Management with Kyverno Kyverno, a policy engine designed specifically for Kubernetes.
• arun-sisodiya.medium.com: Kyverno — A Kubernetes native policy manager (Policy as Code)
• dev.to: Default Kyverno Policies for OpenEBS
• cloud.redhat.com: Automate Your Security Practices and Policies on OpenShift With Kyverno 🌟
• A Kyverno policy to block custom snippet configurations for Kubernetes Nginx ingress (CVE-2021-25742
• kyverno.io: Restrict Image Registries kyverno has a solid set of kubernetes policies and excellent documentation out of the box!
• dev.to: Using Kyverno Policies for Kubernetes Governance

• kyverno.io: Implementing your best practices is simple with kyverno

  1. Startup Probe
  2. Liveness Probe
  3. Readiness Probe
  4. Graceful shutdown - be able to handle a sigterm in kubernetes

• medium.com/compass-true-north: Governing Multi-Tenant Kubernetes Clusters with Kyverno

• medium.com/@haseebshaukat2: Kyverno — Policy Engine for Kubernetes | Muhammad Haseeb Shaukat
• youtube: The Rise of Kubernetes Policy Engine | Ep 57 Learn how to prepare for Pod Security Policies removal in Kubernetes V1.25 with Kyverno 1.8:
  • YAML signing and verification
  • Pod security admission integrations
  • Clone multiple resources
  • OpenTelemetry
  • Multi-tenancy
• medium.com/compass-true-north: Governing Multi-Tenant Kubernetes Clusters with Kyverno With Kyverno:
  • Invalid resources can be blocked with helpful errors
  • Misconfigured resources can be corrected on the fly
  • New resources can be dynamically generated
• blog.sigstore.dev: How to verify container images with Kyverno using KMS, Cosign, and Workload Identity
• medium.com/@glen.yu: Why I prefer Kyverno over Gatekeeper for native Kubernetes policy management I used to use Open Policy Agent Gatekeeper for Kubernetes policies but personally found writing new policies to be quite difficult with a steep learning curve. I then decided to give Kyverno a try and was really impressed with how easy it was to use.

Kyverno E-Learning

• appsecengineer.com: Kubernetes Policy Management with Kyverno

Cloud Custodian

• Cloud Custodian is a rules engine for managing public cloud accounts and resources. It allows users to define policies to enable a well managed cloud infrastructure, that’s both secure and cost optimized.

Apolicy

• Apolicy
• sysdig.com: Sysdig and Apolicy join forces to help customers secure Infrastructure As Code and automate remediation

Azure Policy

• Azure Policy