Policy as Code

Purpose

Implement policy as code using OPA/Rego and Kyverno: write admission policies, enforce guardrails, validate configurations, and automate compliance checks in Kubernetes and cloud environments. Covers mutating and validating policies, constraint templates, policy testing, CI/CD integration, and policy lifecycle management.

Agent Protocol

Trigger

Exact user phrases: "policy as code", "OPA", "Open Policy Agent", "Rego", "Gatekeeper", "Kyverno", "admission controller", "admission webhook", "conftest", "constraint template", "constraint", "policy enforcement", "guardrails", "compliance as code", "policy testing", "opa test", "validate", "mutate", "generate", "policy report", "background scan".

Input Context

• Existing policy tools (OPA, Kyverno, or none)
• Cluster/environment (Kubernetes, Terraform, CI/CD)
• Compliance requirements (PCI, SOC2, HIPAA, internal)
• Team structure and policy ownership
• Existing policy rules (if any, to migrate)

Output Artifact

Policy definitions (Rego files, Kyverno YAML, Gatekeeper constraints), policy tests, CI/CD integration scripts, and policy reporting configuration.