Policy Enforcement

DevSecOps emphasizes embedding security and compliance into every stage of the software development lifecycle. Policy enforcement is critical to ensuring that infrastructure-as-code (IaC), application configurations, and deployment pipelines adhere to organizational and regulatory standards. Tools like Open Policy Agent (OPA) and Conftest enable teams to define, test, and enforce policies programmatically, integrating seamlessly into CI/CD pipelines.

Open Policy Agent (OPA)¶

Overview¶

OPA is a general-purpose policy engine that uses the Rego language to define rules. It can enforce policies across diverse domains, including infrastructure, application configurations, and security. OPA is often used in conjunction with Gatekeeper (for Kubernetes) or as a standalone tool for runtime policy enforcement.

Key Features¶

Policy-as-code: Policies are written in Rego, a declarative language.
Runtime enforcement: Validates requests against policies in real time.
Integration: Works with Kubernetes, cloud providers, and custom systems.

Example: Enforcing Security Policies¶

# policy.rego
package security

deny[msg] {
    input.request.action == "create"
    input.resource == "pod"
    not input.request.annotations["security.annotations.compliant"]
    msg := "Pod creation requires compliance annotations"
}

Usage in CI/CD:

# Validate a Kubernetes manifest against OPA policies
opa eval --input=manifest.yaml --policy=policy.rego

Conftest¶

Overview¶

Conftest is a tool specifically designed for testing IaC templates (e.g., Terraform, Docker, Kubernetes). It uses Rego to define policies and checks templates for compliance during development or pre-deployment.

Key Features¶

IaC validation: Supports Terraform, Docker, Kubernetes, and more.
Pre-commit hooks: Integrates with Git to enforce policies during code reviews.
CI/CD integration: Validates templates as part of pipeline stages.

Example: Validating Terraform Templates¶

# policy.rego
package terraform

deny[msg] {
    input.resource == "aws_instance"
    input.config.count != null
    msg := "Count values are not allowed for AWS instances"
}

Usage in CI/CD:

# Run Conftest against Terraform files
conftest test --policy=policy.rego terraform/

Integrating Policy Enforcement into CI/CD Pipelines¶

Pre-commit hooks: Use Conftest to validate IaC changes before merging.
Pipeline gates: Run OPA or Conftest as part of deployment stages to block non-compliant changes.
Runtime checks: Deploy OPA as an admission controller in Kubernetes to enforce policies at runtime.

Key takeaways¶

OPA is ideal for runtime policy enforcement across diverse systems, while Conftest specializes in validating IaC templates.
Both tools use Rego, enabling consistent policy definitions across infrastructure and application layers.
Integrating policy enforcement into CI/CD pipelines ensures compliance is enforced early, reducing security risks and remediation costs.