policy-platforms

What this skill does

# Policy Platforms

Platform-specific OPA/Rego patterns covering Kubernetes, Terraform, Docker, cloud providers, and service mesh. Each platform has unique input schemas and conventions.

## Platform Quick Reference

| Platform | Input Source | Policy Tool | Key Package |
|----------|-------------|-------------|-------------|
| Kubernetes | AdmissionReview | Gatekeeper / OPA | `kubernetes.admission` |
| Terraform | Plan JSON | Conftest / OPA | `terraform.analysis` |
| Docker | Dockerfile AST | Conftest | `main` (Conftest convention) |
| Envoy | CheckRequest | OPA-Envoy plugin | `envoy.authz` |
| AWS/Azure/GCP | Terraform plan / CloudFormation | Conftest / Regula / Terrascan | Varies |

---

## Kubernetes (Gatekeeper)

### Input Schema

Gatekeeper provides an `AdmissionReview` object:

```json
{
  "review": {
    "object": { /* resource being created/updated */ },
    "oldObject": { /* previous version on UPDATE */ },
    "operation": "CREATE",
    "userInfo": { "username": "admin", "groups": ["system:masters"] },
    "namespace": "default"
  },
  "parameters": { /* constraint parameters */ }
}
```

### ConstraintTemplate Pattern

```rego
package k8srequiredlabels

import rego.v1

violation contains {"msg": msg, "details": {"missing_labels": missing}} if {
    provided := {label | some label, _ in input.review.object.metadata.labels}
    required := {label | some label in input.parameters.labels}
    missing := required - provided
    count(missing) > 0
    msg := sprintf("missing required labels: %v", [missing])
}
```

### Common K8s Policy Categories

| Category | Examples |
|----------|---------|
| **Pod Security** | No privileged, runAsNonRoot, drop capabilities, read-only rootfs |
| **Resource Limits** | CPU/memory limits required, ratio constraints |
| **Image Policy** | Allowed registries, no `latest` tag, signed images |
| **Network** | NetworkPolicy required, no hostNetwork, port restrictions |
| **Labels/Annotations** | Required labels, label format validation |
| **RBAC** | No wildcard permissions, namespace isolation |

### Testing Gatekeeper Policies Locally

```bash
# Install gator CLI
go install github.com/open-policy-agent/gatekeeper/v3/cmd/gator@latest

# Test constraint template
gator verify suite.yaml

# Verify against test resources
gator test -f constraint-template.yaml -f constraint.yaml -f test-resource.yaml
```

---

## Terraform

### Input Schema

Terraform plan JSON (via `terraform show -json tfplan`):

```json
{
  "resource_changes": [
    {
      "address": "aws_s3_bucket.example",
      "type": "aws_s3_bucket",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": ["create"],
        "before": null,
        "after": { /* planned state */ },
        "after_unknown": { /* computed values */ }
      }
    }
  ],
  "configuration": { /* HCL configuration tree */ },
  "planned_values": { /* root_module with resources */ }
}
```

### Conftest Policy Pattern

```rego
package terraform.aws.s3

import rego.v1

deny contains msg if {
    some rc in input.resource_changes
    rc.type == "aws_s3_bucket"
    "create" in rc.change.actions
    not rc.change.after.server_side_encryption_configuration
    msg := sprintf("S3 bucket '%s' must have encryption enabled", [rc.address])
}

deny contains msg if {
    some rc in input.resource_changes
    rc.type == "aws_s3_bucket"
    rc.change.after.acl == "public-read"
    msg := sprintf("S3 bucket '%s' must not be public", [rc.address])
}
```

### Workflow

```bash
# Generate plan JSON
terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json

# Evaluate with Conftest
conftest test tfplan.json -p policy/terraform/

# Evaluate with OPA directly
opa eval -d policy/terraform/ -i tfplan.json "data.terraform.aws.s3.deny"
```

### Common Terraform Policy Categories

| Category | Examples |
|----------|---------|
| **Encryption** | S3 SSE, RDS encryption, EBS encryption |
| **Networking** | No public IPs, security group restrictions, VPC required |
| **IAM** | No wildcard actions, MFA required, role boundaries |
| **Tagging** | Required tags (env, team, cost-center) |
| **Compliance** | Logging enabled, backup configured, deletion protection |

---

## Docker

### Input Schema

Conftest parses Dockerfiles into structured commands:

```json
{
  "Stages": [
    {
      "Name": "builder",
      "From": {"Image": "golang", "Tag": "1.22"},
      "Commands": [
        {"Cmd": "run", "Value": ["apt-get install -y curl"]},
        {"Cmd": "copy", "Value": [".", "/app"]},
        {"Cmd": "user", "Value": ["nonroot"]}
      ]
    }
  ]
}
```

### Dockerfile Policy Pattern

```rego
package docker.security

import rego.v1

deny contains msg if {
    some stage in input.Stages
    stage.From.Tag == "latest"
    msg := sprintf("stage '%s' uses 'latest' tag - pin to specific version", [stage.Name])
}

deny contains msg if {
    some stage in input.Stages
    not _has_user(stage)
    msg := sprintf("stage '%s' missing USER instruction - must not run as root", [stage.Name])
}

warn contains msg if {
    some stage in input.Stages
    some cmd in stage.Commands
    cmd.Cmd == "add"
    msg := "prefer COPY over ADD unless extracting archives"
}

_has_user(stage) if {
    some cmd in stage.Commands
    cmd.Cmd == "user"
}
```

### Workflow

```bash
conftest test Dockerfile -p policy/docker/
```

---

## Envoy / Service Mesh

### Input Schema

OPA-Envoy external authorization request:

```json
{
  "attributes": {
    "request": {
      "http": {
        "method": "GET",
        "path": "/api/v1/users",
        "headers": {
          "authorization": "Bearer eyJ..."
        }
      }
    },
    "source": {
      "principal": "spiffe://cluster.local/ns/default/sa/frontend"
    },
    "destination": {
      "principal": "spiffe://cluster.local/ns/default/sa/backend"
    }
  }
}
```

### Envoy Authorization Pattern

```rego
package envoy.authz

import rego.v1

default allow := false

allow if {
    input.attributes.request.http.method == "GET"
    glob.match("/api/v1/public/*", ["/"], input.attributes.request.http.path)
}

allow if {
    input.attributes.request.http.method in {"GET", "POST"}
    token := io.jwt.decode(bearer_token)
    "admin" in token[1].roles
}

bearer_token := t if {
    auth_header := input.attributes.request.http.headers.authorization
    startswith(auth_header, "Bearer ")
    t := substring(auth_header, 7, -1)
}
```

---

## Cloud Provider Patterns

### AWS (Terraform)

Common AWS resource types and their security properties:

| Resource | Security Properties |
|----------|-------------------|
| `aws_s3_bucket` | `server_side_encryption_configuration`, `acl`, `versioning`, `logging` |
| `aws_security_group` | `ingress[].cidr_blocks` (no `0.0.0.0/0` on sensitive ports) |
| `aws_rds_instance` | `storage_encrypted`, `backup_retention_period`, `deletion_protection` |
| `aws_iam_policy` | No `*` in `Action` or `Resource` |
| `aws_cloudtrail` | `enable_logging`, `is_multi_region_trail` |

### Azure (Terraform)

| Resource | Security Properties |
|----------|-------------------|
| `azurerm_storage_account` | `enable_https_traffic_only`, `min_tls_version`, `network_rules` |
| `azurerm_key_vault` | `purge_protection_enabled`, `soft_delete_retention_days` |
| `azurerm_sql_server` | `administrator_login`, `minimum_tls_version` |

### GCP (Terraform)

| Resource | Security Properties |
|----------|-------------------|
| `google_storage_bucket` | `uniform_bucket_level_access`, `encryption` |
| `google_compute_firewall` | `source_ranges` (no `0.0.0.0/0`) |
| `google_sql_database_instance` | `settings.ip_configuration.require_ssl` |

---

## Common Mistakes -- DO NOT MAKE THESE

These are the most frequent platform-specific errors. Check every policy against this table before finalizing.

### Kubernetes / Gatekeeper

| WRONG | CORRECT | Why |
|-------|---------|-----|
| `input.spec.containers` | `input.review.object.spec.containers` | Gatekeeper wraps the res