implementing-policy-as-code-with-open-policy-agent

使用 Open Policy Agent 实现策略即代码

何时使用

• 当需要以编程方式在多个 Kubernetes 集群中强制执行组织安全策略时
• 当需要准入控制以阻止创建不合规资源时
• 当实施可版本控制、可测试、可审计的策略治理时
• 当需要在多个集群和环境间统一安全规则时
• 当需要一个超越 Kubernetes、可扩展到 API 和 CI/CD 的灵活策略引擎时

请勿使用于漏洞扫描（使用 Trivy/Checkov）、运行时威胁检测（使用 Falco）或网络策略执行（使用 Kubernetes NetworkPolicy 或 Calico）。

前置条件

• 具有管理员权限、可用于安装 Gatekeeper 的 Kubernetes 集群
• 用于部署 Gatekeeper 的 Helm
• 用于本地策略测试的 OPA CLI 或 conftest
• 用于编写策略的 Rego 知识

工作流

步骤 1：安装 OPA Gatekeeper

# Install Gatekeeper via Helm
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper \
  --namespace gatekeeper-system --create-namespace \
  --set replicas=3 \
  --set audit.replicas=1 \
  --set audit.writeToRAMDisk=true

步骤 2：创建约束模板

# templates/k8s-required-labels.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("Missing required labels: %v", [missing])
        }

---
# templates/k8s-container-limits.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8scontainerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sContainerLimits
      validation:
        openAPIV3Schema:
          type: object
          properties:
            cpu:
              type: string
            memory:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerlimits
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := sprintf("Container %v has no CPU limit", [container.name])
        }
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := sprintf("Container %v has no memory limit", [container.name])
        }

---
# templates/k8s-block-privileged.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sblockprivileged
spec:
  crd:
    spec:
      names:
        kind: K8sBlockPrivileged
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sblockprivileged
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged container not allowed: %v", [container.name])
        }
        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          container.securityContext.privileged == true
          msg := sprintf("Privileged init container not allowed: %v", [container.name])
        }

步骤 3：应用约束

# constraints/require-labels.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-labels
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet"]
    excludedNamespaces:
      - kube-system
      - gatekeeper-system
  parameters:
    labels:
      - "team"
      - "environment"
      - "cost-center"

---
# constraints/block-privileged.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
  name: block-privileged-containers
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: ["apps"]
        kinds: ["Deployment", "DaemonSet", "StatefulSet"]
    excludedNamespaces:
      - kube-system

步骤 4：使用 conftest 测试策略

# Install conftest
brew install conftest

# Test Kubernetes manifests against OPA policies locally
conftest test deployment.yaml --policy policies/ --output json

# Test Terraform against OPA policies
conftest test terraform/main.tf --policy policies/terraform/ --parser hcl2

# Test Dockerfiles
conftest test Dockerfile --policy policies/docker/

# policies/kubernetes/deny_latest_tag.rego
package kubernetes

deny[msg] {
  input.kind == "Deployment"
  container := input.spec.template.spec.containers[_]
  endswith(container.image, ":latest")
  msg := sprintf("Container %v uses :latest tag. Pin to specific version.", [container.name])
}

deny[msg] {
  input.kind == "Deployment"
  container := input.spec.template.spec.containers[_]
  not contains(container.image, ":")
  msg := sprintf("Container %v has no tag. Pin to specific version.", [container.name])
}

步骤 5：在 CI/CD 中集成策略测试

# .github/workflows/policy-test.yml
name: Policy Validation

on:
  pull_request:
    paths: ['k8s/**', 'terraform/**', 'policies/**']

jobs:
  conftest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install conftest
        run: |
          wget -q https://github.com/open-policy-agent/conftest/releases/download/v0.50.0/conftest_0.50.0_Linux_x86_64.tar.gz
          tar xzf conftest_0.50.0_Linux_x86_64.tar.gz
          sudo mv conftest /usr/local/bin/
      - name: Test K8s manifests
        run: conftest test k8s/**/*.yaml --policy policies/kubernetes/ --output json
      - name: Test Terraform
        run: conftest test terraform/*.tf --policy policies/terraform/ --parser hcl2

关键概念

术语	定义
OPA	Open Policy Agent —— 使用 Rego 语言进行策略决策的通用策略引擎
Rego	OPA 用于编写策略规则的声明式查询语言
Gatekeeper	Kubernetes 原生的 OPA 集成，通过 ConstraintTemplates 实现准入控制
ConstraintTemplate	定义某类约束的 Rego 策略逻辑和参数模式的 CRD
Constraint	具有特定参数和作用范围（要检查哪些资源）的 ConstraintTemplate 实例
Admission Controller	Kubernetes 组件，在持久化之前拦截 API 请求，可以允许或拒绝请求
conftest	用于根据 OPA 策略测试结构化数据（YAML、JSON、HCL）的 CLI 工具

工具与系统

• Open Policy Agent (OPA)：用于统一策略执行的通用策略引擎
• Gatekeeper：基于 OPA 构建、采用基于 CRD 配置的 Kubernetes 准入控制器
• conftest：针对配置文件测试 OPA 策略的测试框架
• Kyverno：使用基于 YAML 的策略（无需 Rego）的替代 Kubernetes 策略引擎
• Styra DAS：商业 OPA 管理平台，提供策略编写、测试和分发

常见场景

场景：跨集群强制执行容器安全标准

背景：多个开发团队部署到共享的 Kubernetes 集群。一些团队运行特权容器和没有资源限制的镜像，导致安全和稳定性问题。

方法：

1. 通过 GitOps 在所有集群上部署 Gatekeeper（FluxCD 仓库中的 Helm chart）
2. 为以下内容创建 ConstraintTemplates：禁止特权容器、要求资源限制、要求标签、禁止 latest 标签
3. 从 enforcementAction: warn 开始，在不阻止部署的情况下识别违规
4. 通知团队违规情况，并提供 2 周的修复窗口
5. 修复期结束后切换到 enforcementAction: deny
6. 为 kube-system 和监控命名空间添加 excludedNamespaces

陷阱：立即以 deny 模式部署 Gatekeeper 可能会破坏现有工作负载。始终从 warn 模式开始。过于严格且没有为系统命名空间设置豁免的策略可能会阻止集群组件正常运行。

输出格式

OPA Policy Evaluation Report
==============================
Cluster: production-east
Date: 2026-02-23
Gatekeeper Version: 3.16.0

CONSTRAINT SUMMARY:
  K8sRequiredLabels:        12 violations (warn)
  K8sBlockPrivileged:        0 violations (deny)
  K8sContainerLimits:        8 violations (deny)
  K8sBlockLatestTag:         3 violations (deny)

BLOCKED DEPLOYMENTS (deny):
  [K8sContainerLimits] deployment/api-server in ns/payments
    - Container 'api' has no memory limit
  [K8sBlockLatestTag] deployment/frontend in ns/web
    - Container 'nginx' uses :latest tag

AUDIT VIOLATIONS (warn):
  [K8sRequiredLabels] namespace/staging
    - Missing labels: {cost-center}