Policy-as-Code automates the enforcement of security and compliance rules across your infrastructure, decoupling policy logic from application code.

Step 1 — Open Policy Agent (OPA)

OPA uses a high-level declarative language called Rego to evaluate JSON inputs against defined policies. It's widely used in Kubernetes admission controllers and CI/CD pipelines.

policy.regorego
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Deployment"
  not input.request.object.spec.template.metadata.labels["cost-center"]
  msg := "All Deployments must have a 'cost-center' label for FinOps tracking"
}

Step 2 — CI/CD Integration

Shift policy enforcement left by scanning Terraform and Kubernetes manifests during pull requests using tools like Conftest or Checkov.

Common Policies

  • Security: Prevent running containers as root.
  • Reliability: Require CPU and Memory limits on all pods.
  • Governance: Enforce specific tagging/labeling schemas.