Agent skill
policy-as-code-template-library
Production-ready policy template library: 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/enforce/skills/policy-as-code-template-library
SKILL.md
Policy-as-Code Template Library
When to Use This Skill
48 production-ready policies for Kubernetes security and governance. Reduce the Rego learning curve. Copy, customize, deploy.
Template Library Overview
This library contains 28 Kyverno policies and 20 OPA/Gatekeeper constraint templates covering pod security, image validation, RBAC, resource governance, network security, mutation, and generation. Each template includes complete YAML/Rego, customization variables, validation commands, and real-world use cases.
Implementation
Deploy in Audit Mode First
Always start with
audit(Kyverno) ordryrun(OPA) mode. Monitor violations for 48 hours before switching to enforcement. Existing workloads may violate policies.
Kyverno Quick Start (5 minutes)
See examples.md for detailed code examples.
OPA/Gatekeeper Quick Start (10 minutes)
See examples.md for detailed code examples.
Comparison
Choose the right policy engine for your team:
| Feature | Kyverno | OPA/Gatekeeper |
|---|---|---|
| Policies | 28 (validation, mutation, generation) | 20 (validation only) |
| Language | YAML + JMESPath | Rego (Go-like DSL) |
| Learning Curve | < 1 hour | 4-8 hours |
| Best For | Kubernetes-native teams, fast adoption | Multi-platform policies, complex logic |
| Mutation | ✅ Native support | ❌ Validation only |
| Generation | ✅ Auto-create resources | ❌ Validation only |
See Decision Guide → for detailed comparison and recommended starter paths.
Examples
See examples.md for code examples.
Full Reference
See reference.md for complete documentation.
Related Patterns
- Kyverno Official Documentation
- OPA/Gatekeeper Documentation
- Kubernetes Pod Security Standards
- NIST SP 800-190
- CIS Kubernetes Benchmark
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?