Compliance and Governance
Best practices for implementing policy-as-code, supply chain security, audit trails, and regulatory compliance in cloud-native environments. This skill covers the full lifecycle from policy authoring to continuous compliance monitoring and evidence generation.
Regulatory Framework Comparison
Understanding which controls map to which framework prevents duplicate work and identifies gaps.
| Control Domain | SOC 2 (TSC) | HIPAA | PCI-DSS v4.0 | FedRAMP | ISO 27001 | |----------------|-------------|-------|---------------|---------|-----------| | Access Control | CC6.1-CC6.8 | 164.312(a) | Req 7, 8 | AC family | A.9 | | Audit Logging | CC7.1-CC7.4 | 164.312(b) | Req 10 | AU family | A.12.4 | | Encryption at Rest | CC6.1 | 164.312(a)(2)(iv) | Req 3 | SC-28 | A.10.1 | | Encryption in Transit | CC6.7 | 164.312(e) | Req 4 | SC-8 | A.13.1 | | Vulnerability Mgmt | CC7.1 | 164.308(a)(5)(ii) | Req 6, 11 | RA-5, SI-2 | A.12.6 | | Incident Response | CC7.3-CC7.5 | 164.308(a)(6) | Req 12.10 | IR family | A.16 | | Change Management | CC8.1 | 164.308(a)(5)(ii) | Req 6.5 | CM family | A.12.1 | | Data Classification | CC6.5 | 164.312(d) | Req 3.2-3.4 | RA-2 | A.8.2 | | Backup & Recovery | CC7.5, A1.2 | 164.308(a)(7) | Req 9.5 | CP family | A.12.3 | | Vendor Management | CC9.2 | 164.308(b) | Req 12.8 | SA family | A.15 |
Framework Selection Guidance
| Your Industry | Start With | Add When Needed | |----------------|-----------|-----------------| | SaaS B2B | SOC 2 Type II | ISO 27001 for international | | Healthcare | HIPAA + SOC 2 | HITRUST for certification | | E-commerce / Payments | PCI-DSS | SOC 2 for broader trust | | Government / Defense | FedRAMP | NIST 800-171 for CUI | | Finance | SOC 2 + PCI-DSS | SOX for public companies |
Policy-as-Code with OPA
Open Policy Agent (OPA) evaluates policies written in Rego against structured data. Policies are version-controlled, tested, and deployed alongside application code.
OPA Architecture
+------------------+
| Policy Bundle |
| (Git repo) |
+--------+---------+
|
+--------v---------+
Request -------->| OPA Server |-------> Allow / Deny
(JSON input) | (Rego engine) | + Reasons
+--------+---------+
|
+--------v---------+
| Decision Log |
| (audit trail) |
+------------------+OPA Rego Policy: Kubernetes Admission Control
package kubernetes.admission
import rego.v1
# Deny containers running as root
deny contains msg if {
input.request.kind.kind == "Pod"
some container in input.request.object.spec.containers
not container.securityContext.runAsNonRoot
msg := sprintf(
"Container '%s' in Pod '%s' must set securityContext.runAsNonRoot=true",
[container.name, input.request.object.metadata.name]
)
}
# Deny images without digest pinning
deny contains msg if {
input.request.kind.kind == "Pod"
some container in input.request.object.spec.containers
not contains(container.image, "@sha256:")
not startswith(container.image, "registry.internal.company.com/")
msg := sprintf(
"Container '%s' uses unpinned image '%s'. Pin with @sha256: digest.",
[container.name, container.image]
)
}
# Require resource limits on all containers
deny contains msg if {
input.request.kind.kind == "Pod"
some container in input.request.object.spec.containers
not container.resources.limits.memory
msg := sprintf(
"Container '%s' must define resources.limits.memory",
[container.name]
)
}
# Require labels for cost tracking
deny contains msg if {
input.request.kind.kind in {"Deployment", "StatefulSet", "DaemonSet"}
not input.request.object.metadata.labels["cost-center"]
msg := sprintf(
"%s '%s' must have label 'cost-center' for cost allocation",
[input.request.kind.kind, input.request.object.metadata.name]
)
}OPA Policy Testing
package kubernetes.admission_test
import rego.v1
test_deny_root_container if {
result := deny with input as {
"request": {
"kind": {"kind": "Pod"},
"object": {
"metadata": {"name": "test-pod"},
"spec": {
"containers": [{
"name": "app",
"image": "nginx@sha256:abc123",
"securityContext": {},
"resources": {"limits": {"memory": "128Mi"}}
}]
}
}
}
}
count(result) > 0
some msg in result
contains(msg, "runAsNonRoot")
}
test_allow_nonroot_container if {
result := deny with input as {
"request": {
"kind": {"kind": "Pod"},
"object": {
"metadata": {"name": "test-pod"},
"spec": {
"containers": [{
"name": "app",
"image": "nginx@sha256:abc123",
"securityContext": {"runAsNonRoot": true},
"resources": {"limits": {"memory": "128Mi"}}
}]
}
}
}
}
count(result) == 0
}Policy-as-Code with Kyverno
Kyverno uses Kubernetes-native YAML for policies. No new language to learn.
Kyverno ClusterPolicy: Image Registry Restriction
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-image-registries
annotations:
policies.kyverno.io/title: Restrict Image Registries
policies.kyverno.io/category: Supply Chain Security
policies.kyverno.io/severity: high
policies.kyverno.io/description: >-
Only allow images from approved registries to prevent
supply chain attacks via untrusted image sources.
spec:
validationFailureAction: Enforce
background: true
rules:
- name: validate-registries
match:
any:
- resources:
kinds:
- Pod
validate:
message: >-
Image '{{ images.containers.*.registry }}' is not from an
approved registry. Allowed: ghcr.io/our-org, registry.internal.company.com
pattern:
spec:
containers:
- image: "ghcr.io/our-org/* | registry.internal.company.com/*"
=(initContainers):
- image: "ghcr.io/our-org/* | registry.internal.company.com/*"
- name: require-digest
match:
any:
- resources:
kinds:
- Pod
validate:
message: "Images must use digest (@sha256:) not tags for reproducibility."
pattern:
spec:
containers:
- image: "*@sha256:*"
- name: add-image-pull-secret
match:
any:
- resources:
kinds:
- Pod
mutate:
patchStrategicMerge:
spec:
imagePullSecrets:
- name: registry-credentialsOPA vs Kyverno Comparison
| Aspect | OPA / Gatekeeper | Kyverno | |--------|-----------------|---------| | Policy Language | Rego (purpose-built) | YAML (K8s-native) | | Learning Curve | Steep (new language) | Gentle (familiar YAML) | | Mutation Support | Limited | First-class | | Generation Support | No | Yes (create resources) | | Image Verification | Via external data | Built-in (cosign/notary) | | Audit Reports | Custom | Built-in PolicyReport | | Multi-cluster | Bundle server | Shared policies via Git | | Best For | Complex logic, multi-system | K8s-only, team adoption |
Supply Chain Security
SBOM Generation with Syft
A Software Bill of Materials (SBOM) catalogs every component in your software. R