adaptive-enforcement-lab/policy-as-code-template-library
plugins/enforce/skills/policy-as-code-template-library/SKILL.md
Production-ready policy template library: 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration.
development
Updated Mar 27, 2026
$ install --global
skillsauthnpx skillsauth add adaptive-enforcement-lab/claude-skills policy-as-code-template-libraryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 10:43 AM36.4s5 files scanned
SKILL.md
- name:
- policy-as-code-template-library
- description:
- >-
- Production-ready policy template library:
- 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration.
Policy-as-Code Template Library
When to Use This Skill
48 production-ready policies for Kubernetes security and governance. Reduce the Rego learning curve. Copy, customize, deploy.
<!-- more -->Template Library Overview
This library contains 28 Kyverno policies and 20 OPA/Gatekeeper constraint templates covering pod security, image validation, RBAC, resource governance, network security, mutation, and generation. Each template includes complete YAML/Rego, customization variables, validation commands, and real-world use cases.
Implementation
Deploy in Audit Mode First
Always start with
audit(Kyverno) ordryrun(OPA) mode. Monitor violations for 48 hours before switching to enforcement. Existing workloads may violate policies.
Kyverno Quick Start (5 minutes)
See examples.md for detailed code examples.
OPA/Gatekeeper Quick Start (10 minutes)
See examples.md for detailed code examples.
Comparison
Choose the right policy engine for your team:
| Feature | Kyverno | OPA/Gatekeeper | |---------|---------|----------------| | Policies | 28 (validation, mutation, generation) | 20 (validation only) | | Language | YAML + JMESPath | Rego (Go-like DSL) | | Learning Curve | < 1 hour | 4-8 hours | | Best For | Kubernetes-native teams, fast adoption | Multi-platform policies, complex logic | | Mutation | ✅ Native support | ❌ Validation only | | Generation | ✅ Auto-create resources | ❌ Validation only |
See Decision Guide → for detailed comparison and recommended starter paths.
Examples
See examples.md for code examples.
Full Reference
See reference.md for complete documentation.
Related Patterns
- Kyverno Official Documentation
- OPA/Gatekeeper Documentation
- Kubernetes Pod Security Standards
- NIST SP 800-190
- CIS Kubernetes Benchmark
References
- Source Documentation
- AEL Enforce
Related Skills
adaptive-enforcement-lab/workload-identity-federation-implementation
documentation
VerifiedTrustedCommunity
Workload Identity Federation implementation guide. GKE setup, IAM bindings, ServiceAccount configuration, migration from service account keys, and troubleshooting patterns.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/workflow-trigger-security
development
VerifiedTrustedCommunity
Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/third-party-action-risk-assessment
development
VerifiedTrustedCommunity
Structured framework for evaluating GitHub Actions security before adoption. Trust tiers, risk assessment checklist, and decision tree for action evaluation.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/storing-credentials
testing
VerifiedTrustedCommunity
Securely store GitHub App credentials across different environments. GitHub Actions secrets, external CI, Kubernetes, and automated rotation patterns.
SKILL.mdUpdated Mar 27, 2026