# Infrastructure Policy As Code

> Use when implementing policy as code for infrastructure.

- Skill: `loopyluci/infrastructure-policy-as-code` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/infrastructure-policy-as-code`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/infrastructure-policy-as-code/raw
- Safety review: pending (external: skill-scanner WARNING, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/infrastructure-policy-as-code

---


# Infrastructure Policy as Code

Implementing policy as code — from OPA/Rego and Kyverno through compliance checks in CI/CD, admission controllers, and infrastructure governance.

## When to Use

- Enforcing infrastructure compliance (security, cost, naming)
- Automated policy checking in CI/CD pipelines
- Kubernetes admission control
- Multi-cloud policy governance
- Security and compliance automation

## Policy Engines

```python
POLICY_ENGINES = {
    'opa': 'Open Policy Agent — Rego language, versatile, CI + admission control',
    'kyverno': 'Kubernetes-native, YAML policies, mutate/validate/generate',
    'conftest': 'OPA-based, test configuration files in CI (Terraform, K8s, Docker)',
    'sentinel': 'HashiCorp — Terraform Cloud/Enterprise, policy-as-code for IaC',
}

# OPA/Rego example: enforce required labels
REGO_POLICY = """
package kubernetes.admission

deny[msg] {
    input.request.kind.kind == "Deployment"
    not input.request.object.metadata.labels.owner
    msg := "Deployments must specify 'owner' label"
}

deny[msg] {
    input.request.object.metadata.labels.environment
    env := input.request.object.metadata.labels.environment
    not env in ["dev", "staging", "prod"]
    msg := sprintf("Invalid environment: %v", [env])
}
"""

def check_with_conftest(config_path: str, policy_path: str) -> List[str]:
    import subprocess, json
    result = subprocess.run(
        ['conftest', 'test', config_path, '-p', policy_path, '--output', 'json'],
        capture_output=True, text=True
    )
    output = json.loads(result.stdout)
    return [f['message'] for f in output if not f.get('success', True)]
```

## Verification Checklist

- [ ] Policy engine selected (OPA, Kyverno, Conftest, Sentinel)
- [ ] Policies defined for security (public S3 buckets, privileged containers)
- [ ] Policies defined for cost (instance types, regions, tags)
- [ ] CI/CD integration (conftest in pipeline)
- [ ] Admission controller deployed (Kyverno/OPA Gatekeeper)
- [ ] Policy exceptions handling (break-glass procedure)
- [ ] Policy tests written (conftest test cases)