Governance & Policy as Code: My DevSecOps Operating System

🔐 DevSecOps Governance Tools Comparison

As a DevSecOps practitioner, it’s critical to choose the right Policy-as-Code tool based on your stack and use case. Below is a comparison of 5 key tools used to enforce governance across CI/CD pipelines, Infrastructure as Code, and Kubernetes.

---

📊 Tool Overview Table

Tool	Ecosystem Fit	Policy Language	Best For	Realtime Enforcement	Difficulty
OPA	Cloud-native (K8s, Terraform)	Rego	Generic policy engine, APIs, Terraform	✅ Yes (via Gatekeeper)	⚙️ Medium
Sentinel	HashiCorp Stack	Sentinel (HCL-like)	Terraform Enterprise, Vault, Consul	✅ Yes	⚙️ Medium
Checkov	Terraform, CloudFormation	YAML + Python	IaC static security checks	❌ No (pre-apply only)	🟢 Easy
Conftest	YAML, JSON, Dockerfiles, etc.	Rego (OPA)	CI/CD config validation	❌ No (CI only)	⚙️ Medium
Kyverno	Kubernetes-native	Declarative YAML	Kubernetes admission policies	✅ Yes	🟢 Easy

---

🛠 Real-World Use Cases

✅ OPA (Open Policy Agent)

• Enforce no unencrypted S3 buckets in Terraform
• Block Kubernetes pods from running as root (via Gatekeeper)
• Apply policies on custom APIs (Envoy/NGINX integration)

# Disallow root containers in Kubernetes
violation[{"msg": msg}] {
  input.spec.securityContext.runAsNonRoot == false
  msg := "Containers must not run as root"
}

---

✅ Sentinel

• Block Terraform plans that don’t tag resources
• Ensure Vault secrets are scoped properly
• Enforce job-level access policies in Nomad

# Enforce tagging policy
main = rule { all resources.r as r { r.tags contains "env" } }

---

✅ Checkov

• Scan Terraform for open security groups
• Ensure RDS has backup retention
• Detect hardcoded secrets

# Checkov finding example
check: CKV_AWS_24
message: Ensure no open security group to 0.0.0.0/0

---

✅ Conftest

• Enforce variables in Ansible playbooks
• Validate GitHub Actions workflows
• Run pre-merge config checks in CI

# Required env variable must exist
deny[msg] {
  not input.env
  msg := "Missing required env key"
}

---

✅ Kyverno

• Block use of latest image tag
• Auto-label all pods with team info
• Enforce CPU/memory limits

# Block latest tag in image
spec:
  validation:
    message: "Avoid using latest tag"
    pattern:
      spec:
        containers:
        - image: "!*:latest"

---

🧠 Summary: How to Choose

Scenario	Start With
General-purpose policies	OPA
You use Terraform Enterprise	Sentinel
Quick IaC scan before deploying	Checkov
Need portable CI/CD policy checks	Conftest
Kubernetes native enforcement	Kyverno

---

🔗 Explore More

• 🌐 openpolicyagent.org
• 🌐 developer.hashicorp.com/sentinel
• 🌐 checkov.io
• 🌐 conftest.dev
• 🌐 kyverno.io

---

Thanks for reading. May your pipelines be green, your infra be tagged, and your security posture be strong!

🔗 Explore my other blogs at opsbygandal.dev
📁 Check out the GitHub repo [https://github.com/gandalops/portfolio-chirpy]
🔄 Let’s connect on LinkedIn

---