Compliance as Code

1 - Concept

1.1 Définition

Compliance as Code = Définir, tester et appliquer les politiques de conformité sous forme de code.

1.2 Avantages

Avantage	Description
Automatisation	Vérifications continues
Cohérence	Même règle partout
Audit Trail	Historique Git
Scalabilité	Des milliers de ressources
Shift Left	Détection précoce

2 - Open Policy Agent (OPA)

2.1 Architecture

2.2 Rego Basics

# policy.rego
package kubernetes.admission

# Deny pods without resource limits
deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not container.resources.limits
    msg := sprintf("Container %v must have resource limits", [container.name])
}

# Deny privileged containers
deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    container.securityContext.privileged == true
    msg := sprintf("Privileged container not allowed: %v", [container.name])
}

# Require specific labels
deny[msg] {
    input.request.kind.kind == "Pod"
    not input.request.object.metadata.labels.app
    msg := "Pod must have 'app' label"
}

2.3 OPA Gatekeeper

# Install Gatekeeper
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper

# ConstraintTemplate
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("Missing required labels: %v", [missing])
        }
---
# Constraint
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-labels
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    labels:
      - "app"
      - "environment"
      - "team"

3 - Kyverno

3.1 Introduction

Kyverno = Policy engine Kubernetes-native (YAML, pas Rego).

3.2 Validate Policies

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: enforce
  rules:
    - name: check-for-labels
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Labels 'app' and 'environment' are required"
        pattern:
          metadata:
            labels:
              app: "?*"
              environment: "?*"

3.3 Mutate Policies

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-securitycontext
spec:
  rules:
    - name: add-securitycontext
      match:
        any:
          - resources:
              kinds:
                - Pod
      mutate:
        patchStrategicMerge:
          spec:
            securityContext:
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
            containers:
              - (name): "*"
                securityContext:
                  allowPrivilegeEscalation: false
                  readOnlyRootFilesystem: true

3.4 Generate Policies

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: generate-networkpolicy
spec:
  rules:
    - name: default-deny
      match:
        any:
          - resources:
              kinds:
                - Namespace
      generate:
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        name: default-deny
        namespace: "{{request.object.metadata.name}}"
        data:
          spec:
            podSelector: {}
            policyTypes:
              - Ingress
              - Egress

4 - Infrastructure Scanning

4.1 Checkov

# Scan Terraform
checkov -d ./terraform/

# Scan Kubernetes
checkov -d ./kubernetes/

# Scan specific framework
checkov -d . --framework terraform

# Custom checks
checkov -d . --external-checks-dir ./custom_checks

# GitHub Action
- name: Checkov
  uses: bridgecrewio/checkov-action@master
  with:
    directory: terraform/
    framework: terraform
    soft_fail: false
    skip_check: CKV_AWS_123

4.2 tfsec

# Scan
tfsec ./terraform/

# Avec severity
tfsec --minimum-severity HIGH ./terraform/

# Output SARIF
tfsec --format sarif ./terraform/ > results.sarif

# GitHub Action
- name: tfsec
  uses: aquasecurity/tfsec-[email protected]
  with:
    soft_fail: false
    working_directory: terraform/

4.3 Terrascan

# Scan
terrascan scan -i terraform -d ./terraform/

# Avec policy set
terrascan scan -p aws -i terraform -d ./terraform/

5 - Compliance Frameworks

5.1 CIS Benchmarks

# Kyverno CIS Policy Example
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: cis-5.2.1-privileged
  annotations:
    policies.kyverno.io/category: CIS
    policies.kyverno.io/description: "CIS 5.2.1 - Minimize privileged containers"
spec:
  validationFailureAction: enforce
  rules:
    - name: privileged-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Privileged mode is not allowed (CIS 5.2.1)"
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "!true"

5.2 SOC 2

Control	Implementation
CC6.1	Access control policies
CC6.6	Network segmentation
CC7.1	System monitoring
CC7.2	Vulnerability management

5.3 PCI-DSS

# PCI-DSS requirement 3.4 - Encryption
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pci-dss-3.4-encryption
spec:
  validationFailureAction: enforce
  rules:
    - name: require-encryption
      match:
        any:
          - resources:
              kinds:
                - Secret
      validate:
        message: "Secrets must be encrypted at rest (PCI-DSS 3.4)"
        deny:
          conditions:
            any:
              - key: "{{ request.object.type }}"
                operator: Equals
                value: "Opaque"

6 - Audit et Reporting

6.1 Kyverno Policy Reporter

# Install Policy Reporter
helm repo add policy-reporter https://kyverno.github.io/policy-reporter
helm install policy-reporter policy-reporter/policy-reporter \
    --set ui.enabled=true \
    --set kyvernoPlugin.enabled=true

6.2 Export des résultats

# Export Checkov
checkov -d . -o json > compliance-report.json
checkov -d . -o junitxml > compliance-junit.xml

# Export OPA
opa eval --data policy.rego --input input.json "data.kubernetes.admission.deny" --format json

6.3 Dashboard Grafana

# Métriques Kyverno
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kyverno
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: kyverno
  endpoints:
    - port: metrics

7 - CI/CD Integration

# Pipeline avec Compliance Checks
stages:
  - lint
  - security
  - compliance
  - deploy

compliance-terraform:
  stage: compliance
  script:
    - checkov -d ./terraform/ --framework terraform
    - tfsec ./terraform/
    - terrascan scan -i terraform -d ./terraform/
  allow_failure: false

compliance-kubernetes:
  stage: compliance
  script:
    - kyverno apply policies/ --resource manifests/
    - checkov -d ./kubernetes/ --framework kubernetes
  allow_failure: false

deploy:
  stage: deploy
  script:
    - kubectl apply -f manifests/
  needs: [compliance-terraform, compliance-kubernetes]
  only:
    - main

Résumé

Dans ce chapitre, nous avons appris :

Le concept Compliance as Code
Open Policy Agent et Rego
Kyverno pour Kubernetes
Les outils de scanning (Checkov, tfsec)
Les frameworks (CIS, SOC 2, PCI-DSS)
L'audit et le reporting

Prochaine étape

Dans le prochain chapitre, nous verrons Incident Response.

→ Chapitre suivant : Incident Response

← Retour à la table des matières

1 - Concept​

1.1 Définition​

1.2 Avantages​

2 - Open Policy Agent (OPA)​

2.1 Architecture​

2.2 Rego Basics​

2.3 OPA Gatekeeper​

3 - Kyverno​

3.1 Introduction​

3.2 Validate Policies​

3.3 Mutate Policies​

3.4 Generate Policies​

4 - Infrastructure Scanning​

4.1 Checkov​

4.2 tfsec​

4.3 Terrascan​

5 - Compliance Frameworks​

5.1 CIS Benchmarks​

5.2 SOC 2​

5.3 PCI-DSS​

6 - Audit et Reporting​

6.1 Kyverno Policy Reporter​

6.2 Export des résultats​

6.3 Dashboard Grafana​

7 - CI/CD Integration​

Résumé​

Prochaine étape​