Policies & Compliance

Define and enforce infrastructure policies across Terraform, Ansible configurations, and Kubernetes clusters. ops0 evaluates policies before deployments, enforces Kyverno rules on clusters, and tracks violations in the compliance dashboard.

Policy Types

The Policies page organizes policies into tabs by infrastructure type:

Severity Levels

Policy Categories

AI Policy Generation

Generate policies automatically using natural language prompts. ops0 produces valid Rego or Kyverno YAML based on your description.

Policy Groups

Organize policies into named groups and attach groups to projects. This lets you manage policy assignments at scale instead of mapping individual policies.

How Groups Work

• Create a group and add policies to it
• Map the group to one or more projects
• All policies in the group apply to every mapped project
• Toggle the group to enable/disable all policies at once

Effective Policies

A project's effective policies are the union of:

• Policies directly mapped to the project
• Policies inherited from policy groups mapped to the project

View a project's effective policies at Policies → By Project.

Policy Templates

ops0 includes a library of built-in policy templates for common compliance and security scenarios. Import templates instead of writing policies from scratch.

Compliance Frameworks

Import pre-built compliance frameworks that map industry standards to ops0 policies. Each framework contains controls specific to a cloud provider or platform.

Kyverno Policies (Kubernetes)

For Kubernetes clusters, ops0 supports Kyverno policies written in YAML. Kyverno runs natively in the cluster and enforces policies at admission time.

Policy Diagnostics

The Policy Diagnostics modal shows the health of Kyverno on a cluster:

• Kyverno installation status
• Deployed policies and their enforcement modes
• Webhook verification status
• Per-rule detail and status

Policy Actions

Policy Check History

View a log of all policy evaluations across projects. The history shows:

• Which policies ran and their results (pass/fail)
• The project and deployment that triggered the check
• Timestamps and duration
• Violation details for failed checks

Access at Policies → Check History.

Example: Blocking an Insecure S3 Bucket

The Policy

package ops0.terraform.s3

deny[msg] {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    not resource.values.server_side_encryption_configuration

    msg := sprintf(
        "S3 bucket '%s' must have encryption enabled",
        [resource.values.bucket]
    )
}

Policy Settings

Name:         S3 Encryption Required
Type:         IaC (Terraform)
Category:     Security
Severity:     Error

Deployment Blocked

Terraform Plan: 1 to add, 0 to change, 0 to destroy

Policy Evaluation
─────────────────────────────────────
✗ FAILED - S3 Encryption Required (Error)

Violations:
  • S3 bucket 'company-data-bucket' must have encryption enabled

Deployment blocked. Fix violations and retry.

Related