GitOps for Regulated Environments: How Argo CD and Policy-as-Code Simplify Compliance

# Argo CD Helm values for compliance-ready deployment
server:
  # Enable SSO with your identity provider
  config:
    # SAML/OIDC SSO configuration
    oidc.config: |
      name: Okta
      issuer: https://your-org.okta.com
      clientID: your-client-id
      clientSecret: $oidc.okta.clientSecret
      requestedScopes: ["openid", "profile", "email", "groups"]
    
    # RBAC policy enforcement
    policy.default: role:readonly
    policy.csv: |
      # Only platform team can sync to production
      p, role:platform-admin, applications, sync, production/*, allow
      p, role:platform-admin, applications, *, */*, allow
      
      # Developers can view and create apps in dev/staging
      p, role:developer, applications, get, dev/*, allow
      p, role:developer, applications, get, staging/*, allow
      p, role:developer, applications, create, dev/*, allow
      
      # Read-only access for auditors
      p, role:auditor, applications, get, */*, allow
      p, role:auditor, repositories, get, *, allow
      
      # Map SSO groups to roles
      g, platform-team, role:platform-admin
      g, engineering, role:developer
      g, security-audit, role:auditor
    
    # Webhook for change notifications
    webhook.github.secret: $webhook.github.secret

  # Immutable audit logging to external SIEM
  auditLog:
    enabled: true
    destination: syslog://your-siem.company.com:514

  # Encryption at rest for sensitive data
  config:
    # Store secrets in external secret manager
    repository.credentials: |
      - url: https://github.com/yourorg
        usernameSecret:
          name: github-creds
          key: username
        passwordSecret:
          name: github-creds
          key: token

# Notifications for change tracking
notifications:
  enabled: true
  argocdUrl: https://argocd.company.com
  
  # Notify compliance team of production changes
  subscriptions:
    - recipients:
      - slack:compliance-alerts
      triggers:
      - on-deployed
      - on-sync-failed
      - on-sync-succeeded
      selector: environment=production

# Policy enforcement hooks
repoServer:
  volumes:
    - name: policy-configs
      configMap:
        name: opa-policies
  
  # Conftest for policy-as-code validation
  volumeMounts:
    - mountPath: /policies
      name: policy-configs

# High availability for production
controller:
  replicas: 3
  
redis-ha:
  enabled: true

# Resource limits for stability
resources:
  limits:
    cpu: 2
    memory: 4Gi
  requests:
    cpu: 500m
    memory: 512Mi

# Install Argo CD with compliance configurations
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# Create dedicated namespace with network policies
kubectl create namespace argocd
kubectl label namespace argocd compliance=required

# Apply network policy to restrict traffic
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-network-policy
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: argocd
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 443  # Git repositories
    - protocol: TCP
      port: 6443 # Kubernetes API
EOF

# Install with compliance values
helm install argocd argo/argo-cd \
  --namespace argocd \
  --version 5.51.0 \
  --values argocd-values.yaml \
  --wait

# Verify RBAC is enforced
kubectl exec -n argocd argocd-server-0 -- \
  argocd account list

# Configure audit log forwarding
kubectl apply -f audit-log-forwarder.yaml

package main

import data.kubernetes

# Deny deployments without resource limits (SOC 2 CC7.2 - capacity management)
deny[msg] {
  kubernetes.is_deployment
  container := input.spec.template.spec.containers[_]
  not container.resources.limits
  msg := sprintf("Container '%s' must define resource limits for capacity planning", [container.name])
}

# Deny privileged containers (SOC 2 CC6.1 - least privilege)
deny[msg] {
  kubernetes.is_deployment
  container := input.spec.template.spec.containers[_]
  container.securityContext.privileged == true
  msg := sprintf("Container '%s' cannot run as privileged - violates least privilege", [container.name])
}

# Require security labels for audit trail
deny[msg] {
  kubernetes.is_deployment
  not input.metadata.labels.owner
  msg := "Deployment must have 'owner' label for change attribution"
}

deny[msg] {
  kubernetes.is_deployment
  not input.metadata.labels.data-classification
  msg := "Deployment must have 'data-classification' label (public/internal/confidential)"
}

# Enforce encryption for data at rest (HIPAA §164.312(a)(2)(iv))
deny[msg] {
  kubernetes.is_persistentvolumeclaim
  classification := input.metadata.labels["data-classification"]
  classification == "confidential"
  not input.spec.volumeMode == "Block"
  not regex.match("encrypted", input.spec.storageClassName)
  msg := "PVC with confidential data must use encrypted storage class"
}

# Require network policies for production (PCI-DSS 1.2.1)
deny[msg] {
  kubernetes.is_namespace
  environment := input.metadata.labels.environment
  environment == "production"
  not has_network_policy
  msg := "Production namespaces must have NetworkPolicy for network segmentation"
}

has_network_policy {
  some policy
  kubernetes.networkpolicies[policy].metadata.namespace == input.metadata.name
}

# Enforce image scanning results (SOC 2 CC7.1 - change testing)
deny[msg] {
  kubernetes.is_deployment
  container := input.spec.template.spec.containers[_]
  not container.image contains "@sha256:"
  msg := sprintf("Container '%s' must use digest-pinned image for immutability", [container.name])
}

warn[msg] {
  kubernetes.is_deployment
  container := input.spec.template.spec.containers[_]
  not has_image_scan_annotation
  msg := sprintf("Container '%s' should have image-scan annotation with vulnerability results", [container.name])
}

has_image_scan_annotation {
  input.metadata.annotations["image-scan-status"]
}

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-compliance-labels
  annotations:
    policies.kyverno.io/title: Require Compliance Labels
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      All deployments must have owner, data-classification, and 
      change-ticket labels for audit trail and change management
spec:
  validationFailureAction: enforce
  background: true
  rules:
  - name: check-for-owner-label
    match:
      any:
      - resources:
          kinds:
          - Deployment
          - StatefulSet
          - DaemonSet
          namespaces:
          - "production"
          - "staging"
    validate:
      message: "Label 'owner' is required for change attribution"
      pattern:
        metadata:
          labels:
            owner: "?*"
  
  - name: check-for-data-classification
    match:
      any:
      - resources:
          kinds:
          - Deployment
          - StatefulSet
          namespaces:
          - "production"
    validate:
      message: "Label 'data-classification' must be public, internal, or confidential"
      pattern:
        metadata:
          labels:
            data-classification: "public|internal|confidential"
  
  - name: check-for-change-ticket
    match:
      any:
      - resources:
          kinds:
          - Deployment
          - StatefulSet
          namespaces:
          - "production"
    validate:
      message: "Annotation 'change-ticket' required for production deployments"
      pattern:
        metadata:
          annotations:
            change-ticket: "?*"

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
  annotations:
    policies.kyverno.io/title: Only Allow Approved Image Registries
    policies.kyverno.io/description: >-
      Container images must come from approved registries with 
      vulnerability scanning (PCI-DSS 6.2, SOC 2 CC7.1)
spec:
  validationFailureAction: enforce
  rules:
  - name: validate-registry
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: >-
        Container images must be from approved registries: 
        registry.company.com, gcr.io/company-prod
      pattern:
        spec:
          containers:
          - image: "registry.company.com/*|gcr.io/company-prod/*"

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
  annotations:
    policies.kyverno.io/description: >-
      Containers must define resource limits for capacity 
      management and availability (SOC 2 CC7.2)
spec:
  validationFailureAction: enforce
  rules:
  - name: validate-resources
    match:
      any:
      - resources:
          kinds:
          - Deployment
          - StatefulSet
    validate:
      message: "All containers must define CPU and memory limits"
      pattern:
        spec:
          template:
            spec:
              containers:
              - resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"