Policy as Code: Automated Compliance Enforcement Using Open Policy Agent Across Multi-Tenant Kubernetes Clusters

Abstract

Regulated industries operating Kubernetes at scale face continuous compliance challenges spanning CIS benchmarks, SOC 2, and PCI-DSS controls. This paper demonstrates a Policy as Code architecture using Open Policy Agent (OPA) and Gatekeeper to enforce 147 compliance controls across multi-tenant Kubernetes clusters in a financial services firm. The policy lifecycle�authoring, testing, staging, and enforcement�is fully integrated into the GitOps delivery pipeline. Automated compliance reporting reduced manual audit effort by 68% and eliminated configuration drift violations within two quarters of deployment. A library of reusable, community-contributed Rego policies and a policy testing harness are released as open-source artefacts.