Runbook 02 — Enterprise Policy Review

Runbook Information

Item	Details
Runbook ID	K8S-COMPLIANCE-RUNBOOK-02
Runbook Type	Enterprise Governance Review
Difficulty	Advanced
Estimated Time	6–8 Hours
Environment	Enterprise Kubernetes Clusters
Platform	Kubernetes, Kyverno, Gatekeeper, Pod Security Admission, kubectl
Primary Role	Kubernetes Security Engineer
Supporting Roles	Platform Engineer, DevSecOps Engineer, Cloud Security Engineer, Compliance Analyst, Enterprise Architect
Module	Kubernetes Benchmarks, Governance & Compliance
Previous Runbook	Runbook 01 — Kubernetes Compliance Assessment
Next Runbook	Runbook 03 — Governance Audit
Review Frequency	Quarterly or After Major Policy Changes
Classification	Internal – Confidential

Executive Summary

Enterprise Kubernetes environments typically contain dozens or hundreds of security policies enforcing organisational standards.

These policies may include:

Kyverno ClusterPolicies
Kyverno Policies
OPA Gatekeeper Constraints
ConstraintTemplates
Pod Security Admission
NetworkPolicies
Image Verification Policies
Registry Restrictions
Resource Governance
Namespace Governance
Secrets Governance

Over time, policy sprawl becomes common.

Different business units often create:

Duplicate policies
Conflicting rules
Expired policies
Disabled policies
Unowned policies
Audit-only policies
Excessive exclusions
Inconsistent enforcement

This runbook provides a structured enterprise methodology for reviewing the complete Kubernetes policy ecosystem to ensure policies remain:

Secure
Consistent
Governed
Documented
Tested
Approved
Effective

Enterprise Scenario

CloudNova Technologies has operated Kubernetes across multiple regions for several years.

Numerous platform teams have independently created security policies.

During an internal governance review the following issues were identified:

Similar policies implemented in both Kyverno and Gatekeeper
Production clusters using different policy versions
Multiple policies left permanently in Audit mode
Namespace exclusions growing without review
Temporary exceptions becoming permanent
Policy ownership no longer accurate
Image verification enabled only in selected clusters
Missing documentation for critical controls
Inconsistent policy testing before deployment
No formal policy lifecycle

The CISO requests an enterprise policy review.

Objectives

This runbook enables security teams to:

Inventory every Kubernetes policy
Review policy ownership
Review policy lifecycle
Validate policy enforcement
Identify duplicate policies
Detect policy conflicts
Review exceptions
Validate policy testing
Assess policy maturity
Review policy consistency
Validate production readiness
Produce executive governance reports

Enterprise Policy Governance Architecture

                   Enterprise Security Governance

                              │

                              ▼

                     Kubernetes Policy Board

                              │

        ┌─────────────────────┼────────────────────┐

        │                     │                    │

 Platform Team         Cloud Security      DevSecOps

        │                     │                    │

        └─────────────────────┼────────────────────┘

                              │

                              ▼

                Kubernetes Policy Repository

      ┌─────────────────────────────────────────────┐

      │ Kyverno Policies                            │

      │ Gatekeeper Constraints                      │

      │ Pod Security Admission                      │

      │ Network Policies                            │

      │ Image Verification                          │

      │ Admission Webhooks                          │

      │ Resource Policies                           │

      └─────────────────────────────────────────────┘

                              │

                              ▼

               Development → Testing → Production

                              │

                              ▼

                    Continuous Governance Review

Policy Review Workflow

Collect Policies

      │

      ▼

Inventory Policies

      │

      ▼

Review Ownership

      │

      ▼

Review Enforcement

      │

      ▼

Review Exceptions

      │

      ▼

Review Testing

      │

      ▼

Review Compliance Mapping

      │

      ▼

Identify Gaps

      │

      ▼

Assign Risk

      │

      ▼

Approve Remediation

Review Principles

Every enterprise policy should have:

Clear owner
Business purpose
Technical justification
Version history
Change approval
Testing evidence
Production approval
Compliance mapping
Risk classification
Review schedule

Review Scope

The assessment includes:

ClusterPolicies
Namespaced Policies
ConstraintTemplates
Constraints
Admission Controllers
Pod Security Admission
Network Policies
Image Verification Policies
Registry Policies
Resource Policies
Namespace Standards
Exceptions
Policy Reports

Required Tools

Tool	Purpose
kubectl	Export policies
Kyverno	Policy review
Gatekeeper	Constraint review
jq	JSON analysis
Git	Version history
Helm	Installed components
VS Code	YAML review

Recommended Folder Structure

runbook-02-enterprise-policy-review/

├── inventory/
│   ├── kyverno.md
│   ├── gatekeeper.md
│   ├── admission.md
│   ├── network.md
│   └── image-policies.md
│
├── evidence/
│   ├── clusterpolicies.yaml
│   ├── policies.yaml
│   ├── constraints.yaml
│   ├── templates.yaml
│   ├── webhooks.yaml
│   ├── policyreports.yaml
│   └── audit.txt
│
├── assessment/
│   ├── ownership.md
│   ├── lifecycle.md
│   ├── enforcement.md
│   ├── exceptions.md
│   ├── maturity.md
│   └── consistency.md
│
└── reports/
    ├── findings.md
    ├── policy-scorecard.md
    ├── remediation.md
    └── executive-report.md

Phase 01 — Policy Discovery

Step 01 — Export Kyverno ClusterPolicies

kubectl get clusterpolicies \
-o yaml \
> evidence/clusterpolicies.yaml

Review:

Count
Status
Ready state
Version
Owner
Validation mode

Step 02 — Export Kyverno Policies

kubectl get policies \
-A \
-o yaml \
> evidence/policies.yaml

Step 03 — Export Gatekeeper ConstraintTemplates

kubectl get constrainttemplates \
-o yaml \
> evidence/templates.yaml

Step 04 — Export Constraints

kubectl get constraints \
-o yaml \
> evidence/constraints.yaml

Step 05 — Export Admission Webhooks

kubectl get validatingwebhookconfigurations \
-o yaml \
> evidence/webhooks.yaml

kubectl get mutatingwebhookconfigurations \
-o yaml \
>> evidence/webhooks.yaml

Phase 02 — Policy Inventory

For every policy capture:

Attribute	Description
Policy Name
Policy Engine
Namespace
Version
Owner
Severity
Enforcement Mode
Created
Last Updated
Review Date
Compliance Mapping

Phase 03 — Ownership Review

Validate:

Security Owner
Platform Owner
Business Owner
Policy Maintainer

Flag policies where:

Owner missing
Owner inactive
Owner unknown

Phase 04 — Enforcement Review

Review:

Audit mode
Enforce mode
Failure Policy
Namespace exclusions
Resource exclusions
Background scanning
Policy Reports

Questions:

Is production protected?
Are policies actually enforced?
Are policies permanently left in Audit?

Phase 05 — Duplicate Policy Review

Identify duplicate controls such as:

Two non-root policies
Multiple privileged policies
Multiple image restrictions
Duplicate resource-limit policies

Document:

Policy A	Policy B	Risk

Phase 06 — Conflict Analysis

Review for conflicts such as:

Example:

Kyverno:

Require Image Digest

Gatekeeper:

Allow Mutable Tags

Conflicting policies create:

Unexpected admission failures
Operational issues
Compliance confusion

Phase 07 — Exception Review

Every exception should contain:

Exception ID

Policy

Namespace

Owner

Business Justification

Risk

Approval

Start Date

Expiry Date

Review Date

Review:

Expired exceptions
Missing owners
Missing approvals
Permanent exceptions

Phase 08 — Policy Testing

Review whether policies were tested:

Development

↓

Testing

↓

Staging

↓

Production

Evidence required:

Test manifests
CI/CD results
Unit tests
Regression tests

Phase 09 — Policy Lifecycle

Every policy should have:

Created

↓

Reviewed

↓

Approved

↓

Implemented

↓

Validated

↓

Production

↓

Periodic Review

↓

Retired

Review:

Draft policies
Deprecated policies
Unused policies
Disabled policies

Phase 10 — Policy Consistency

Compare clusters:

Production

↓

Staging

↓

Development

Review:

Policy versions
Exceptions
Enforcement
Owners
Images
Registries

Phase 11 — Compliance Mapping

Review mappings to:

CIS Kubernetes Benchmark
NIST
ISO 27001
PCI DSS
SOC2
Internal Standards

Example:

Policy	CIS	NIST	ISO
Non-root	✔	✔	✔

Phase 12 — Policy Maturity

Rate each area.

Area	Score
Ownership
Documentation
Enforcement
Testing
Automation
Exceptions
Reporting
Lifecycle

Phase 13 — Risk Classification

Critical

Policy deleted
Production bypass
Missing admission controller
No ownership

High

Audit only
Large exclusions
Duplicate policies

Medium

Missing documentation
Weak testing

Low

Formatting
Metadata

Phase 14 — Executive Scorecard

Area	Status
Ownership
Enforcement
Testing
Exceptions
Governance
Documentation
Automation
Compliance

Findings Register

ID	Finding	Severity	Owner	Status

Remediation Roadmap

Immediate

Remove expired exceptions
Enable enforcement
Restore deleted policies

Short Term

Standardise policies
Assign owners
Complete documentation

Medium Term

Centralise policy management
Improve automation
Implement policy testing

Long Term

Multi-cluster governance
Automated policy drift detection
Policy dashboards
GRC integration

Enterprise Policy Review Checklist

Review Item	Status
Policies inventoried	☐
Owners verified	☐
Enforcement reviewed	☐
Exceptions reviewed	☐
Duplicate policies removed	☐
Conflicts resolved	☐
Compliance mapping complete	☐
Testing validated	☐
Lifecycle reviewed	☐
Documentation updated	☐
Executive report completed	☐

Success Criteria

The policy review is complete when:

All policies are inventoried.
Every policy has an owner.
Enforcement is validated.
Exceptions are reviewed.
Policy conflicts are resolved.
Testing evidence exists.
Compliance mappings are complete.
Governance score is calculated.
Executive report is approved.

Knowledge Check

Question 1

Why should every policy have an owner?

Answer: To ensure accountability for maintenance, review, updates, and risk decisions throughout the policy lifecycle.

Question 2

What is the risk of leaving critical policies permanently in Audit mode?

Answer: Violations are recorded but not prevented, allowing insecure resources to be admitted into the cluster.

Question 3

Why should duplicate policies be removed?

Answer: Duplicate policies increase operational complexity, can produce conflicting results, and make governance harder to maintain.

Question 4

What is policy drift?

Answer: Policy drift occurs when different clusters or environments no longer enforce the same approved security policies or policy versions.

Question 5

Why should policy exceptions have expiry dates?

Answer: Expiry dates ensure temporary business exceptions are reviewed and removed instead of becoming permanent security weaknesses.

Runbook Summary

This runbook established a structured enterprise process for reviewing Kubernetes security policies across Kyverno, OPA Gatekeeper, Pod Security Admission, admission webhooks, NetworkPolicies, and image-governance controls.

The review focused on:

Policy discovery and inventory
Ownership and accountability
Enforcement validation
Duplicate and conflicting policies
Exception governance
Policy lifecycle management
Compliance mapping
Multi-cluster consistency
Governance maturity
Executive reporting

By completing this runbook, security teams can ensure that Kubernetes policies remain consistent, enforceable, well-governed, and aligned with organisational security and compliance requirements.

What’s Next?

Next Runbook: Runbook 03 — Enterprise Governance Audit

In the next runbook, you will conduct a full enterprise governance audit covering organisational governance, operational processes, compliance oversight, audit readiness, executive reporting, policy effectiveness, risk management, and continuous improvement across Kubernetes environments.