kubescape/regolibrary

Regolibrary is a library of security controls written in Open Policy Agent that Kubescape uses to detect misconfigurations in Kubernetes manifests and running clusters.

The library codifies Kubernetes security best practices derived from prevalent industry security frameworks. It organizes controls hierarchically: frameworks group controls, controls bundle related rules, and rules perform individual tests. Each control and framework can be scoped to run only against specific targets, such as clusters, files, or particular managed cloud platforms like GKE, EKS, or AKS. The controls are written in Rego, OPA's declarative policy language, enabling precise and auditable security policy definitions.

Organizations adopting this tool should understand that it serves as the policy engine backing Kubescape's scanning capabilities. It suits teams already using or planning to adopt Kubescape for Kubernetes security scanning, whether scanning manifests during development or auditing running clusters. The library's framework-based organization allows teams to select which security standards to enforce, and the scanning scope feature enables different policies for different deployment contexts.

The project maintains an active contribution model with documented processes for adding new frameworks, controls, and rules. Contributors can extend the library by adding framework JSON files that reference existing controls, creating new control definitions that group related rules, and implementing individual rule logic in Rego. The release process automatically enriches exported controls with framework metadata, providing observability into which frameworks include each control. The project includes references to supporting infrastructure, such as the control data structures maintained in a separate utilities repository and documentation generation pipelines.