Problem

Infrastructure review needs both known-misconfiguration coverage and rules expressing what this environment specifically permits. A green deployment template is not useful evidence unless policy behavior is tested.

Threat model

The lab will consider privileged workloads, unsafe capabilities, mutable images, missing network boundaries, exposed services, unencrypted configuration, and policy bypass during deployment.

Architecture

OpenTofu will represent infrastructure, Helm will render Kubernetes resources, Checkov will identify common configuration risks, and OPA/Rego will evaluate project-specific rules against rendered manifests before deployment to an isolated cluster.

Decisions and trade-offs

Checkov and OPA are complementary, not interchangeable. Checkov supplies maintained checks for common IaC errors; OPA expresses local decisions such as permitted registries, required labels, or workload constraints. Custom policy increases maintenance cost and therefore needs tests and ownership.

Security controls

Planned controls include non-root security contexts, reduced Linux capabilities, read-only filesystems where practical, resource boundaries, network policies, immutable image references, and pre-deployment policy checks.

Validation or attack simulation

Planned negative fixtures will attempt privileged execution, host namespace access, unapproved image sources, missing network policy, and policy input that is incomplete. No validation has run yet.

Evidence

No implementation evidence is available. Expected evidence includes versioned policies, policy unit tests, rendered manifests, scanner output, approved exceptions, and cluster admission results.

Measurements

No measurements have been collected. The lab may measure policy test coverage, rejected negative fixtures, review time, and exception age without turning counts into unsupported security claims.

Limitations

Pre-deployment policy cannot detect every runtime change or application flaw. A lab cluster will not demonstrate production availability, governance, or operating experience.

Next improvements

Define the cluster boundary and five high-value policies, create positive and negative fixtures, then compare pre-deployment results with an admission-control implementation.