rulehub-policies

RuleHub curated Gatekeeper & Kyverno policy collection for Kubernetes clusters

Why this repository

Accelerate security and compliance for Kubernetes with a ready-to-use, industry‑curated policy pack. This chart packages proven policies for Kyverno and Gatekeeper, helping platform and security teams reach a compliant baseline fast, with confidence and a clean upgrade path.

Who is it for

• Platform/SRE teams standardizing cluster guardrails
• Security & compliance leaders in regulated industries (FinTech/AML, Healthcare, EdTech, iGaming)
• Builders who want deterministic, signed, and test‑covered policy delivery

What you get

• One chart, two engines: Kyverno and Gatekeeper supported out of the box
• Policy profiles for domains like AML/FinTech to enable focused, low‑noise rollouts
• Deterministic builds with integrity: SBOM, signatures, provenance (release pipeline)
• Unit tests and schema validation baked into the workflow
• Clear, versioned releases with changelogs

How it fits into RuleHub

• This repository delivers the Helm chart that installs policy sets into clusters.
• The core project (RuleHub) curates the catalog, metadata, tests, and integrity assets.
• The Backstage plugin provides a read‑only catalog UI powered by the published index.

Learn more:

• RuleHub (core): ../rulehub
• Backstage plugin: ../rulehub-backstage-plugin

Profiles-only rendering (Kyverno & Gatekeeper)

The chart supports a profiles-first, deterministic render mode for both engines:

• kyverno.useProfilesOnly: when true, ignores kyverno.policies and renders only policies enabled via activeProfiles.
• gatekeeper.useProfilesOnly: when true, ignores gatekeeper.policies and renders only constraints/templates enabled via activeProfiles.

Example values snippet to render only the AML/FinTech profile across both engines:

activeProfiles:
  - aml-fintech

kyverno:
  useProfilesOnly: true

gatekeeper:
  useProfilesOnly: true

Configuration

See the full values reference in VALUES_TABLE.md. It is generated from values.yaml and the schema. To update it locally:

make values-table
# or
./hack/gen/gen-values-table.sh