Project Name
Passing SOC 2 With OPA Gatekeeper Compliance Automation
The client is a growth-stage B2B software company based in the United States, operating a multi-tenant SaaS platform for enterprise workflow automation. The platform runs on Kubernetes across 30-plus clusters, including production, staging, and customer-dedicated environments, managed by a platform engineering team of 12.
The company was pursuing SOC 2 Type II certification as a prerequisite for enterprise sales to financial services and healthcare customers. Previous attempts to document security controls had produced a comprehensive policy document and a Confluence wiki, but neither constituted the continuous, automated enforcement evidence that auditors require for a credible SOC 2 Type II submission.
The compliance team was spending four weeks before each audit cycle manually reviewing kubectl describe outputs, scanning pod security contexts, and assembling evidence spreadsheets, a process their auditor noted was “convincing about intent but not about enforcement.”
The company faced critical gaps between documented security policies, technical enforcement, and the continuous evidence required for SOC 2 Type II compliance.
- Manual Security Reviews Unconvincing to SOC 2 Auditors: Documented policies covered container security, image provenance, and access controls, but quarterly manual kubectl reviews provided only point-in-time evidence, falling short of the continuous enforcement expected for SOC 2 Type II.
- Inconsistent Enforcement Across 30+ Clusters: Manual enforcement across 30+ Kubernetes clusters led to configuration differences. Policies enforced on production were sometimes missing from customer-dedicated clusters, creating control gaps and audit concerns.
- Four-Week Evidence Assembly Before Every Audit: The compliance team spent four weeks collecting kubectl outputs, image scan results, security context reviews, and RBAC exports. The process was time-consuming, error-prone, and produced fragmented point-in-time evidence.
- SOC 2 Controls Not Mapped to Technical Enforcement: Policies defined requirements such as "no containers run with elevated privileges," but lacked a technical enforcement mechanism. Auditors could not verify whether documented controls matched actual system behavior.
- Image Provenance and Registry Controls Not Enforced: The company had no technical control preventing engineers from deploying images directly from unapproved public registries, allowing deployments to bypass the approved CI/CD pipeline and weakening CC6.8 controls.
Ksolves, an AI-first DevOps consulting services company, structured the engagement into three phases: control mapping, policy implementation, and evidence automation. The approach mapped SOC 2 requirements to enforceable OPA Gatekeeper policies, implemented 28 Rego policies across 30+ clusters, and automated evidence collection, reducing audit preparation from four weeks to one hour.
- SOC 2 Control Mapping: Conducted a three-day workshop with the compliance and platform teams to map each relevant SOC 2 Trust Service Criterion to an enforceable Kubernetes control. The resulting control catalogue defined what each control must verify, what constitutes a violation, and became the specification for all 28 Rego policies.
- 28 Rego Policies Implemented and Tested: All 28 policies were implemented as OPA Rego rules with opa test unit tests covering compliant and non-compliant paths. CI enforced 100% rule coverage before deployment. Each violation message included the SOC 2 control reference and an internal runbook link.
- Progressive Deployment - Audit Then Enforce: Policies were initially deployed in dry-run audit mode across all 30+ clusters. Two weeks of findings identified 147 violating resources, including missing resource limits and unapproved image tags. After remediation, policies were progressively switched to deny enforcement.
- Uniform Deployment via ArgoCD: ConstraintTemplates and Constraints were managed in a dedicated GitLab policy repository and deployed across all 30+ clusters through ArgoCD. Every change required peer-reviewed merge requests, while Git history provided an auditable record of policy changes.
- Namespace-Scoped Enforcement for Production Tiers: Strict controls, including read-only root filesystems, approved image tags, and required probes, were enforced in production namespaces. Staging and development used a lighter policy subset with warn enforcement to reduce developer friction.
- Gatekeeper Audit Controller as Continuous Compliance Monitor: Gatekeeper's audit controller evaluated cluster resources against active Constraints every 60 seconds. Violation details were stored in Constraint status, providing continuous compliance evidence instead of quarterly snapshots and supporting SOC 2 CC7 monitoring requirements.
- Prometheus Metrics for Trend Analysis and Compliance Dashboards: Gatekeeper metrics were scraped every 30 seconds and visualized in Grafana. The dashboard tracked violations by SOC 2 control, trends over time, policy coverage, and per-cluster compliance health, with weekly review by the VP of Compliance.
- Automated Evidence Pack Generation: A Python script queried Gatekeeper and GitLab to generate a structured SOC 2 evidence pack containing policy mappings, 90-day violation history, Git version history, continuous monitoring metrics, and per-cluster compliance attestations. The complete pack was generated in under one hour.
Technology Stack
| Category | Technology |
|---|---|
| Policy Engine | OPA Gatekeeper + Rego |
| GitOps CD | ArgoCD |
| Policy Testing | OPA test + Conftest |
| Observability | Prometheus + Grafana |
| Evidence | Automated Evidence Pack (Python + Gatekeeper API) |
| Source Control | GitLab + Policy Repository |
From inconsistent manual reviews, 147 previously undetected violations, and four weeks of audit preparation to SOC 2 Type II passed on the first attempt with zero Kubernetes-related findings.
- SOC 2 Type II Passed on First Attempt: Auditors reviewed the Gatekeeper dashboard, automated evidence pack, policy Git history, and Prometheus trends, resulting in a first-attempt SOC 2 Type II pass with zero findings against the Kubernetes environment.
- All 30+ Clusters Running Identical, Auditable Policies: ArgoCD ensured all clusters ran the same 28 Constraints at the same version, detecting and correcting policy drift within minutes and eliminating inconsistent security configurations.
- Evidence Assembly Cut From Four Weeks to Under One Hour: The automated evidence pack generated a complete 90-day compliance record, including policy history, violation trends, and cluster attestations, in under one hour instead of four weeks.
- 147 Pre-Existing Policy Violations Discovered and Remediated: The two-week audit-mode deployment identified 147 violations across 30 clusters that manual reviews had missed, including missing resource limits and unapproved image tags.
- Continuous Compliance Monitoring Supporting SOC 2 CC7: Gatekeeper's 60-second audit cycle and Prometheus dashboards provided continuous compliance visibility and historical violation trends, replacing quarterly reviews with ongoing monitoring evidence.
This engagement transformed SOC 2 compliance from a manual, point-in-time exercise into a continuously enforced security process. Ksolves mapped 28 SOC 2 controls to enforceable Gatekeeper policies, deployed them consistently across 30+ clusters, and automated evidence collection, reducing audit preparation from four weeks to under one hour. Most importantly, the approach uncovered and remediated 147 previously missed violations and helped the client achieve SOC 2 Type II certification on the first attempt with zero Kubernetes-related findings.
Is Your SOC 2 Compliance Programme Still Relying on Manual Reviews That Auditors Find Unconvincing?
