Open Policy Agent (OPA)
What is Open Policy Agent?
Open Policy Agent (OPA) is an open-source, general-purpose policy engine that evaluates policy as code across software stacks. It separates policy logic from application code, so teams can write, test and update rules in one place and apply them consistently across Kubernetes, APIs, CI/CD pipelines and cloud infrastructure. OPA is a graduated project of the Cloud Native Computing Foundation (CNCF).
Why does OPA matter?
Decoupling policy from code: Policies live outside the application, so teams can change a rule without redeploying the software that enforces it. Developers write features; security and platform teams own the rules.
One language across systems: OPA's language, Rego, expresses rules for Kubernetes, microservices, CI pipelines and infrastructure. Teams learn one way to write, test and review policy instead of a different rule format for every tool.
What is OPA used for?
Kubernetes admission control: OPA (often via the Gatekeeper project) checks resources as they're created or updated before it's admitted to a cluster, blocking unapproved container images, privileged pods or missing labels.
API and microservice authorization: OPA sits alongside a service or API gateway and decides whether each request is allowed, so authorization logic is consistent across services instead of being reimplemented in each one.
Infrastructure and CI/CD checks: OPA validates Terraform plans, configuration files and deployment manifests in the pipeline, catching policy violations before anything reaches production.
How does OPA work?
Policy language: Rego is OPA's declarative policy language. Rules describe what should be true about a request rather than the steps to check it, and they can evaluate any structured data.
Decision time: A service sends OPA a query with the request details as JSON. OPA evaluates it against the loaded policies and data and returns a decision, typically allow or deny, which the calling service enforces. OPA runs as sidecar, host-level daemon or embedded library, so decisions happen locally in milliseconds.
What are the benefits of OPA?
Stack-wide integration: OPA integrates with Kubernetes, Envoy and other API gateways. Terraform, CI systems and cloud platforms. One policy engine and one language across much of the stack.
Audit trails: When decision log is enabled, OPA logs every decision with the input and policy that produced it, and policies are versioned like code, so auditors and engineers can see what was enforced, when and why.
Policy testing: Rego policies can be unit-tested and reviewed in pull requests before they're deployed, so a bad rule is caught in CI rather than in production.
Open Policy Agent resources
Blogs
How Policy-based Access Control Improves Agility and Security