Open Policy Agent
What is this?
OPA (Open Policy Agent) is an open source, general-purpose policy engine that lets you enforce policies — like 'can user X do Y on resource Z?' — consistently across your whole stack via a declarative policy language called Rego.
OPA (Open Policy Agent) is an open source, general-purpose policy engine that lets you enforce policies — like 'can user X do Y on resource Z?' — consistently across your whole stack via a declarative policy language called Rego.Is it a library I embed, or a standalone server I query?Both: you can run OPA as a standalone CLI/server that your services query over a REST API, or embed it directly via the Go SDK/API if your service is written in Go.
Both: you can run OPA as a standalone CLI/server that your services query over a REST API, or embed it directly via the Go SDK/API if your service is written in Go.How do I get started with OPA?Try Rego in the browser via the Rego Playground, install the VS Code extension for local editing, or follow the 'Running OPA' docs to get the CLI running; container images are on Docker Hub and binaries are on GitHub releases.
Try Rego in the browser via the Rego Playground, install the VS Code extension for local editing, or follow the 'Running OPA' docs to get the CLI running; container images are on Docker Hub and binaries are on GitHub releases.Do I need to write my own rules, or does it come with built-in policies?You write the rules yourself in Rego and supply the data; OPA has no built-in policy logic out of the box.
You write the rules yourself in Rego and supply the data; OPA has no built-in policy logic out of the box.What integration pitfall should I expect?OPA doesn't auto-enforce anything — your service must be modified to query OPA and then act on the allow/deny decision it returns, which means integration work on your side for each system (Kubernetes, Terraform, Docker, SSH, etc.).
OPA doesn't auto-enforce anything — your service must be modified to query OPA and then act on the allow/deny decision it returns, which means integration work on your side for each system (Kubernetes, Terraform, Docker, SSH, etc.).Who typically uses this?Platform and security engineers building authorization/compliance controls into cloud-native systems; it's a CNCF graduated project used in production by many organizations.
Platform and security engineers building authorization/compliance controls into cloud-native systems; it's a CNCF graduated project used in production by many organizations.Is OPA tied to Kubernetes, or can I use it anywhere?OPA is general-purpose and integrates with many systems beyond Kubernetes, including Terraform, Docker, and SSH.
OPA is general-purpose and integrates with many systems beyond Kubernetes, including Terraform, Docker, and SSH.What is Rego?Rego is OPA's high-level declarative policy language used to author the rules that OPA evaluates to make allow/deny decisions.
Rego is OPA's high-level declarative policy language used to author the rules that OPA evaluates to make allow/deny decisions.Has OPA's security been audited?Yes, a third-party security audit was performed by Cure53, and the full report is published; vulnerabilities can be reported by email to the OPA security team.
Yes, a third-party security audit was performed by Cure53, and the full report is published; vulnerabilities can be reported by email to the OPA security team.What kind of questions does OPA help answer?Policy questions like whether a user can call a given operation on a resource, which clusters a workload should deploy to, or what tags a resource must have before creation.
Policy questions like whether a user can call a given operation on a resource, which clusters a workload should deploy to, or what tags a resource must have before creation.What are similar projects?meshery, apisix, encore, microservices-demo, istio, linkerd2, agent-safe-pipeline, hydra
meshery, apisix, encore, microservices-demo, istio, linkerd2, agent-safe-pipeline, hydraWhich topics is it in?authorization, declarative, compliance, terraform, cloud-native, microservices, json, kubernetes, rest-api, devops, go, security
authorization, declarative, compliance, terraform, cloud-native, microservices, json, kubernetes, rest-api, devops, go, security