Protect · Policy engine
Open Policy Agent (OPA)
OPA evaluates Rego policies over JSON input, enabling policy as code for Kubernetes admission (Gatekeeper), Terraform plans, API authorisation and CI checks with one language.
On this page
What it does
Decouples policy decisions from enforcement: any system can ask OPA “is this allowed?” with a JSON document and get a decision.
Where it fits
Protect (admission control via Gatekeeper, service authorisation) and Secure (checking Terraform plans or CI metadata before apply).
Quick start
opa eval -i plan.json -d policy/ 'data.terraform.deny'
opa test policy/ -v
conftest test deployment.yaml # OPA-based testing for config filesCommon pitfalls
- Rego has a learning curve; invest in unit tests (
opa test) for every policy. - For Kubernetes-only use cases Kyverno’s YAML policies are often faster to adopt.