TroveGrid
Back to all tools
Open Policy Agent logo

Open Policy Agent

CNCF policy engine — enforce consistent policies across Kubernetes, APIs, and infrastructure.

0Open Source
Policy & Governance
Official Website View on GitHub
Share:XLinkedInWhatsApp

Overview

Open Policy Agent (OPA) is a CNCF Graduated open-source, general-purpose policy engine that unifies policy enforcement across the stack — from Kubernetes admission control to API authorization and Terraform plan validation using the Rego policy language.

Key Features

  • Rego — a declarative, logic-based policy language with rich query capabilities
  • Kubernetes admission control via Gatekeeper for real-time policy enforcement
  • API authorization for any HTTP API — used at Atlassian, Netflix, Goldman Sachs
  • Terraform plan evaluation to catch policy violations before apply
  • OPA playground for interactive Rego policy development and testing
  • CNCF Graduated with strong SBOM, supply chain, and audit support

Real-World Workflows

Kubernetes admission control policies

  1. 1Install OPA Gatekeeper on the cluster
  2. 2Write a Rego policy: 'all deployments must have resource limits'
  3. 3Create a ConstraintTemplate and Constraint from the policy
  4. 4Kubernetes rejects non-compliant manifests at admission time

API authorization without code changes

  1. 1Deploy OPA as a sidecar or external service
  2. 2Services call OPA with an input document (user, resource, action)
  3. 3OPA evaluates the Rego policy and returns allow/deny
  4. 4Centralized policy logic — change rules without redeploying services

Getting Started

# Install OPA CLI
brew install opa

# Write a policy (policy.rego)
package example
default allow = false
allow if input.user == "alice"

# Evaluate
opa eval -i input.json -d policy.rego 'data.example.allow'

# Start as a server
opa run --server policy.rego

Compare Alternatives

See how Open Policy Agent stacks up against similar tools.

VSkyvernoVSjsPolicyVSpolarisVSkubearmor