Open Policy Agent

Open Policy Agent, usually called OPA, is a general-purpose policy engine. It lets you write rules once and check them across applications, Kubernetes and other parts of a stack.

OPA takes an input and a set of data loaded in memory, evaluates a policy written in the Rego language, and returns a decision. Applications can call it through an SDK or a REST API, which keeps policy logic out of the application code. Security and platform teams can manage shared policies centrally, while developer teams extend them where needed.

• Write policies in the Rego language
• Call it from your app through an SDK or REST API
• Enforce rules in Kubernetes, proxies and CI/CD
• Audit trail of every policy decision
• Replay past decisions for debugging

OPA suits platform and security teams that want shared policies, along with developers who need to extend them. Small projects with a few simple rules may not need a separate policy engine.

OPA is open source under the Apache-2.0 license and is free to use. It is a CNCF graduated project, and the site has an online Rego playground for trying policies in the browser. Rego has a learning curve, so plan time for training if your team is new to policy as code.