Open Policy Agent

Visit Website

Introduction

Open Policy Agent is a general-purpose policy engine. It gives you a high-level declarative language, Rego, for writing rules, and an engine that evaluates those rules against any structured JSON input. The README stresses the benefit of decoupling policy from application logic: platform and security teams manage shared policies centrally while developer teams extend them.

OPA is not tied to one system. The same engine can decide whether a Kubernetes manifest is allowed, whether an HTTP request should be authorised, whether a Terraform plan may be applied, or whether a CI job may deploy. Integrations exist for Kubernetes admission control (through Gatekeeper), Envoy, Terraform, Kafka and many others, and you can embed OPA as a Go library or run it as a sidecar or server with a REST API.

For quality and release checks, the most relevant features are the opa test command, which runs unit tests written in Rego, and opa eval, which evaluates a policy against an input file in a pipeline. Policies can be bundled, versioned and distributed to many OPA instances, and decision logs record what was decided and why.

Rego is the main learning curve. It is a declarative query language inspired by Datalog, and writing it well takes practice. Recent versions moved to Rego v1 syntax by default, which makes policies more readable with keywords such as if and contains.

In the quality loop, OPA is the engine behind policy-as-code gates: misconfigurations, missing labels, insecure settings and disallowed resources are caught in CI or at admission instead of in production. Tools such as Conftest and Gatekeeper build on it for specific use cases.

The source code is at open-policy-agent/opa on GitHub under the Apache-2.0 licence, with about 12,500 stars; the most recent commit was on 10 November 2026.

Features

1. Rego language: Declarative rules over JSON and YAML data, with helpers for strings, sets, JWTs and more.
2. Policy unit tests: opa test runs Rego test rules with coverage reporting.
3. CLI evaluation: opa eval evaluates policies against files in CI pipelines.
4. REST server: Run OPA as a service and query decisions over HTTP.
5. Go library: Embed the engine directly in Go applications.
6. Bundles: Package and distribute policies and data to many OPA instances.
7. Decision logs: Record each decision for audit and debugging.
8. Kubernetes admission: Used by Gatekeeper to validate and mutate resources.
9. Ecosystem integrations: Envoy, Terraform, Kafka, CI systems and many others.
10. Editor tooling: Language server and plugins for popular editors, plus the Rego Playground.

Pros

1. One engine everywhere: A single policy language can cover infrastructure, APIs and pipelines.
2. CNCF graduated: A widely adopted, well-governed project.
3. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
4. Actively maintained: The repository had commits as recent as 10 November 2026.
5. Community: About 12,500 GitHub stars.

Cons

1. Rego learning curve: The language is unfamiliar to most developers at first.
2. Bring your own policies: OPA ships the engine; you still have to write or source rules.
3. Debugging complex rules: Large policy sets can be hard to reason about without good tests.
4. Integration work: Each enforcement point needs its own integration or wrapper tool.

Usage and Links (Example)

A policy and its test:

package deploy

default allow := false

allow if {
  input.image_tag != "latest"
  input.replicas >= 2
}

package deploy_test
import data.deploy

test_rejects_latest if {
  not deploy.allow with input as {"image_tag": "latest", "replicas": 3}
}

Run in CI:

opa test policy/ -v
opa eval -d policy/ -i deploy.json "data.deploy.allow"

Practical tips:

1. Write a Rego test for every rule; policy bugs are as costly as code bugs.
2. Start with warnings, then promote rules to hard failures once teams have fixed violations.
3. Use Conftest or Gatekeeper rather than building your own wrappers for common cases.

Resources:

• Open Policy Agent website
• GitHub repository

Pricing

Open Policy Agent is free and open source under the Apache-2.0 licence.

Recommended for?

1. Platform and security teams that want one policy language across many systems.
2. Organisations with compliance requirements that need auditable decisions.
3. Teams building custom authorisation for APIs or internal platforms.
4. Not ideal if you only need Kubernetes admission rules in YAML; Kyverno may be simpler.

Conclusion

OPA is the most general policy-as-code engine available. Rego, unit tests and decision logs give teams a disciplined way to express and verify rules across infrastructure, pipelines and services.

The trade-off is the Rego learning curve and the work of writing policies. For many teams, the best entry point is Conftest in CI or Gatekeeper in clusters, with OPA underneath.

On CheckOps, Open Policy Agent is filed under the Release & CI gates and Security testing stages. Related tools listed here include Conftest, Kyverno, OPA Gatekeeper, Checkov, KICS and terraform-compliance. Before standardising on one, compare recent maintenance activity, the pricing model as your usage grows, and the integrations you rely on today. Information on this page was verified against the official website, documentation and repository on 11 November 2026.