What is Open Policy Agent (OPA)?

Question

Accepted Answer

**OPA** — universal policy engine for access control.

**Rego — policy language:**
```rego
package authz

default allow = false

allow {
    input.method == "GET"
    input.user.role == "admin"
}
```

**OPA Gatekeeper (Kubernetes):**
```yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          required := input.review.object.spec.labels[_]
          not input.review.object.metadata.labels[required]
          msg := sprintf("Missing required label: %v", [required])
        }
```

**Use cases:** K8s admission control, API authorization, Infra policy.

DevOps: What is Open Policy Agent (OPA)?