OPA

OPA is a CNCF graduated project. A caller sends structured input (an HTTP request, a Kubernetes object, a Terraform plan) and OPA evaluates it against policy written in Rego, a declarative query language, plus any loaded data, returning allow/deny or a richer document such as a list of violations.

It exists so policy can be versioned, tested and reviewed like code, and reused across layers: Gatekeeper for Kubernetes admission, Conftest for IaC in CI, Envoy external authorisation for service calls, and in-process libraries for application authorisation.

Common pitfalls: Rego's semantics (undefined is not false, rules are unions) surprise newcomers, so policies need unit tests with opa test. Shipping large data sets to every OPA instance gets expensive; relationship-heavy authorisation is often better served by a ReBAC system. Decision logs are valuable audit evidence and should be shipped centrally.

package k8s.admission

import rego.v1

deny contains msg if {
  input.request.kind.kind == "Pod"
  some c in input.request.object.spec.containers
  c.securityContext.privileged
  msg := sprintf("privileged container %q is not allowed", [c.name])
}