Policy as Code

Chapter 2. Open Policy Agent

I started using Open Policy Agent (OPA) in 2018, almost two full years after the project launched and just after it was accepted into the CNCF. OPA is now a graduated CNCF project, which is an attestation of its overall maturity as a PaC solution.

OPA is a very mature OSS project with a strong and active community of developers and users. The following links provide more information about OPA:

• GitHub project

• Documentation website

• Policy library

• Slack community

When I think of OPA, the two things that immediately come to mind are general purpose and unification. OPA is domain agnostic, which means it’s not focused on a single data domain or stack. In fact, OPA doesn’t come with built-in, ready-to-use Kubernetes or cloud computing policies. You pass it policies, data, and queries. It matches policies to the data you send it and evaluates said data with the policies based on queries you provide.

Because OPA is domain agnostic, it is general purpose. And because of OPA’s general-purpose utility, you can pass input (data) and policies (data) regardless of the domain or stack you are evaluating. This general purpose leads to PaC unification across domains and stacks. In other words, since OPA is domain agnostic, it can be used across many domains and stacks, thereby unifying the different policy needs using one PaC solution.

As we explore OPA in this chapter, we will start with the requisite Hello World example. Then, we will put OPA through ...