Repolode
Submit
open-policy-agent

open-policy-agent/opa

A general-purpose policy engine that lets you write authorization and compliance rules in Rego and evaluate them from services, Kubernetes, and other systems.

View on GitHubWebsite
Stars
12,442
Forks
1,710
Open issues
266
Last commit
11 hours ago

What is it?

Open Policy Agent (OPA) is a general-purpose policy engine. Instead of hardcoding authorization or compliance logic into each service, you write rules in Rego, OPA's declarative language, and your services ask OPA for a decision by running a query. OPA evaluates the rules against the data you provide and returns the result, which the calling service then enforces.

OPA is a graduated project of the Cloud Native Computing Foundation. It can be run as a standalone CLI or server, shipped as container images and binaries, and embedded in Go services through a Go SDK and low-level Go API. Other languages integrate through its REST API.

The project documents integrations with systems such as Kubernetes, Terraform, Docker, and SSH. Editor support includes a VS Code extension with live diagnostics, debugging, and formatting.

Key features

  • 01Policies are written in Rego, a declarative language for rules and queries.
  • 02Runs as a standalone CLI or server, or embeds in Go applications via an SDK.
  • 03Exposes a REST API so services in any language can request policy decisions.
  • 04Provides a VS Code extension with live diagnostics, debugging, and formatting.
  • 05Distributed as container images and binaries.

Use cases

  • Enforcing API authorization so services decide whether a user may call an operation on a resource.
  • Validating Kubernetes resources against admission policies before they are created.
  • Checking infrastructure definitions, such as Terraform plans, against compliance rules.
  • Centralizing access control decisions across many microservices.

Quick start

  1. 1

    Download the OPA binary or container image from the GitHub releases or Docker Hub

  2. 2

    Follow the Running OPA instructions in the official docs to start the OPA CLI locally

Things to know

  • Writing policies requires learning the Rego language.

In collections

Microservice frameworks & service infrastructure

Topics

#policy-engine#authorization#rego#kubernetes#cloud-native#compliance#access-control#declarative#json#opa

FAQ

What is opa?
A general-purpose policy engine that lets you write authorization and compliance rules in Rego and evaluate them from services, Kubernetes, and other systems. Open Policy Agent (OPA) is a general-purpose policy engine. Instead of hardcoding authorization or compliance logic into each service, you write rules in Rego, OPA's declarative language, and your services ask OPA for a decision by running a query. OPA evaluates the rules against the data you provide and returns the result, which the calling service then enforces.
Is opa free to use? What license does it have?
opa is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is opa still maintained?
Actively maintained. The last commit to opa was on Nov 6, 2026.
What can I use opa for?
Enforcing API authorization so services decide whether a user may call an operation on a resource. Validating Kubernetes resources against admission policies before they are created. Checking infrastructure definitions, such as Terraform plans, against compliance rules. Centralizing access control decisions across many microservices.
How do I install opa?
Download the OPA binary or container image from the GitHub releases or Docker Hub Follow the Running OPA instructions in the official docs to start the OPA CLI locally
Where can I get opa?
The source code and installation instructions are on GitHub: https://github.com/open-policy-agent/opa

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects