Open Policy Agent (OPA)

Homepage: https://www.openpolicyagent.org/
Documentation: https://www.openpolicyagent.org/docs/
Source: https://github.com/open-policy-agent/opa

February 22, 2026

What it is

Open Policy Agent (OPA) evaluates policies written in Rego. Use for API authorization, Kubernetes admission control, and config validation.

K8s admission (validating/mutating); API authz; Terraform/IaC policy; CI policy checks.

Pros	Cons
One language (Rego) for many use cases	Rego learning curve
Decoupled from apps
CNCF graduated
Integrations (K8s, Envoy, Terraform)

Kyverno (K8s-native), custom admission. Why OPA: Need one policy engine across K8s, APIs, and IaC.