Declarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego language.
Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
Write your first Rego policy with the Rego Playground or use it to share your work with others for feedback and support. Have a look at the Access Control examples if you're not sure where to start.
Install the VS Code extension to get started locally with live diagnostics, debugging and formatting. See Editor and IDE Support for other supported editors.
Go to the OPA Documentation to
learn about the Rego language as well as how to deploy and integrate OPA.
Check out the learning resources in the Learning Rego section of the ecosystem directory.
Follow the Running OPA instructions to get started with the OPA CLI locally.
Check out the ADOPTERS.md file for a list of production adopters. Does your organization use OPA in production? Support the OPA project by submitting a PR to add your organization to the list with a short description of your OPA use cases!
Want to integrate OPA?
See the high-level Go SDK or the low-level Go API
to integrate OPA with services written in Go.
See the REST API
reference to integrate OPA with services written in other languages.
Read the Contributing Guide to learn how to make your first contribution.
Use #contributors in Slack to talk to other contributors and OPA maintainers.
File a GitHub Issue to request features or report bugs.
How does OPA work?
OPA gives you a high-level declarative language to author and enforce policies
across your stack.
With OPA, you define rules that govern how your system should behave. These
rules exist to answer questions like:
Can user X call operation Y on resource Z?
What clusters should workload W be deployed to?
What tags must be set on resource R before it's created?
You integrate services with OPA so that these kinds of policy decisions do not
have to be hardcoded in your service. Services integrate with OPA by
executing queries when policy decisions are needed.
When you query OPA for a policy decision, OPA evaluates the rules and data
(which you give it) to produce an answer. The policy decision is sent back as
the result of the query.
For example, in a simple API authorization use case:
You write rules that allow (or deny) access to your service APIs.
Your service queries OPA when it receives API requests.
OPA returns allow (or deny) decisions to your service.
Your service enforces the decisions by accepting or rejecting requests accordingly.
Enforcing Bespoke Policies In Kubernetes @ KubeCon US 2017: video, slides
Istio's Mixer: Policy Enforcement with Custom Adapters @ CloudNativeCon US 2017: video, slides
Security
A third party security audit was performed by Cure53, you can see the full report here.
Please report vulnerabilities by email to open-policy-agent-security.
We will send a confirmation message to acknowledge that we have received the
report and then we will send additional messages to follow up once the issue
has been investigated.
open-policy-agent/opa
Open Policy Agent
