Open Policy Agent (OPA)

OPA externalizes authorization logic from the application codebase. Instead of embedding complex if-else blocks, services query OPA via a local sidecar or daemon. This separation allows policy updates without recompiling, redeploying, or restarting the application. The application sends a structured JSON query, and OPA returns a simple allow/deny decision, keeping business logic clean and maintainable.

Policies are expressed in Rego, a high-level declarative language purpose-built for expressing rules over complex hierarchical data. Rego queries inspect the structure of JSON input to make decisions.

• Declarative: You define what the policy is, not how to enforce it.
• Iterative Evaluation: Rego uses a unified syntax for queries and rules.
• Built-in Functions: Includes over 150 built-ins for string manipulation, JWT verification, and cryptographic hashing.

OPA evaluates policies against the full context of an API request, not just the user's role. This enables Attribute-Based Access Control (ABAC).

• Data Injection: OPA can pull in external data (e.g., real-time threat feeds, inventory levels) at decision time.
• Multi-Dimensional: Decisions can factor in the request path, HTTP method, time of day, IP geolocation, and resource ownership simultaneously.
• Example: A policy might allow a POST to /api/orders only if the user is in the fulfillment group and the request originates from a corporate IP range during business hours.

OPA Gatekeeper is a specialized Kubernetes admission controller that enforces Custom Resource Definitions (CRDs) via Rego policies. It validates, mutates, or rejects resource creation before objects are persisted to etcd.

• Constraint Templates: Define reusable policy schemas.
• Audit Functionality: Periodically evaluates existing cluster resources against current policies to detect historical violations.
• Common Use Cases: Enforcing mandatory container image registries, denying privileged pods, and requiring specific labels on namespaces.

OPA evaluates static infrastructure manifests (Terraform, CloudFormation, Kubernetes YAML) before deployment to prevent misconfigurations. This shifts security left by catching violations in CI/CD pipelines.

• Terraform Integration: The terraform plan output is passed to OPA to deny non-compliant resources.
• Regal Linter: A dedicated linter for Rego policies ensures best practices are followed in the policies themselves.
• Example Rule: Deny any AWS S3 bucket with public-read ACL or an unencrypted block device.

OPA integrates as an external authorizer for service meshes like Envoy and Istio. Instead of relying solely on mTLS identity, OPA applies fine-grained Rego policies to every inter-service request at the proxy level.

• Envoy External Authorization: The ext_authz filter offloads decision-making to an OPA instance.
• API Gateway: OPA can authorize requests at the edge, validating JWT claims and API keys before traffic reaches internal services.
• Dynamic Control: API access rules can be updated instantly without restarting the sidecar proxies.