Overview
OPA provides a high-level declarative language called Rego to define policies. It can be used to control access to APIs, Kubernetes resources, CI/CD pipelines, and more, decoupling policy logic from the application code.
How it Works
- An application sends a Query (JSON data) to OPA.
- OPA evaluates the query against its Policies and Data.
- OPA returns a Decision (e.g., Allow/Deny, or a complex JSON object).
Use Cases
- Kubernetes Admission Control: Ensuring pods meet security standards.
- API Authorization: Deciding which users can access which endpoints.
- Terraform Plan Validation: Checking for insecure infrastructure configurations.