What is OPA?
- Docker & Kubernetes course
- Expert
- Lesson 31/47
- 4 min
Learn that Open Policy Agent is a policy engine.
What is OPA?
Open Policy Agent (OPA) is a general-purpose policy engine that separates policies from code. It takes a request (JSON) and rules, and returns "allow / deny" or a list of violations. In Kubernetes it runs in the admission stage and enforces company rules:
- Every deployment must have the
takimandortamlabels. - Images must only be pulled from the company registry.
- The
latesttag and root containers are forbidden. - Every container must write resource limits.
request (AdmissionReview) ─► OPA/Gatekeeper ─► no violation -> accept
└─► violation -> reject with "eksik etiket: takim"Gatekeeper and Kyverno
For Kubernetes, OPA comes with the Gatekeeper project: policies are written as CRDs and applied with a validating admission webhook. The alternative Kyverno writes policies directly in YAML. Kubernetes's built-in ValidatingAdmissionPolicy feature also uses CEL for simple rules.
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace
kubectl get pods -n gatekeeper-systemPractice Install Gatekeeper
Write three commands: add the gatekeeper repository with the address https://open-policy-agent.github.io/gatekeeper/charts; install the gatekeeper/gatekeeper chart as gatekeeper into the gatekeeper-system namespace (creating it if missing); list the pods in gatekeeper-system.
Starter code
# buraya yazSample solution
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace
kubectl get pods -n gatekeeper-systemExpected output
"gatekeeper" has been added to your repositories NAME: gatekeeper STATUS: deployed NAME READY STATUS RESTARTS AGE gatekeeper-audit-6c5d4b3a2-x2k9p 1/1 Running 0 40s gatekeeper-controller-manager-7d6e5f4a3-abcde 1/1 Running 0 40s
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What is the difference between RBAC and OPA policies?
- RBAC checks images
- RBAC looks at who can do what, OPA at the object's content Correct answer
- They are the same
- OPA creates users
Explanation: RBAC answers "can they create a deployment?", OPA "does this deployment follow the rules?".
2 Install the Gatekeeper chart.
helm ____ gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespacehelm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespaceExplanation: helm install takes the release and chart names.
3 Match.
| Term | Meaning |
|---|---|
OPA |
Policy engine |
Gatekeeper |
OPA for Kubernetes |
Kyverno |
YAML-based policy |
admission webhook |
Enforcement point |