What is OPA?

Learn that Open Policy Agent is a policy engine.

What is OPA?

Open Policy Agent (OPA) is a general-purpose policy engine that separates policies from code. It takes a request (JSON) and rules, and returns "allow / deny" or a list of violations. In Kubernetes it runs in the admission stage and enforces company rules:

Every deployment must have the takim and ortam labels.
Images must only be pulled from the company registry.
The latest tag and root containers are forbidden.
Every container must write resource limits.

request (AdmissionReview) ─► OPA/Gatekeeper ─► no violation -> accept
                                               └─► violation   -> reject with "eksik etiket: takim"

Gatekeeper and Kyverno

For Kubernetes, OPA comes with the Gatekeeper project: policies are written as CRDs and applied with a validating admission webhook. The alternative Kyverno writes policies directly in YAML. Kubernetes's built-in ValidatingAdmissionPolicy feature also uses CEL for simple rules.

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace
kubectl get pods -n gatekeeper-system

Exercise Install Gatekeeper

Write three commands: add the gatekeeper repository with the address https://open-policy-agent.github.io/gatekeeper/charts; install the gatekeeper/gatekeeper chart as gatekeeper into the gatekeeper-system namespace (creating it if missing); list the pods in gatekeeper-system.

Show example solution

helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace
kubectl get pods -n gatekeeper-system

Test yourself

What is the difference between RBAC and OPA policies?
- RBAC checks images
- RBAC looks at who can do what, OPA at the object's content
- They are the same
- OPA creates users
Show answer

RBAC looks at who can do what, OPA at the object's content — RBAC answers "can they create a deployment?", OPA "does this deployment follow the rules?".

Install the Gatekeeper chart.

helm ____ gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace

Show answer

helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace

Match.

OPA

Policy engine
Gatekeeper

OPA for Kubernetes
Kyverno

YAML-based policy
admission webhook

Enforcement point

Next lesson: The Rego language

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies