opa

OPA, the Open Policy Agent, is a general-purpose policy engine: you write rules in a language called Rego, and OPA evaluates them to make yes-or-no decisions for anything that asks. Should this Kubernetes pod be allowed? Can this user call this API? Is this Terraform plan compliant? One engine, consistent policy across your whole stack. Open source and free, a graduated CNCF project.

It runs as a service or a library that your applications and infrastructure query at decision points. The power is decoupling policy from code: instead of hardcoding rules into every service, they live in Rego and OPA answers the questions. Rego takes real effort to learn, and that's the honest cost of the flexibility. Setup is easy, getting good at Rego is not.

OPA is free. Styra, founded by OPA's creators, sells Styra DAS: a commercial control plane for managing policies, distribution, and monitoring across a large environment. Solo and small teams, raw OPA, or Gatekeeper if your only use case is Kubernetes. Large orgs running policy everywhere, Styra DAS is the management layer.

The catch: Rego is the barrier. It's a declarative logic language that thinks differently from normal code, and the learning curve is steep enough that teams often stall. If your only need is Kubernetes admission control, Gatekeeper or Kyverno wrap OPA-style policy in something friendlier. Reach for raw OPA when you genuinely need one policy engine across many systems.