What is OPA (Open Policy Agent)?
OPA is a general-purpose policy engine that decouples policy decisions from application code. Policies are written in Rego, a declarative language designed for evaluating structured data.
OPA in Kubernetes
OPA Gatekeeper runs as an admission controller — it evaluates every API request against your Rego policies and rejects non-compliant configurations before they reach the cluster.
OPA vs Kyverno
| Feature | OPA Gatekeeper | Kyverno |
|---|---|---|
| Language | Rego | YAML (K8s native) |
| Learning curve | Higher | Lower |
| Mutation | Limited | Full |
| Ecosystem | Broader (beyond K8s) | K8s-specific |