Cloud Security DevOps and SRE

Policy as Code with Open Policy Agent (OPA)

January 11, 2026

Open Policy Agent (OPA) enables policy as code, allowing organizations to define and enforce policies across the stack using a declarative language called Rego.

Rego Policy Example

package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := "Containers must run as non-root"
}

Gatekeeper in Kubernetes

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-label
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["team"]

Conftest for CI/CD

# Test Terraform plans
conftest test tfplan.json -p policy/

Policy as code ensures consistent enforcement across environments and provides version-controlled, auditable policy definitions.

Related Posts: