Open Policy Agent (OPA) is an open source, general-purpose policy engine and a graduated Cloud Native Computing Foundation (CNCF) project. Policies are written in a language called Rego, and OPA evaluates them against structured input, such as a Terraform plan in JSON or a Kubernetes manifest.
OPA is used for Kubernetes admission control (through Gatekeeper), API authorization and infrastructure code checks. Conftest, a related tool, applies Rego policies to configuration files in CI/CD.
OPA is flexible, but teams must write and maintain every policy themselves in Rego. Steampunk Spotter takes a different approach for Ansible and Terraform: it ships built-in compatibility, security and CIS checks and adds custom policies on top.
