OPA Policies

Policies as Code using Open Policy Agent (OPA) and the Rego language.

Structure

.
├── policies/                   # Rego policies organized by domain
│   ├── authz/                  # General authorization policies
│   │   ├── allow.rego
│   │   └── allow_test.rego
│   ├── kubernetes/             # Kubernetes admission control
│   │   └── admission/
│   │       ├── deny.rego
│   │       └── deny_test.rego
│   ├── terraform/              # Infrastructure-as-Code checks
│   │   ├── checks.rego
│   │   └── checks_test.rego
│   └── rbac/                   # Role-Based Access Control
│       └── rbac.rego
├── data/                       # Static data and test fixtures
│   └── fixtures/
│       ├── authz/
│       └── kubernetes/
├── bundles/                    # Compiled OPA bundles (git-ignored)
├── scripts/                    # Helper scripts
│   ├── test.sh
│   └── build.sh
├── .github/workflows/          # CI/CD pipelines
│   └── policy-tests.yaml
├── Makefile
├── opa-config.yaml             # OPA server configuration
└── .gitignore

Getting Started

Prerequisites

• OPA >= 0.60
• (Optional) Regal for linting

Running Tests

make test

Formatting

make fmt        # format in-place
make fmt-check  # check without modifying

Building Bundles

make build

Linting

make lint

Policy Domains

Domain	Path	Description
Authorization	policies/authz/	Role-permission based access control
Kubernetes	policies/kubernetes/	Admission webhook policies
Terraform	policies/terraform/	IaC compliance checks
RBAC	policies/rbac/	Fine-grained RBAC model

Writing Policies

Each policy file should:

1. Declare a package at the top: package <domain>.<subpackage>
2. Use import rego.v1 for the latest Rego syntax
3. Have a corresponding _test.rego file with unit tests
4. Follow OPA naming conventions (deny, allow, violation)

CI/CD

The GitHub Actions workflow (.github/workflows/policy-tests.yaml) automatically:

• Runs all policy tests on every push and pull request
• Checks Rego formatting
• Builds and uploads bundles on merges to main

References

• OPA Documentation
• Rego Language Reference
• Regal Linter
• OPA Playground