Open Policy Agent 101

📖 Series Overview

Policy enforcement is one of those problems that looks simple on day one and gets complicated fast. When I first set up a Kubernetes cluster for my personal projects, I just applied YAML and moved on. Then, as the setup grew — more namespaces, more workloads, a few team members sharing the cluster — I started noticing drift. Containers running as root. No resource limits. Images pulled from anywhere. Nothing enforcing the rules I thought I'd communicated.

That's what brought me to Open Policy Agent. OPA doesn't just enforce rules — it makes policy a first-class concern in your stack. Policies become code: versioned, tested, reviewed, deployed. This series documents what I learned building policy-as-code across local Kubernetes clusters and progressively more complex setups.

---

🎯 What You'll Learn

By working through this series, you'll understand:

• What OPA is and how policy decoupling solves real engineering problems

• Rego language — OPA's declarative policy language from first principles

• Deployment modes — sidecar, server, and embedded library patterns

• Kubernetes admission control using OPA Gatekeeper

• Writing real Kubernetes policies for pod security, namespaces, and RBAC

• Policy bundles — distributing and managing policies at scale

• Testing policies with opa test and Conftest

• CI/CD integration — shift-left policy enforcement in pipelines

---

🗺️ Learning Path

---

📚 Articles in This Series

#	Title	Description
01	Introduction to Open Policy Agent	What OPA is, why policy decoupling matters, core concepts
02	Rego Language Fundamentals	Syntax, rules, iteration, functions — learning to write policy
03	OPA Architecture and Deployment Modes	How OPA works, sidecar vs server vs library
04	OPA Gatekeeper on Kubernetes	Installing and configuring admission control on a cluster
05	Writing Kubernetes Admission Policies	Real policies: pod security, image registries, resource limits
06	OPA Bundles and Policy Management	Distributing policies, bundle server, policy versioning
07	Testing OPA Policies	Unit testing with opa test, Conftest, and policy coverage
08	OPA in CI/CD Pipelines	Shift-left enforcement: validating IaC, manifests, configs

---

🔧 Prerequisites

This series assumes you:

• Are comfortable with Kubernetes basics (pods, deployments, namespaces, RBAC)

• Have a working local Kubernetes cluster (kind, k3s, or minikube)

• Know JSON and YAML at a working level

• Have some experience with at least one declarative or functional language

• Are running macOS or Linux for the examples

---

🛠️ Tools Used in This Series

Tool	Purpose	Install
opa CLI	Evaluate and test policies locally	brew install opa
kubectl	Interact with Kubernetes	brew install kubectl
kind or k3s	Local Kubernetes cluster	brew install kind
helm	Install Gatekeeper	brew install helm
conftest	Policy testing for configs	brew install conftest

---

📎 Related Series

• DevSecOps 101 — Security integration across the SDLC

• Platform Engineering 101 — Building Internal Developer Platforms

---

OPA graduated as a CNCF project in 2021. It's production-proven across Kubernetes, CI/CD, API gateways, and microservices. This series focuses on understanding it deeply before applying it broadly.