[opensourcedex]

opa is a free, open source compliance & risk management project written in Go and released under Apache-2.0. It has 12,244 GitHub stars, 1,685 forks and 310 open issues, and was last pushed 5 hours ago. On this registry it ranks #6 of 45 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available. It gained 6 stars over the last 3 tracked days.

What is opa?

What it is

Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. It lives in the cloud-native ecosystem as a graduated project in the Cloud Native Computing Foundation landscape, and it is written in Go under the Apache-2.0 license. Policy is expressed declaratively in the Rego language, and the project ships alongside a CLI, an HTTP REST API, a Go SDK, and editor tooling rather than as a single binary alone. The repository has been active for roughly eleven years, with 12,234 stars, 1,679 forks, and a last push dated 15 September 2026.

The concrete problem OPA solves is policy fragmentation. Rather than embedding authorization, compliance, and admission rules separately inside each service, OPA centralizes those decisions in one declarative engine that answers policy questions on demand. Because the engine is general-purpose, the same Rego policy can govern access control, cloud-native admission decisions, and compliance checks, and results stay consistent because the evaluation logic is shared instead of duplicated. The topic list — authorization, cloud-native, compliance, declarative, json, policy — reflects that breadth.

Key capabilities

  • General-purpose policy engine with unified, context-aware enforcement across the stack.
  • Rego declarative policy language, with an online Rego Playground for writing, running, and sharing policies.
  • Policy evaluation over JSON input, matching the project's JSON topic.
  • REST API for integration with services written in languages other than Go.
  • Go SDK, plus a low-level Go API documented on pkg.go.dev, for native Go integration.
  • OPA CLI for local runs and policy work.
  • Editor and IDE support, including a VS Code extension with live diagnostics, debugging, and formatting.

Who uses it and how

  • Teams enforcing authorization decisions as policy rather than hard-coded per-service logic.
  • Cloud-native platforms applying policy enforcement in the CNCF ecosystem.
  • Compliance and risk programs expressing rules declaratively so they can be reviewed and versioned.
  • Integrators embedding OPA through the REST API when their services are not written in Go.
  • Organizations listed in ADOPTERS.md that run OPA in production; the README asks adopters to submit a pull request describing their use cases.

Getting started

Install from Docker Hub using the openpolicyagent/opa image tags, or download binaries from the GitHub releases page; the README's Running OPA instructions cover getting started with the OPA CLI locally. Policies can be drafted first in the Rego Playground or with the VS Code extension.

When to use it — and when not to

OPA fits when policy must be declarative, shared, and enforced in many places at once, and the README points to commercial support options for organizations that want backing. The listing does not publish a contributor count, and it shows 310 open issues, so prospective

project readme (upstream, from github) — read inline

logo Open Policy Agent

Build Status CII Best Practices Netlify Status

Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.

OPA is proud to be a graduated project in the Cloud Native Computing Foundation (CNCF) landscape. For details read the CNCF announcement.

Get started with OPA

  • Write your first Rego policy with the Rego Playground or use it to share your work with others for feedback and support. Have a look at the Access Control examples if you're not sure where to start.
  • Install the VS Code extension to get started locally with live diagnostics, debugging and formatting. See Editor and IDE Support for other supported editors.
  • Go to the OPA Documentation to learn about the Rego language as well as how to deploy and integrate OPA.
  • Check out the learning resources in the Learning Rego section of the ecosystem directory.
  • Follow the Running OPA instructions to get started with the OPA CLI locally.
  • See Docker Hub for container images and the GitHub releases for binaries.
  • Check out the OPA Roadmap to see a high-level snapshot of OPA features in-progress and planned.

Want to talk about OPA or get support?

  • Join the OPA Slack to talk to other OPA users and maintainers. See #help for support.
  • Check out the Community Discussions to ask questions.
  • See the Support page for commercial support options.

Interested to learn what others are doing with OPA?

  • Browse community projects on the OPA Ecosystem Directory - don't forget to list your own!
  • Check out the ADOPTERS.md file for a list of production adopters. Does your organization use OPA in production? Support the OPA project by submitting a PR to add your organization to the list with a short description of your OPA use cases!

Want to integrate OPA?

  • See the high-level Go SDK or the low-level Go API GoDoc to integrate OPA with services written in Go.
  • See the REST API reference to integrate OPA with services written in other languages.
  • See the integration docs for more options.

Want to contribute to OPA?

How does OPA work?

OPA gives you a high-level declarative language to author and enforce policies across your stack.

With OPA, you define rules that govern how your system should behave. These rules exist to answer questions like:

  • Can user X call operation Y on resource Z?
  • What clusters should workload W be deployed to?
  • What tags must be set on resource R before it's created?

You integrate services with OPA so that these kinds of policy decisions do not have to be hardcoded in your service. Services integrate with OPA by executing queries when policy decisions are needed.

When you query OPA for a policy decision, OPA evaluates the rules and data (which you give it) to produce an answer. The policy decision is sent back as the result of the query.

For example, in a simple API authorization use case:

  • You write rules that allow (or deny) access to your service APIs.
  • Your service queries OPA when it receives API requests.
  • OPA returns allow (or deny) decisions to your service.
  • Your service enforces the decisions by accepting or rejecting requests accordingly.

For concrete examples of how to integrate OPA with systems like Kubernetes, Terraform, Docker, SSH, and more, see openpolicyagent.org.

Presentations

  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2026: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon NA 2025: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2025: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon NA 2024: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2024: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon NA 2023: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2023: video
  • Running Policy in Hard to Reach Places with WASM & OPA @ CN Wasm Day EU 2023: video
  • OPA maintainers talk @ Kubecon NA 2022: video
  • Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2022: video
  • Open Policy Agent Intro @ KubeCon EU 2021: Video
  • Using Open Policy Agent to Meet Evolving Policy Requirements @ KubeCon NA 2020: video
  • Applying Policy Throughout The Application Lifecycle with Open Policy Agent @ CloudNativeCon 2019: video
  • Open Policy Agent Introduction @ CloudNativeCon EU 2018: video, slides
  • Rego Deep Dive @ CloudNativeCon EU 2018: video, slides
  • How Netflix Is Solving Authorization Across Their Cloud @ CloudNativeCon US 2017: video, slides.
  • Policy-based Resource Placement in Kubernetes Federation @ LinuxCon Beijing 2017: slides, screencast
  • Enforcing Bespoke Policies In Kubernetes @ KubeCon US 2017: video, slides
  • Istio's Mixer: Policy Enforcement with Custom Adapters @ CloudNativeCon US 2017: video, slides

Security

A third party security audit was performed by Cure53, you can see the full report here.

Please report vulnerabilities by email to open-policy-agent-security. We will send a confirmation message to acknow

readme truncated — read the full docs on github

Frequently asked questions

Is opa free to use?

opa is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does opa do?

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

What is opa written in?

opa is primarily written in Go. Its source is publicly available at https://github.com/open-policy-agent/opa, and it has 12,244 GitHub stars.