Open Policy Agent (OPA) review: the open-source, CNCF-graduated policy engine for Kubernetes and cloud-native authorization. Features, pricing, alternatives.
Open Policy Agent (OPA) is an open-source, general-purpose policy engine that decouples authorization and compliance logic from application code. Originally created in 2016 by Styra, it was donated to the Cloud Native Computing Foundation and reached full Graduated status in 2021, becoming the CNCF's first authorization-focused graduated project.
OPA lets platform and security teams write policy rules in Rego, a declarative language purpose-built for expressing logic over structured data, and enforce those rules consistently across Kubernetes, microservices, APIs, and CI/CD pipelines rather than reimplementing authorization logic separately in every system.
OPA's core strength is its unified policy evaluation model: policies written once in Rego can be applied anywhere OPA is embedded, whether as a sidecar, a library, or a standalone service, giving organizations one consistent way to enforce rules across a heterogeneous stack.
The most widely used integration is OPA Gatekeeper, which turns OPA into a Kubernetes admission controller that blocks non-compliant resources at creation time. Beyond Kubernetes, OPA integrates with API gateways for request-level authorization, and with tools like Conftest for validating Terraform and other infrastructure-as-code configurations in CI/CD pipelines.
Open Policy Agent itself is completely free and open source, with no paid tier for the core engine, CLI, or Rego language.
Organizations that want a centralized management layer, policy authoring UI, testing, and compliance reporting across many OPA deployments can pay for Styra DAS, a commercial product built around open-source OPA, priced on a custom, enterprise basis.
Yes, OPA is completely free and open source. The commercial option, Styra DAS, adds centralized management and reporting on top of OPA for enterprises but is not required to use OPA.
OPA uses Rego, a purpose-built declarative language designed to express policy logic over structured, hierarchical data.
OPA was created in 2016 by Styra, a company founded that year and headquartered in Redwood City, California, and was later donated to the Cloud Native Computing Foundation.
Yes, OPA entered the CNCF Sandbox in 2018, reached Incubation in 2019, and achieved full Graduated status in 2021, becoming the CNCF's first authorization-focused graduated project.
OPA Gatekeeper is the most common way to run OPA on Kubernetes, acting as an admission controller that validates or blocks resources against policy before they are created.
RBAC controls who can perform which actions on which resource types, while OPA enables far more expressive, context-aware policies that can factor in arbitrary structured data beyond simple role bindings.
Publicly disclosed users include Netflix, Cloudflare, Pinterest, Intuit, and Capital One, among many other organizations running Kubernetes and microservices at scale.