opa

Try it in 3 steps

1. 1

   Fetch the pinned OPA CLI

   On Linux AMD64 with curl and zsh or bash, download the OPA v1.21.1 static CLI and make it executable.

   mkdir opa-demo && cd opa-demo && curl -fsSLo opa https://github.com/open-policy-agent/opa/releases/download/v1.21.1/opa_linux_amd64_static && chmod +x opaCopy
2. 2

   Write a policy and tests

   Write a default-deny Rego policy with role as its input contract plus unit tests for an allowed admin and denied reader.

   printf '%s\n' 'package example.authz' 'import rego.v1' 'default allow := false' 'allow if input.role == "admin"' > policy.rego && printf '%s\n' 'package example.authz_test' 'import rego.v1' 'import data.example.authz.allow' 'test_admin if allow with input as {"role": "admin"}' 'test_reader_denied if not allow with input as {"role": "reader"}' > policy_test.regoCopy
3. 3

   Verify tests and a deny decision

   Run opa test for both cases, then verify that the comparison asserting reader allow is false evaluates to true and exits with status 0.

   ./opa test . && ./opa eval --fail --data policy.rego --input <(printf '%s\n' '{"role":"reader"}') 'data.example.authz.allow == false'Copy

Built with

• Go

Categories and tags

GitHub data

Share a guide or use case for this OSS in Markdown. Articles are published after administrator approval.

Explore next

• 1Panel37,104 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  centralize Linux server, Docker, web, database, backup, and AI operations in one privileged control plane

  Go
• minikube32,175 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  create a workstation Kubernetes cluster for pre-deployment testing

  Go
• Dokku32,168 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  turn a single Linux VM into a PaaS from git push through build, release, and routing

  Go
• Helm30,304 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  package Kubernetes applications as Charts and manage install, upgrade, and rollback as releases

  Go
• Consul30,091 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  combine service discovery, health checks, service mesh, and API gateway capabilities for distributed infrastructure

  Go
• Kyverno8,212 Stars

  3 shared tag(s) · 1 shared category(s) · Same language

  Continuously apply policy as code through Kubernetes admission and background scans

  Go