{"id":37112570,"url":"https://github.com/nordcloud/opa","last_synced_at":"2026-01-14T13:18:43.833Z","repository":{"id":57530011,"uuid":"258777281","full_name":"nordcloud/opa","owner":"nordcloud","description":"An open source, general-purpose policy engine.","archived":false,"fork":true,"pushed_at":"2020-06-15T15:58:52.000Z","size":70577,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-12-19T16:03:21.244Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.openpolicyagent.org","language":"Go","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"open-policy-agent/opa","license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nordcloud.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null}},"created_at":"2020-04-25T13:03:59.000Z","updated_at":"2020-06-15T15:58:09.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/nordcloud/opa","commit_stats":null,"previous_names":[],"tags_count":83,"template":false,"template_full_name":null,"purl":"pkg:github/nordcloud/opa","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fopa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fopa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fopa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fopa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nordcloud","download_url":"https://codeload.github.com/nordcloud/opa/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fopa/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28421000,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T10:47:48.104Z","status":"ssl_error","status_checked_at":"2026-01-14T10:46:19.031Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-14T13:18:42.855Z","updated_at":"2026-01-14T13:18:43.821Z","avatar_url":"https://github.com/nordcloud.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ![logo](./logo/logo-144x144.png) Open Policy Agent\n\n[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://travis-ci.org/open-policy-agent/opa.svg?branch=master)](https://travis-ci.org/open-policy-agent/opa) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)\n\nThe Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.\n\nOPA is hosted by the [Cloud Native Computing Foundation](https://cncf.io) (CNCF) as an incubating-level project. If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details read the CNCF [announcement](https://www.cncf.io/blog/2019/04/02/toc-votes-to-move-opa-into-cncf-incubator/).\n\n## Want to learn more about OPA?\n\n- See [openpolicyagent.org](https://www.openpolicyagent.org) to get started with documentation and tutorials.\n- See [blog.openpolicyagent.org](https://blog.openpolicyagent.org) for blog posts about OPA and policy.\n- See [ADOPTERS.md](./ADOPTERS.md) for a list of production OPA adopters and use cases.\n- See [the Roadmap slides](https://docs.google.com/presentation/d/16QV6gvLDOV3I0_guPC3_19g6jHkEg3X9xqMYgtoCKrs/edit?usp=sharing) for a snapshot of high-level OPA features in-progress and planned.\n- Try [play.openpolicyagent.org](https://play.openpolicyagent.org) to experiment with OPA policies.\n- Join the conversation on [Slack](https://slack.openpolicyagent.org).\n\n## Want to get OPA?\n\n- See [Docker Hub](https://hub.docker.com/r/openpolicyagent/opa/tags/) for Docker images.\n- See [GitHub releases](https://github.com/open-policy-agent/opa/releases) for binary releases and changelogs.\n\n## Want to integrate OPA?\n\n* See\n  [![GoDoc](https://godoc.org/github.com/open-policy-agent/opa?status.svg)](https://godoc.org/github.com/open-policy-agent/opa/rego)\n  to integrate OPA with services written in Go.\n* See [REST API](https://www.openpolicyagent.org/docs/rest-api.html) to\n  integrate OPA with services written in other languages.\n\n\n## Want to contribute to OPA?\n\n* See [DEVELOPMENT.md](./docs/devel/DEVELOPMENT.md) to build and test OPA itself.\n* See [CONTRIBUTING.md](./CONTRIBUTING.md) to get started.\n* Use [GitHub Issues](https://github.com/open-policy-agent/opa/issues) to request features or file bugs.\n* Join bi-weekly meetings every other Tuesday at 10:00 (Pacific Timezone):\n    * [Meeting Notes](https://docs.google.com/document/d/1v6l2gmkRKAn5UIg3V2QdeeCcXMElxsNzEzDkVlWDVg8/edit?usp=sharing)\n    * [Zoom](https://zoom.us/j/97827947600)\n    * [Calendar Invite](https://calendar.google.com/event?action=TEMPLATE\u0026tmeid=MnRvb2M4amtldXBuZ2E1azY0MTJndjh0ODRfMjAxODA5MThUMTcwMDAwWiBzdHlyYS5jb21fY28zOXVzc3VobnE2amUzN2l2dHQyYmNiZGdAZw\u0026tmsrc=styra.com_co39ussuhnq6je37ivtt2bcbdg%40group.calendar.google.com\u0026scp=ALL)\n\n## How does OPA work?\n\nOPA gives you a high-level declarative language to author and enforce policies\nacross your stack.\n\nWith OPA, you define _rules_ that govern how your system should behave. These\nrules exist to answer questions like:\n\n* Can user X call operation Y on resource Z?\n* What clusters should workload W be deployed to?\n* What tags must be set on resource R before it's created?\n\nYou integrate services with OPA so that these kinds of policy decisions do not\nhave to be *hardcoded* in your service. Services integrate with OPA by\nexecuting _queries_ when policy decisions are needed.\n\nWhen you query OPA for a policy decision, OPA evaluates the rules and data\n(which you give it) to produce an answer. The policy decision is sent back as\nthe result of the query.\n\nFor example, in a simple API authorization use case:\n\n* You write rules that allow (or deny) access to your service APIs.\n* Your service queries OPA when it receives API requests.\n* OPA returns allow (or deny) decisions to your service.\n* Your service _enforces_ the decisions by accepting or rejecting requests accordingly.\n\nThe examples below show different kinds of policies you can define with OPA as\nwell as different kinds of queries your system can execute against OPA. The\nexample queries are executed inside OPA's\n[REPL](https://www.openpolicyagent.org/docs/get-started.html) which was built to\nmake it easy to develop and test policies.\n\nFor concrete examples of how to integrate OPA with systems like [Kubernetes](https://www.openpolicyagent.org/docs/kubernetes-admission-control.html), [Terraform](https://www.openpolicyagent.org/docs/terraform.html), [Docker](https://www.openpolicyagent.org/docs/docker-authorization.html), [SSH](https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html), and more, see [openpolicyagent.org](https://www.openpolicyagent.org).\n\n### Example: API Authorization\n\nThis example shows how you can enforce access controls over salary information\nserved by a simple HTTP API. In this example, users are allowed to access their\nown salary as well as the salary of anyone who reports to them.\n\nThe management chain is represented in JSON and stored in a file (`data.json`):\n\n```json\n{\n    \"management_chain\": {\n        \"bob\": [\n            \"ken\",\n            \"janet\"\n        ],\n        \"alice\": [\n            \"janet\"\n        ]\n    }\n}\n```\n\nStart OPA and load the `data.json` file:\n\n```bash\nopa run data.json\n```\n\nInside the REPL you can define rules and execute queries. Paste the following rules into the REPL.\n\n```ruby\ndefault allow = false\n\nallow {\n    input.method = \"GET\"\n    input.path = [\"salary\", id]\n    input.user_id = id\n}\n\nallow {\n    input.method = \"GET\"\n    input.path = [\"salary\", id]\n    managers = data.management_chain[id]\n    input.user_id = managers[_]\n}\n```\n\n#### Example Queries\n\n**Is someone allowed to access their own salary?**\n\n```ruby\n\u003e input := {\"method\": \"GET\", \"path\": [\"salary\", \"bob\"], \"user_id\": \"bob\"}\n\u003e allow\ntrue\n```\n\n**Display the management chain for Bob:**\n\n```ruby\n\u003e data.management_chain[\"bob\"]\n[\n    \"ken\",\n    \"janet\"\n]\n```\n\n**Is Alice allowed to access Bob's salary?**\n\n```ruby\n\u003e input := {\"method\": \"GET\", \"path\": [\"salary\", \"bob\"], \"user_id\": \"alice\"}\n\u003e allow\nfalse\n```\n\n**Is Janet allowed to access Bob's salary?**\n\n```ruby\n\u003e input := {\"method\": \"GET\", \"path\": [\"salary\", \"bob\"], \"user_id\": \"janet\"}\n\u003e allow\ntrue\n```\n\n### Example: App Placement\n\nThis example shows how you can enforce where apps are deployed inside a simple\norchestrator. In this example, apps must be deployed onto clusters that satisfy\nPCI and jurisdiction requirements.\n\n```ruby\napp_placement[cluster_id] {\n    cluster = data.clusters[cluster_id]\n    satisfies_jurisdiction(input.app, cluster)\n    satisfies_pci(input.app, cluster)\n}\n\nsatisfies_jurisdiction(app, cluster) {\n    not app.tags[\"requires-eu\"]\n}\n\nsatisfies_jurisdiction(app, cluster) {\n    app.tags[\"requires-eu\"]\n    startswith(cluster.region, \"eu-\")\n}\n\nsatisfies_pci(app, cluster) {\n    not app.tags[\"requires-pci-level\"]\n}\n\nsatisfies_pci(app, cluster) {\n    level = to_number(app.tags[\"requires-pci-level\"])\n    level \u003e= cluster.tags[\"pci-level\"]\n}\n```\n\n#### Example Queries\n\n**Where will this app be deployed?**\n\n```ruby\n\u003e input := {\"app\": {\"tags\": {\"requires-pci-level\": \"3\", \"requires-eu\": \"true\"}}}\n\u003e app_placement\n[\n    \"prod-eu\"\n]\n```\n\n**Display clusters in EU region:**\n\n```ruby\n\u003e startswith(data.clusters[cluster_id].region, \"eu-\")\n+------------+\n| cluster_id |\n+------------+\n| \"prod-eu\"  |\n| \"test-eu\"  |\n+------------+\n```\n\n**Display all clusters:**\n\n```ruby\n\u003e data.clusters[cluster_id]\n+------------+------------------------------------------------+\n| cluster_id |           data.clusters[cluster_id]            |\n+------------+------------------------------------------------+\n| \"prod-eu\"  | {\"region\":\"eu-central\",\"tags\":{\"pci-level\":2}} |\n| \"prod-us\"  | {\"region\":\"us-east\"}                           |\n| \"test-eu\"  | {\"region\":\"eu-west\",\"tags\":{\"pci-level\":4}}    |\n| \"test-us\"  | {\"region\":\"us-west\"}                           |\n+------------+------------------------------------------------+\n```\n\n### Example: SSH Auditing\n\nThis example shows how you can audit who has SSH access to hosts within\ndifferent clusters. We will assume that SSH access is granted via group access\nin LDAP.\n\n```ruby\nimport data.ldap\nimport data.clusters\n\nssh_access[[cluster_name, host_id, user_id]] {\n    host_id = clusters[cluster_name].hosts[_]\n    group_id = ldap.users[user_id].groups[_]\n    group_id = clusters[cluster_name].groups[_]\n}\n\nprod_users = {user_id | ssh_access[[\"prod\", _, user_id]]}\n```\n\n#### Example Queries\n\n**Who can access production hosts?**\n\n```ruby\n\u003e prod_users\n[\n  \"alice\",\n  \"bob\"\n]\n```\n\n**Display all LDAP users:**\n\n```ruby\n\u003e data.ldap.users[user_id]\n+-------------------------------+---------+\n|   data.ldap.users[user_id]    | user_id |\n+-------------------------------+---------+\n| {\"groups\":[\"dev\",\"platform\"]} | \"alice\" |\n| {\"groups\":[\"dev\",\"ops\"]}      | \"bob\"   |\n| {\"groups\":[\"dev\"]}            | \"janet\" |\n+-------------------------------+---------+\n```\n\n**Display all cluster/group pairs:**\n\n```ruby\n\u003e data.clusters[cluster_id].groups[_] = group_id\n+------------+------------+\n| cluster_id |  group_id  |\n+------------+------------+\n| \"test\"     | \"dev\"      |\n| \"test\"     | \"ops\"      |\n| \"prod\"     | \"ops\"      |\n| \"prod\"     | \"platform\" |\n+------------+------------+\n```\n\n**Does Janet have access to the test cluster?**\n\n```ruby\n\u003e ssh_access[[\"test\", _, \"janet\"]]\ntrue\n```\n\n**What are the addresses of the hosts in the test cluster that Janet can access?**\n\n```ruby\n\u003e ssh_access[[\"test\", host_id, \"janet\"]]; addr = data.hosts[host_id].addr\n+------------+------------+\n|    addr    |  host_id   |\n+------------+------------+\n| \"10.0.0.1\" | \"host-abc\" |\n| \"10.0.0.2\" | \"host-cde\" |\n| \"10.0.0.3\" | \"host-efg\" |\n+------------+------------+\n```\n\n## Further Reading\n\n### Presentations\n\n- Open Policy Agent Introduction @ CloudNativeCon EU 2018: [video](https://youtu.be/XEHeexPpgrA), [slides](https://www.slideshare.net/TorinSandall/opa-the-cloud-native-policy-engine)\n- Rego Deep Dive @ CloudNativeCon EU 2018: [video](https://youtu.be/4mBJSIhs2xQ), [slides](https://www.slideshare.net/TorinSandall/rego-deep-dive)\n- How Netflix Is Solving Authorization Across Their Cloud @ CloudNativeCon US 2017: [video](https://www.youtube.com/watch?v=R6tUNpRpdnY), [slides](https://www.slideshare.net/TorinSandall/how-netflix-is-solving-authorization-across-their-cloud).\n- Policy-based Resource Placement in Kubernetes Federation @ LinuxCon Beijing 2017: [slides](https://www.slideshare.net/TorinSandall/policybased-resource-placement-across-hybrid-cloud), [screencast](https://www.youtube.com/watch?v=hRz13baBhfg\u0026feature=youtu.be).\n- Enforcing Bespoke Policies In Kubernetes @ KubeCon US 2017: [video](https://www.youtube.com/watch?v=llDI8VvkUj8), [slides](https://www.slideshare.net/TorinSandall/enforcing-bespoke-policies-in-kubernetes).\n- Istio's Mixer: Policy Enforcement with Custom Adapters @ CloudNativeCon US 2017: [video](https://www.youtube.com/watch?v=czZLXUqzd24), [slides](https://www.slideshare.net/TorinSandall/istios-mixer-policy-enforcement-with-custom-adapters-cloud-nativecon-17).\n\n## Security\n\n### Security Audit\n\nA third party security audit was performed by Cure53, you can see the full report [here](SECURITY_AUDIT.pdf)\n\n### Reporting Security Vulnerabilities\n\nPlease report vulnerabilities by email to [open-policy-agent-security](mailto:open-policy-agent-security@googlegroups.com).\nWe will send a confirmation message to acknowledge that we have received the\nreport and then we will send additional messages to follow up once the issue\nhas been investigated.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fopa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnordcloud%2Fopa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fopa/lists"}