Commercial Tools

Meetup Groups

• Scalr - Collaboration and Automation for Terraform, backed by OPA
• Snyk IaC - Test Infrastructure as Code source code repositories for security misconfigurations and best practices. The OPA golang libraries are used to evaluate Rego policies to detect misconfigurations in the repositories.
• Spacelift
• env0

Community

Meetup Groups

• Slack

Datasource Integrations

Blogs and Articles

• Kafka Authorizer - Kafka authorizer plugin using OPA, with example policies
• OPA Single Message Transformer - Single Message Transformer for Kafka. Uses OPA to choose which records to filter out based on policy.
• Data Filtering on Spring Data - Data filtering for MongoDB and JPA using OPA
• Elasticsearch - OPA-Elasticsearch Data Filtering Example
• Strimzi - Kafka in kubernetes, with built-in support for OPA as authorizer
• Google Calendar - Integrating OPA with the Google Calendar API
• Alluxio - Alluxio is a data orchestration tool which allows delegating access control decisions to OPA
• Inspektor - Access Control as Code for databases using OPA to make its access decision
• OPA SpiceDB - OPA integration with Authzed SpiceDB that allows to use ReBAC in policies for authorization

Datasource Integrations Blogs and Articles

• Google Calendar Integration - The Power of Data: Calendar-based Policy Enforcement
• Apache Kafka - Controlling Kafka Data Flows using Open Policy Agent

Fun and Quirky

Testing Blogs and Articles

• How I Used OPA to Help Me Solve Wordle - OPA as a Wordle assistant
• Policing Christmas Tree - Using Rego to determine the correctness of Christmas tree decorations
• Corrupting OPA to Run My Games - Fun blog on using OPA for game engines
• Colorized - Colorized output for the OPA print function!

IDE and Editor Integrations

Datasource Integrations Blogs and Articles

• VS Code plugin - Develop, test, debug, and analyze policies for OPA in VS Code
• IntelliJ plugin - OPA plugin for the IntelliJ IDE
• Zed Extension - Zed extension for OPA and Rego leveraging Regal
• Emacs - Emacs Major mode for working with Rego
• Vim - Vim plugin for the Rego language, with support for syntax highlighting
• Null-ls - Use Neovim as a language server to inject LSP diagnostics, code actions, and more. Supports linting rego files.
• Atom - Syntax highlighting for the Atom editor
• CodeMirror - Rego mode and minimal key map for CodeMirror
• TextMate - Syntax highlighting for TextMate
• Sublime - Syntax highlighting for Sublime
• Nano - Syntax highlighting for Nano
• Prism - Prism is a lightweight, extensible syntax highlighter, built with modern web standards in mind (supports Rego)
• tree-sitter-rego - Tree-sitter grammar for Rego (blog)
• highlight.js - Rego syntax support for highlight.js
• codemirror-lang-rego - Complete Rego language support for CodeMirror 6, with syntax highlighting, autocomplete, and intelligent data context awareness.

Infrastructure as Code

Datasource Integrations Blogs and Articles

• OPA AWS CloudFormation Hook - AWS CloudFormation Hook calling OPA for policy decisions. See also tutorial.
• TFLint OPA Ruleset - Write custom TFLint rules in Rego
• Regula - Evaluates Terraform code for potential security misconfigurations and compliance violations.
• Example Terraform policies - Example Terraform policies
• KICS - Keeping Infrastructure as Code Secure or KICS scans IaC projects for security vulnerabilities, compliance issues, and infrastructure misconfiguration. Currently working with Terraform projects, Kubernetes manifests, Dockerfiles, AWS CloudFormation Templates, and Ansible playbooks.
• Trivy - Scan your code and artifacts for known vulnerabilities and misconfiguration issues.
• Terraform OPA IBM - Terraform policy library for IBM Cloud
• GCP policy guardrails for Terraform - Rego reference policy library for GCP controls (originally from forseti). Originally used by terraform-validator and now on gcloud beta terraform vet. More info at Policy Validation
• Pulumi OPA Bridge for CrossGuard - This project allows OPA rules to be run in the context of Pulumi's policy system, CrossGuard
• Terrascan - 500+ Policies written in OPA for security best practices.

Infrastructure as Code Blogs and Articles

• Kubernetes Authorization - Kubernetes Authorization via Open Policy Agent
• Using OPA with Pulumi CrossGuard - Authoring Pulumi CrossGuard Policy with OPA
• AWS CDK with OPA - Realize Policy-as-Code with AWS Cloud Development Kit through Open Policy Agent
• Using OPA with Spacelift - Open Policy Agent: What Is OPA and How It Works (Examples)

Kubernetes

Blogs and Articles

• Policy Enabled Kubernetes with OPA - Guide on setting up OPA for kubernetes admission control
• Integrating OPA with Kubernetes - Comprehensive introduction to OPA and Gatekeeper
• Using OPA on EKS - Using Open Policy Agent on Amazon EKS
• OPA and Gatekeeper - Comparison between OPA and Gatekeeper with lots of useful information
• Gatekeeper in a CI/CD pipeline - Guide on how to setup your CI environment to test your Kubernetes configuration against your policy in a CI environment as part of a GitOps strategy
• Verifying container signatures on Kubernetes with Gatekeeper - Verifying container signatures on Kubernetes with Gatekeeper
• Gator CLI - Testing Gatekeeper constraints with Gator CLI
• Kubernetes: An Enterprise Guide, 2nd Ed Chapter 9 - Node Security with GateKeeper - Walk through labs that show the differences between VMs and containers with a breakout, creating securityContext defaults using mutations, replacing PodSecurityPolicy using GateKeeper, debuging audit violations, and policies for multi-tenant clusters.
• OPA Gatekeeper: Policy and Governance for Kubernetes - Kubernetes blog post
• Kubernetes: An Enterprise Guide, 2nd Ed Chapter 8 - Extending Security with OpenPolicyAgent - Walk through labs that show you how to build, debug, and deploy GateKeeper policies and mutations in your cluster.

Built with Wasm

• Gatekeeper - A validating and mutating webhook that enforces CRD-based policies executed by OPA for Kubernetes
• Red Hat Rego Policies - Red Hat Rego policies collection
• Konstraint - CLI tool for working with templates and constraints when using Gatekeeper
• Gatekeeper Policy Manager - Web UI for Gatekeeper policies
• Validating and Mutating Admission Control Example - Example validating and mutation admission controller
• MagTape - OPA-based admission controller for policy enforcement
• Meshery - Meshery leverages built-in relationships to enforce Kubernetes configuration best practices and enhances the development process through custom rules in OPA's Rego query language
• Admission policy development - OPA Kubernetes validation and mutation testing environment
• Gatekeeper Conftest plugin - A Conftest plugin that transforms input objects to be compatible with OPA Gatekeeper policies.
• Cosign Gatekeeper Provider - Cosign Provider a new provider of OPA Gatekeeper's ExternalData feature to verify container images
• Kove - Watch your in-cluster Kubernetes manifests for OPA policy violations and export them as Prometheus metrics
• GKE Policy Automation - Tool and policy library for reviewing GKE clusters against best practices
• kube-mgmt - Sidecar providing data from Kubernetes to OPA. Includes Helm charts for both projects
• Kubescape - Kubescape is tool for scanning Kubernetes clusters for security issues. Kubescape tests (rules) are based completely on OPA. See the regos here
• KubeStellar Console - Open source AI-powered multi-cluster Kubernetes dashboard with built-in OPA/Gatekeeper policy visualization, real-time compliance monitoring across hybrid edge and cloud environments. CNCF Sandbox project (Apache 2.0)

Service Mesh Authorization

• OPA Envoy Plugin - The OPA Envoy Plugin (compatible with Envoy, Istio, Gloo Edge, more)
• Open Service Mesh - Envoy based service mesh using OPA for external authorization
• Kuma - OPA for Kuma service mesh
• Kong Mesh - OPA for Kong Mesh authorization (docs)

Language and Platform Integrations

Clojure

• clj-opa - Middleware and utilities for app authorization with OPA in Clojure

Containers

• Konveyor Forklift Validation Service - VM migration suitability assessment to avoid migrating VMs that are not fit for Kubevirt. Rules are applied on all the VMs of the source provider (VMware) during the initial inventory collection, then whenever a VM configuration changes.

CPP

• rego-cpp - Rego compiler and runtime implemented in C++. It provides a C FFI with Rust and Python bindings in addition to an extensible C++ implementation.
• regorus - C++ bindings to Regorus, a fast, lightweight Rego interpreter written in Rust.

Docker

• OPA Docker authorization - OPA to help policy-enable an existing services
• Docker Security Checker - OPA Rego policies for Dockerfile Security checks using Conftest
• Dockerfile security - A collection of OPA rules to statically analyze Dockerfiles to improve security

Go

• Go Example API Authorization - Example API authorization using OPA
• Fiber OPA Integration - OPA integration for Fiber web framework. Enables to execute Rego policies in the middlewares.
• HTTP API OPA middlewares - Collection of OPA middlewares for your HTTP/Gin/Fiber API.
• regorus - Golang bindings to Regorus, a fast, lightweight Rego interpreter written in Rust.

Java

• Styra Java SDK - Java SDK for interacting with OPA (documentation)
• OPA Java Client - Generic Java client to query OPA's REST API
• Spring Security - OPA Spring Security Library
• Spring Security Reactive - OPA with Spring Security Reactive
• Gradle - OPA plugin for Gradle
• Thunx - Thunx is a pluggable ABAC system using OPA, Spring Cloud Gateway and Spring Data REST
• Java SDK - Java SDK for interacting with OPA (documentation)
• Spring Boot Starter for OPA ABAC - Spring-native ABAC authorization backed by OPA: @OpaPreAuthorize method security, hierarchical resource authorization, and partial-evaluation → JPA Specification data filtering

.NET

• Styra C# SDK - C# SDK for interacting with OPA (documentation)
• ASP.NET Core - ASP.NET Core authorization middleware
• OpaDotNet.Extensions.AspNetCore - ASP.NET Core authorization infrastructure
• regorus - C# bindings to Regorus, a fast, lightweight Rego interpreter written in Rust.
• C# SDK - C# SDK for interacting with OPA (documentation)

Node.js

• OPA Express - OPA client for the Express framework

PHP

• OPA Library for PHP - OPA client, a PSR-15 authorization middleware and a PSR-15 bundle distributor middleware

Python

• OPA Python - Python client library for Open Policy Agent
• OPA Python client - Python client for OPA's REST API
• Flask OPA - OPA client for the Flask microframework
• Bottle Authorization - Custom Bottle Application Authorization
• Rego Python - Python package for interacting with Rego
• Sphinx Rego - Sphinx extension that automatically documents Rego policies
• regorus - Evaluate Rego policies in Python using Regorus, a fast, lightweight Rego interpreter written in Rust.

Rust

• regorust - Rust crate wrapping the C FFI for rego-cpp, allowing in-process Rego policy evaluation using idiomatic Rust.

Swift

• swift-opa - Swift package for evaluating OPA IR Plans compiled from Rego policies

Typescript

• Styra OPA Typescript SDK - Typescript SDK for interacting with OPA (documentation)
• OPA Typescript SDK - Typescript SDK for interacting with OPA (documentation)

Nomad

Blogs and Articles

• Nomad Admission Control Proxy - An admission controller that can be used as a proxy to Nomad's API for mutation and validation with builtin OPA support.

Official projects

Blogs and Articles

• OPA - Official blog for the OPA project
• Logo - The OPA Logo in different versions

Docs

• Styra Academy - Excellent OPA training courses
• Gatekeeper - OPA Gatekeeper docs
• Conftest - Conftest documentation
• Rego Style Guide - Style guide for Rego, providing pointers on best practices for policy authoring
• Regal Docs - Documentation for 60+ linter rules, providing an excellent reference for learning Rego
• Rego Style Guide - Style guide for Rego, providing pointers on best practices for policy authoring
• Regal Docs - Documentation for 60+ linter rules, providing an excellent reference for learning Rego

Repositories

• OPA - Open Policy Agent Github repository
• Conftest - Write tests against structured configuration data

Other Usecases

Testing Blogs and Articles

• SansShell - A non-interactive daemon for host management, where any action is authorized by OPA
• goast - Go AST (Abstract Syntax Tree) based static analysis tool using Rego
• Reposaur - Audit, verify and report on development platforms (GitHub and others) easily with pre-defined and/or custom policies.
• backstage-opa-plugins - Plugins for integrating OPA with Backstage, including OPA-based authorisation.

People

Community Stars

• @Parsifal-M - Peter Macdonald 🇬🇧 - OPA contributor and active community member (Mastodon, Twitter)
• @m-mizutani - Masayoshi Mizutani 🇯🇵 - Security engineer. Prolific OPA & Rego advocate (Twitter)
• @RoyOsaki - Roy Hiroyuki OSAKI 🇺🇸 - Research engineer. OPA community contributor (Twitter)
• @developer-guy - Batuhan Apaydin 🇹🇷 - OPA and many CNCF projects (Mastodon, Twitter)
• @nmeisenzahl - Nico Meisenzahl 🇩🇪 - All about OPA and cloud native topics (Twitter)
• @jaspervdj - Jasper Van der Jeugt 🇨🇭 - OPA contributor (Mastodon)
• @willbeason - Will Beason 🇺🇸 - Ex Gatekeeper maintainer (Mastodon)
• @peteroneilljr - Peter O'Neill 🌎 - Ex OPA community advocate (Mastodon, Twitter)
• @antonioberben - Antonio Berben 🇪🇸 - OPA Contributor & Blogger

Maintainers

• @open-policy-agent - Official OPA account 🌎 (Mastodon, Bluesky, Twitter)
• @tsandall - Torin Sandall 🇨🇦 - OPA co-creator (Twitter)
• @timothyhinrichs - Tim Hinrichs 🇺🇸 - OPA co-creator (Twitter)
• @ashutosh-narkar - Ash Narkar 🇺🇸 - OPA maintainer (Twitter)
• @philipaconrad - Philip Conrad 🇺🇸 - OPA maintainer (Twitter)
• @anderseknert - Anders Eknert 🇸🇪 - OPA developer advocate (Mastodon)
• @charlieegan3 - Charlie Egan 🇬🇧 - OPA developer advocate (Mastodon)
• @ritazh - Rita Zhang 🇺🇸 - Gatekeeper maintainer (Mastodon, Twitter)
• @sozercan - Sertaç Özercan 🇺🇸 - Gatekeeper maintainer (Mastodon, Twitter)
• @jpreese - John Reese 🇺🇸 - Conftest maintainer (Mastodon, Twitter)

Meetup Groups

• Amsterdam OPA Users
• London OPA Meetup
• Stockholm OPA Users

Policy Packages

Blogs and Articles

• Library - Community-owned policy library for OPA
• Policy Hub CLI - CLI tool that makes Rego policies searchable
• Appshield - Open Database of rego policies for common Infrastructure as Code files
• Conftest policy packs - Collection of Conftest policies for "Compliance-as-Code" security policies and general engineering standards. Policies targeting Terraform, Dockerfiles, package.json (NodeJS) files, etc
• Confectionary - A library of rules for Conftest used to detect Terraform misconfigurations.
• Kubescape Rego library - Comprehensive set of Kubernetes policies from Kubescape
• Kubernetes Security Policies - Raspernetes library for fortifying cluster configurations
• agt-policies-nigeria - Policy-as-Code for African AI agent compliance: NDPA 2023, CBN transaction limits, BVN/NIN data protection, NFIU AML/CFT, and POPIA. Includes 88 OPA tests, CI pipeline, and full compliance mapping.
• GOPAL - 66 Rego policies encoding AI-governance regulations as executable checks: EU AI Act, NIST AI RMF, FERPA/COPPA, fair lending. Versioned under v1/ with semver guarantees, allow/deny test per policy, opa check + Regal in CI.
• Rego Policy Libraries - 600+ production-ready Rego v1 policies for CIS Benchmarks (incl. EKS/AKS/GKE), DISA STIGs, CISA SCuBA M365, NSA/CISA K8s Hardening, Pod Security Standards, NIST, NERC-CIP, IEC 62443, ISO 27001, SOC 2, PCI-DSS, EU AI Act, FERPA/COPPA, and 55+ frameworks. Vendor-neutral, fail-closed, Apache 2.0, with OCI bundle distribution.

Recommended Reading

Testing Blogs and Articles

• OPA Guidebook - Open source, free book on Open Policy Agent, by Sangkeon Lee (source code)
• Microservices Security in Action - Book on microservices security, with dedicated section covering OPA. Freely available online
• Gusto Engineering
• Fugue (now Snyk) - 5 tips for using the Rego language for Open Policy Agent
• Integration - Control User Access and Permissions in CVAT with Open Policy Agent
• Gusto Engineering
• Gusto Engineering
• Gusto Engineering

Serverless

Infrastructure as Code Blogs and Articles

• OPA Lambda Extension Plugin - A custom plugin for running OPA in AWS Lambda as a Lambda Extension

Serverless Blogs and Articles

• Serverless Policy Enforcement - Connecting Open Policy Agent and AWS Lambda
• Lambda Authorizer - Creating a custom Lambda authorizer using Open Policy Agent

Support and Community

Testing Blogs and Articles

• Styra - Commercial support, and tools for managing OPA at scale, by the creators of OPA
• Stack Overflow - Stack Overflow OPA section
• OPA Slack - Open Policy Agent Slack workspace

Terraform

Blogs and Articles

• awesome-terraform-compliance - Curated list of OPA/Rego policy libraries, IaC scanners (Conftest, Regula, Fugue), and compliance resources for Terraform and OpenTofu.

Testing

Serverless Blogs and Articles

• rego-test-assertions - Helper library for working with assertions in Rego unit tests
• kube-review - CLI tool to quickly create AdmissionReview requests from Kubernetes resources
• gator CLI - Command line unit test runner for OPA Gatekeeper
• ocov - Colors opa test --coverage reports in the terminal
• opa-codecov - Convert OPA test coverage report to a JSON format supported by Codecov
• github-action-opa-rego-test - GitHub Action to automate testing for your OPA Rego policies and generates a report.

Testing Blogs and Articles

• Advanced Rego Testing Techniques - Great blog on testing patterns for Rego, by Nicholaos Mouzourakis

Tools and Utilities

Testing Blogs and Articles

• Regal - Regal is a linter for Rego, with the goal of making your Rego magnificent! (blog)
• setup-opa - GitHub action to configure the Open Policy Agent CLI in your GitHub Actions workflows
• Fregot - Alternative REPL implementation for Rego
• OPA pre-commit - Pre-commit hooks for OPA/Rego/Conftest development
• Monitor OPA Gatekeeper - Monitoring implementation guide for OPA Gatekeeper (blog)
• OpenAPI to Rego - Generate Rego code given an OpenAPI 3.0 Specification
• Temporal reasoning with OPA - Examples for working with time in Rego
• OPAL - Realtime policy and data updates for your OPA agents on top of websockets pub/sub
• OPA Action - OPA Pull-Request Assessor is a GitHub Action that checks files against policies configured in the same repo
• OPA Schema Examples - Examples of extending the OPA type checker with JSON schemas
• Open Policy Containers - Secure software supply chains for OPA policies. Push, pull, tag, test, version, and sign OPA policies.
• Snyk IaC Rules - Maintain library of Rego rules, run integration tests and build WASM bundles for distribution of rules. The OPA libraries are used to build WASM bundles.
• Topaz - Topaz is an open-source application authorization project that uses OPA as the decision engine and supports Rego policies.
• opactl - A simple tool to turn your Rego rule into CLI command (blog)
• alfred - A self-hosted OPA Playground Alternative