Open Policy Agent (OPA) is a general-purpose, CNCF-graduated policy engine that decouples policy decision-making from application and infrastructure code, using its declarative language Rego to evaluate structured data such as API requests, Kubernetes manifests, and IaC configurations. Gatekeeper extends OPA into a Kubernetes-native admission controller, providing CRD-based policy management via ConstraintTemplates and Constraints. The core mental model to internalize is that OPA never enforces by itself — it only decides; enforcement always lives in the caller (webhook, sidecar, CI step) that acts on OPA's response.
What This Cheat Sheet Covers
This topic spans 23 focused tables and 216 indexed concepts, 168 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Rego Language Fundamentals
Rego is a declarative, Datalog-inspired query language purpose-built for policy evaluation over JSON/YAML documents. Understanding how Rego evaluates rules — as logical assertions rather than imperative instructions — is the foundation for writing correct policies across all OPA use cases.
| Concept | Example | Description | |
|---|---|---|---|
package authz | • Namespaces rules • the package path determines the OPA data document path (e.g., data.authz). | ||
allow if { input.method == "GET"} | • Complete rule with a single value • in Rego v1 (OPA 1.0+) the if keyword is mandatory before the rule body | ||
default allow := false | • Provides a fallback value when no other rule matches • prevents undefined decisions, which differ from false. | ||
input.user.role == "admin" | • The JSON object passed to OPA at query time • represents the request, event, or resource being evaluated | ||
data.roles["admin"] | OPA's in-memory store for base documents (static JSON/YAML loaded via API, bundles, or Gatekeeper sync). | ||
x := 42 | • Unification with explicit assignment • preferred over bare = for readability in Rego v1. | ||
input.count == 5 | • Strict equality check • unlike :=, does not bind variables | ||
x = 42 | • Simultaneously binds and tests • evaluates to undefined if unification fails, which can be a gotcha. | ||
not input.privileged | • Negation-as-failure: true when the expression under not is undefined or false• cannot bind new variables | ||
some i; input.users[i].role == "admin" | • Declares a local variable for iteration • makes the variable's scope explicit and prevents shadowing | ||
every user in input.users { user.active == true} | • Universally quantifies over a collection • rule body must be true for every element or the expression fails | ||
"admin" in input.roles | • Membership test • also used with some for explicit iteration over collections | ||
allowed := {"GET", "POST"} | • Unordered collection of unique values • empty set requires set() — {} is an empty object, not an empty set | ||
names := [n | n := input.users[_].name] | • Builds a new array by iterating a collection • OPA memoizes comprehensions for O(n) group-by performance | ||
names := {n | n := input.tags[_]} | • Builds a deduplicated set • never undefined — returns an empty set {} when no elements match | ||
{k: v | k := input.meta[_].key; v := input.meta[_].val} | • Builds an object by iterating key-value pairs • useful for restructuring JSON data | ||
allow if { input.role == "admin" }allow if { input.role == "owner" } | • Multiple rules with the same name are unioned (OR) • the rule is true if any body evaluates to true | ||
violations contains msg if { not input.encrypted msg := "unencrypted resource"} | • Collects multiple values into a set • used in Gatekeeper violation rules | ||
is_admin(user) if { user.role == "admin"} | • Named rule with arguments • enables reuse and abstraction across policies | ||
allow with input as {"role": "admin"} | • Replaces input, data, or built-in functions during evaluation• essential for unit testing policies | ||
import data.authz.allow | • Aliases a document path • import rego.v1 opts into OPA 1.0 syntax in pre-1.0 builds | ||
input.containers[_].image | • Anonymous variable • a new iterator is instantiated each time _ appears, so two _ are independent | ||
msg := sprintf("missing label: %v", [key]) | • Formats violation messages • most common built-in used in Gatekeeper policies |