Policy as Code with OPA
Write Rego policies with Open Policy Agent, test them with the built-in unit test framework, enforce one against raw Kubernetes manifests, and enforce a second against Terraform plan output — one engine, two very different inputs.
Prerequisites: OPA CLI installed (a single static binary), Docker installed (for the optional Conftest step), and basic familiarity with either Kubernetes YAML or Terraform.
Open Policy Agent decouples policy decisions from the application that needs to make them — instead of writing "is this Kubernetes pod allowed to run as root" as an if-statement scattered inside an admission controller's source code, you write it once as a declarative Rego policy and query OPA for a yes/no decision from anywhere: a Kubernetes admission webhook, a CI pipeline, a Terraform plan check, an API gateway. One policy language, many enforcement points.
This project has you write real Rego from scratch (not just apply an off-the-shelf policy bundle), test it properly, and then enforce the same kind of policy against two structurally different inputs — a Kubernetes manifest and a Terraform plan's JSON output — to see that OPA doesn't care what the input actually is, only that it's structured data.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 6 complete