Policy-as-Code Vocabulary
5 exercises — Practice policy enforcement vocabulary: OPA, Rego, admission controllers, Gatekeeper, Sentinel, constraints, violations, and waivers.
Core Policy-as-Code vocabulary clusters
- OPA & Rego: Open Policy Agent, Rego language, policy rule, allow/deny, input document, data document, partial evaluation
- Kubernetes enforcement: admission controller, validating webhook, mutating webhook, Gatekeeper, constraint template, constraint, violation
- Governance frameworks: Sentinel, compliance-as-code, policy gate, exception, waiver, audit mode vs. enforcement mode
0 / 5 completed
1 / 5
A platform engineer explains the technology stack:
"We use OPA as our policy engine across the board — not just Kubernetes. The same engine evaluates policies for our CI pipeline, our Terraform runs, and our microservices authorisation layer. Policies are written in Rego and the engine answers a simple question: given this input document and this data document, does the policy allow or deny?"
What is the role of the input document in an OPA evaluation?
"We use OPA as our policy engine across the board — not just Kubernetes. The same engine evaluates policies for our CI pipeline, our Terraform runs, and our microservices authorisation layer. Policies are written in Rego and the engine answers a simple question: given this input document and this data document, does the policy allow or deny?"
What is the role of the input document in an OPA evaluation?
Input document: the JSON-structured data representing the request or resource being evaluated. In Kubernetes, it is the admission review object — e.g., a pod spec sent to OPA before it is created. In an API gateway context, it might be the HTTP request (method, path, headers, JWT claims).
Contrast with the data document: static or semi-static reference data loaded into OPA (e.g., approved registries, employee roles). Rego policies can reference both. The policy returns a decision — typically
Contrast with the data document: static or semi-static reference data loaded into OPA (e.g., approved registries, employee roles). Rego policies can reference both. The policy returns a decision — typically
allow = true or a set of deny messages.
Vocabulary Reference
Key policy-as-code terms and their definitions.
- OPA (Open Policy Agent)
- A CNCF graduated project providing a general-purpose policy engine. Decouples policy decisions from application logic. Used across Kubernetes admission, API authorisation, CI pipelines, and Terraform. Policies are written in Rego.
- Rego
- The declarative query language used to write OPA policies. Policies are expressed as rules that compute values (typically
allowor a set ofdenymessages) from input and data documents. - Input document / Data document
- The input document is the JSON object representing the request being evaluated (e.g., a Kubernetes admission request). The data document is static or semi-static reference data loaded into OPA (e.g., approved registries, team metadata).
- Admission controller
- A Kubernetes component that intercepts API server requests before resources are persisted. Admission controllers can validate (accept/reject) or mutate (modify) resources. OPA/Gatekeeper is implemented as an admission controller.
- Mutating webhook / Validating webhook
- Two phases of the Kubernetes admission chain. A mutating webhook can alter a resource (e.g., inject a sidecar). A validating webhook runs after mutations and can only approve or reject. Both are invoked via HTTPS callbacks.
- Gatekeeper
- An OPA-based Kubernetes admission controller (CNCF project). Policies are expressed as ConstraintTemplates (Rego logic + CRD definition) and Constraints (parameterised instances). Violations are surfaced as Kubernetes custom resources.
- Sentinel
- HashiCorp's policy-as-code framework, integrated with Terraform, Vault, Nomad, and Consul. Policies act as policy gates in the run pipeline — a failing policy blocks a plan from being applied.
- Compliance-as-code
- The practice of encoding regulatory and organisational compliance controls as version-controlled, automatically evaluated code rather than manual checklists. Enables audit trails, peer review of controls, and shift-left compliance enforcement.
- Violation
- A resource or request that fails a policy rule. In Gatekeeper, violations are stored as fields on Constraint objects. A violation message describes what failed and why, aiding remediation.
- Exception / Waiver
- An exception is a managed, version-controlled exclusion of a specific resource from a policy rule. A waiver is a time-bound, documented acknowledgement of a known violation, approved by a risk owner, with a remediation deadline.