Rego is a declarative policy language used with Open Policy Agent (OPA) to make decisions about structured data. Instead of embedding compliance checks in every team’s deployment pipeline, a platform can evaluate policies at the point of change. Teams retain control of their pipelines while shared requirements remain enforceable. section 4.2 section 4.4
A Rego rule describes data that satisfies a requirement. OPA receives JSON input, evaluates the rule against that input and any other available data, and returns a decision. This makes Rego closer to a data-query language than to a sequence of instructions for performing a deployment. section 4.2.1
package test #1
default allow := false #2
allow if user_is_over_12 #3
user_is_over_12 if { #4
data.user_attributes[input.user].age > 12
}
This small policy defaults to denial. Its allow rule succeeds only when the user named in the input has an age greater than 12 in the supplied user-attribute data. It shows how a predicate turns a data comparison into a decision. section 4.2.1
For a deployment control, build the policy around the decision boundary:
- Choose the request to inspect. A Kubernetes admission controller receives a deployment request before the API completes it. section 4.2.1
- Identify the data the rule needs. A coverage check can combine a deployment’s source identifier with code-quality data associated with that identifier. section 4.2.1
- Write an assertion for the requirement and define the decision when it is not met. An example Rego policy denies a deployment when its recorded coverage is below 80%. section 4.2.1
Enforce the requirement without owning the pipeline
Suppose development teams own their pipelines, but an organization requires at least 90% test coverage for deployed code. An admission-controller policy can check coverage at deployment time rather than inserting a centrally maintained script into every pipeline. The policy and the quality data must reflect the actual requirement: an illustrative 80% rule would not enforce a 90% target. section 4.2 section 4.2.1
Rego is not limited to Kubernetes admission checks. Gatekeeper uses OPA and Rego for Kubernetes policies but structures policies more like Kubernetes resources. If several disciplines will share policy-as-code, consider that difference early: a common policy language can reduce friction across implementations. Another practical exercise is a rule that permits deployments only when container images come from the organization’s registry. section 4.1.1 section 4.3.1
