# open-policy-agent Published articles for open-policy-agent. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to attach an owner to every cloud resource you find DevFeed: [How to attach an owner to every cloud resource you find]() Original publisher: [Read original article]() Author: Zeen Rachidi Published: 2026-09-15T14:00:00Z Content type: tutorial Language: en Sources: [The New Stack]() Topics: [Cloud](), [Provisioning](), [Open Policy Agent](), [audit trail]() Tags: [audit-trail](), [cloud](), [cloud-services](), [devops](), [env-zero](), [how-to](), [logs](), [open-policy-agent](), [platform-engineering](), [policy](), [post-contributed](), [provisioning](), [sponsor-env-zero](), [sponsored-post-contributed]() ### AI overview This tutorial explains how to identify cloud resources without assigned owners and prevent new ownerless resources. It presents continuously synced inventory queries, Open Policy Agent policies requiring owner tags, and logs or audit trails for resource governance. ### Source excerpt The engineer who knew why that cloud instance existed has left the company. The instance is still running, the bill The post How to attach an owner to every cloud resource you find appeared first on The New Stack. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Optimizing OPA performance: From arrays to objects DevFeed: [Optimizing OPA performance: From arrays to objects]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-07T14:25:30Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [opa](), [Open Policy Agent](), [rego](), [Data structures](), [Optimization](), [Algorithms, Complexity]() Tags: [algorithms](), [cloud-native](), [data-structures](), [kubernetes](), [opa](), [open-policy-agent](), [optimization](), [performance-tuning](), [rego](), [software-development](), [software-engineering](), [software-supply-chain]() ### AI overview This article explains how to improve Open Policy Agent performance by choosing appropriate data structures for Rego policies. It focuses on replacing nested arrays with keyed objects to avoid inefficient array traversal when evaluating large datasets. ### Source excerpt Achieve 99% faster Rego policy execution through optimization. Note: This post focuses on one aspect of performance tuning Rego policies and datasets evaluated by OPA-arrays vs. objects. The Rego Style Guide and Regal Rego linter are very helpful resources for learning Rego best practices and avoiding code smells in Rego policies. There is also the OPA performance tuning documentation. In 2018, I started using open policy agent (OPA) as a solution for controlling and preventing unwanted behaviors in our Kubernetes Clusters. OPA, along with Kubernetes Dynamic Admission Control, provided a means to build preventive controls. Since then, I have worked with several PaC solutions. I have always stayed close to the OPA tool set because of how well it supports multiple use cases. OPA is domain agnostic and can be used with virtually any use case, as long as you supply the correct data and policies. To that end, OPA use cases have expanded throughout several technical disciplines, such as cloud-native computing and software supply chain management. OPA performance engineering OPA enables us to unify PaC solutions across multiple use cases and systems, using the same languages and tools. However, there is always room for improvement and performance engineering policies and the execution thereof. In addition, optimizing data that policies evaluate and mutate should be part of our focus when we deliver OPA-based solutions. Recently I was asked to help with OPA performance issues. I made several recommendations, but I overlooked one simple and glaring issue: the poor performing policy was processing a large data set using nested-arrays, instead of the best practice of using keyed-objects. Later, something was bothering me about my interaction and I realized that while I gave decent architectural level advice, I completely missed the best engineering advice. Rego policies and data should be optimized just like other algorithms and relative data, and part of that optimization is ## Secure DevSecOps: Evaluating OPA Policies Local to Your Data DevFeed: [Secure DevSecOps: Evaluating OPA Policies Local to Your Data]() Original publisher: [Read original article]() Author: Abhijit Pujare Rishabh Gupta Published: 2026-06-09T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [Open Policy Agent](), [DevSecOps](), [Security](), [Kubernetes]() Tags: [devsecops](), [firewalls](), [harness](), [open-policy-agent](), [security](), [shift-left]() ### AI overview Harness announces local evaluation of Open Policy Agent policies on Kubernetes infrastructure. The capability is intended to let policies access internal systems and keep API tokens, certificates, and passwords within corporate security and data-residency boundaries. ### Source excerpt Harness solves the firewall dilemma for OPA. Shift-left governance-as-code while keeping API tokens and internal systems secure within your local perimeter. | Blog ## Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD DevFeed: [Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA & Teleport ACD]() Original publisher: [Read original article]() Author: info@goteleport.com (Mohamed Ouad, Doyensec) Published: 2025-06-04T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [benchmarking](), [Authorization](), [Security](), [rego](), [Open Policy Agent](), [Vulnerabilities]() Tags: [authorization](), [benchmarking](), [opa](), [open-policy-agent](), [performance](), [rego](), [security](), [vulnerabilities]() ### AI overview This article introduces the Security Policy Evaluation Framework (SPEF), an automated testing and benchmarking system for evaluating authorization policy engines. It describes how SPEF assesses robustness, correctness, and performance across Rego, Cedar, OpenFGA, and Teleport ACD. ### Source excerpt Explore how the Security Policy Evaluation Framework (SPEF) benchmarks Rego, Cedar, OpenFGA, and Teleport ACD for vulnerabilities, correctness, and performance. ## Kube-Policies: Guardrails for Apps Running in Kubernetes DevFeed: [Kube-Policies: Guardrails for Apps Running in Kubernetes]() Original publisher: [Read original article]() Author: Hardik Darji Published: 2025-01-28T08:00:00Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Kubernetes](), [cloud security](), [Open Policy Agent](), [Testing](), [SIEM, Security, Observability]() Tags: [admission-controller](), [engineering](), [kubernetes](), [observability](), [open-policy-agent](), [security](), [security-policies](), [testing]() ### AI overview This article introduces Square's design considerations for security guardrails in Kubernetes environments. It explains why default Kubernetes configurations can leave applications vulnerable and describes requirements for an abstraction layer built on Open Policy Agent, including policy dry-runs, minimal user disruption, testing, exception management, extensibility, and observability. ### Source excerpt Design considerations for highly sensitive environments. ## Recap from KubeCon + CloudNativeCon Europe 2024 DevFeed: [Recap from KubeCon + CloudNativeCon Europe 2024]() Original publisher: [Read original article]() Author: Thomas Darimont Published: 2024-04-15T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Cloud Native Ecosystem](), [IAM](), [Kubernetes](), [OAuth 2.0](), [Passkeys](), [Open Policy Agent]() Tags: [cloud-native-ecosystem](), [iam](), [idm](), [kerberos](), [keycloak](), [kubecon](), [kubernetes](), [ldap](), [oauth2](), [open-policy-agent](), [openid](), [openid-connect](), [recap](), [saml](), [security](), [sso]() ### AI overview A recap of Keycloak's presence at KubeCon + CloudNativeCon Europe 2024, covering talks on OAuth2 Token Exchange for microservice API security, Keycloak's use in CERN's IAM infrastructure, federated IAM for Kubernetes with OpenFGA, and recent support for Passkeys, OAuth 2.1, and OpenID for Verifiable Credentials. ### Source excerpt After a packed week of fantastic talks at KubeCon + CloudNativeCon Europe 2024 in Paris, we're delighted to share our impressions with the rest of the Keycloak community. Keycloak and OAuth2 Token Exchange for Microservice API Security The presence of Keycloak in many presentations highlighted its importance in the cloud-native ecosystem. Notably, the talk "OAuth2 Token Exchange for Microservice API Security" by Ahmet Soormally & Letz Yaara on OAuth2 Token Exchange (RFC 8693) underscored its application in microservice security and pinpointed areas for Keycloak's enhancement. Efforts to advance the support for Token Exchange are underway, and community feedback is invaluable. Please join the discussion on the current usage of Token Exchange to help us out. Keycloak and the Secrets of the Universe at CERN A standout moment was learning about Keycloak's role at CERN in the talk "The Hard Life of Securing a Particle Accelerator", as shared by Antonio Nappi and Sebastian Lopienski, emphasizing its contribution to securing the particle accelerator's IAM infrastructure. Keycloak supports research on the nature of the universe. How cool is that :) Keycloak, OpenFGA, and Kubernetes Authorizer Jonathan Whitaker's talk "Federated IAM for Kubernetes with OpenFGA" on federated IAM with OpenFGA showcased innovative approaches for managing access to Kubernetes resources through the combination of Keycloak, OpenFGA and a custom Kubernetes Authorizer Web Hook. In particular, the demonstration of temporarily elevated access to Kubernetes resources was very well received. Keycloak: The Leading Edge of AuthN and AuthZ Last but not least, our session, "The Leading Edge of AuthN and AuthZ by Keycloak", presented by Takashi Norimatsu and Thomas Darimont, introduced the latest Keycloak advancements, including support for Passkeys, OAuth 2.1, and OpenID for Verifiable Credentials (OpenID4VC). As part of our talk, we showed the current support for Passkeys and some integration options with ## Enforcing Policies with Gatekeeper in Kubernetes DevFeed: [Enforcing Policies with Gatekeeper in Kubernetes]() Original publisher: [Read original article]() Author: Cameron Wood, Elieser Pereira, Rodrigo Martinez Published: 2022-06-30T13:34:38Z Content type: tutorial Language: en Sources: [Blog - Container Solutions]() Topics: [Kubernetes](), [Security](), [Open Policy Agent](), [Authorization]() Tags: [best-practices](), [how-to](), [kubernetes](), [open-policy-agent](), [open-source](), [policy](), [security](), [security-policies](), [wtf-is-cloud-native]() ### AI overview This tutorial explains how Gatekeeper works with Kubernetes RBAC to enforce authorization rules and pod security policies. It presents Gatekeeper, based on Open Policy Agent, as a way to add deny rules, protect namespaces, and replace deprecated Pod Security Policies. ### Source excerpt When managing Kubernetes clusters, cluster administrators need to ensure the overall stability of the system. To accomplish this it is necessary to avoid disruptions to the control plane, and also avoid any risks of users being able to escalate their privileges thus causing further problems. With this in mind, protecting the kube-system namespace and enforcing pod security policies to run payloads with just the necessary access is a must.