Technology · Ebook

Open Policy Containers: Policy-as-Images for OPA

by Shriira Press

Open Policy Containers (OPCR) is a CNCF sandbox project that brings the Docker workflow to Open Policy Agent. It packages OPA policies as OCI container images you can tag with a semantic version, push to any OCI registry, pull back down, and cryptographically sign with cosign — closing the gap between how we ship application containers and how we ship the authorization rules that guard them. Its CLI, simply called policy, mirrors docker command for command. This book starts with the policy-distribution problem, explains the policy-as-images idea and how OPA bundles map onto OCI manifests and blobs, walks the policy CLI end to end, opens up the architecture, covers signing and the secure supply chain with cosign and Sigstore, and closes with adoption in real OPA deployments.

Contents

1. 1Preface
2. 2Chapter 1 — The Policy Distribution Problem
3. 3Chapter 2 — Policy-as-Images
4. 4Chapter 3 — The `policy` CLI
5. 5Chapter 4 — Inside the Artifact: OCI and OPA Bundles
6. 6Chapter 5 — Signing and the Secure Supply Chain
7. 7Chapter 6 — Open Policy Containers in Practice