OPA in Practice

This two-day practical course provides engineers with a comprehensive introduction to Open Policy Agent (OPA) and Rego, focusing on consistent authorisation and governance decisions across applications, APIs, platforms, and infrastructure. Delegates engage in demonstrations, guided exercises, and a scenario-based workshop to learn how to define policy decisions, identify required information, implement rules in Rego, and test results. The course also explores policy integration, deployment, distribution, and governance. Practical activities are delivered through a browser-based OPA workshop environment, with scenarios covering API authorisation, Kubernetes/OpenShift, cloud governance, and virtualisation.

Prerequisites

Participants should have:

• Ability to read basic JSON and technical configuration files
• Working understanding of applications, APIs, or infrastructure
• Some scripting or programming experience is helpful

No prior experience with OPA or Rego required

Target audience

This course is designed for:

• Engineers responsible for authorisation and governance decisions across applications, APIs, platforms, or infrastructure
• Technical professionals seeking practical skills in policy definition, implementation, and testing using OPA and Rego
• Individuals interested in integrating, deploying, and governing policy modules in cloud and virtualised environments

Open Policy Agent Fundamentals

• Explore the concept of policy as code and the challenges OPA addresses
• Examine input, reference data, policy evaluation, and decision results
• Understand policy decision points and enforcement points
• Guided exercise: trace a request from policy requirement to decision and action

OPA Use Cases

• Investigate API authorisation and Kubernetes/OpenShift admission scenarios
• Review governance for cloud, infrastructure, and delivery workflows
• Identify suitable policy decisions and integration responsibilities
• Scenario exercise: determine the decision, required facts, and enforcement point

Modelling Policy and Access Decisions

• Analyse subjects, roles, permissions, entitlements, actions, and resources
• Compare role-based and attribute-based access control approaches
• Discuss authoritative sources, missing information, exceptions, and result contracts
• Workshop: turn an incomplete scenario into a policy decision worksheet

Rego Fundamentals and Policy Testing

• Learn about packages, rules, queries, input, and supporting data in Rego
• Understand default behaviour, helper rules, and structured decision results
• Conduct positive, negative, boundary, and missing-information tests
• Hands-on lab: evaluate, modify, and test a policy in the Rego Playpen

Architecture Governance and Distribution

• Examine integration of systems and trusted input
• Compare centralised, nearby shared, and sidecar deployment patterns
• Review policy modules, bundles, distribution, and runtime activation
• Discuss ownership, review, approval, promotion, audit, and rollback processes
• Demonstration: follow a policy from local development to distributed release

OPA in Action and Scenario Workshop

• Follow input creation, evaluation, result interpretation, and enforcement in practice
• Address missing evidence, rejected requests, and unusable decisions
• Hands-on workshop: implement the agreed scenario contract in Rego
• Test, troubleshoot, and explain the policy and its integration assumptions

Exams and assessments

• Assessment of understanding through scenario-based exercises and practical workshops
• Evaluation of policy implementation, testing, and troubleshooting skills
• Review of delegates’ ability to present and explain tested policies and integration assumptions

Hands-on learning

This course includes:

• Guided exercises tracing policy requirements to decisions and actions
• Scenario-based workshops for policy modelling and implementation
• Hands-on labs using the browser-based OPA workshop environment to evaluate, modify, and test Rego policies
• Practical activities covering API authorisation, Kubernetes/OpenShift, cloud governance, and virtualisation scenarios

By the end of this course, learners will be able to:

• Explain how OPA supports policy as code and distinguish decision-making from enforcement
• Identify suitable OPA use cases across applications, APIs, and infrastructure
• Define a decision contract with inputs, trusted sources, rules, and expected outcomes
• Model access decisions using roles, permissions, and contextual attributes
• Write and modify Rego policies using structured input and reference data
• Test permitted, rejected, boundary, and missing-information cases, and troubleshoot unexpected results
• Compare OPA deployment patterns and explain policy bundles, distribution, and activation
• Describe policy ownership, change control, and the responsibilities of integrating systems
• Implement and present a tested policy for a practical scenario