From Kubernetes Gatekeeper to Full-Stack Governance with OPA

Why It Matters

This enables organizations to standardize on Rego across their toolchain and catch violations before resources are created, reducing risk and accelerating compliance.

Key Takeaways

• OPA support now stable in Pulumi v1.1.0
• Reuse Gatekeeper .rego policies without changes
• Policy enforcement runs pre‑deployment via pulumi preview
• Supports resource, stack, and advisory enforcement levels
• Works alongside TypeScript and Python policies in groups

Pulse Analysis

Open Policy Agent (OPA) has become the de‑facto standard for policy‑as‑code across cloud native environments, but many teams still juggle multiple policy languages. Pulumi’s latest stable release of the pulumi‑policy‑opa plugin bridges that gap by treating Rego as a first‑class language within its infrastructure‑as‑code platform. Developers can author resource‑level deny or warn rules, stack‑wide validations, and custom configuration schemas directly in Rego, while still leveraging Pulumi’s multi‑cloud provider model. This unifies policy authoring with existing TypeScript or Python SDKs, simplifying governance across AWS, Azure, GCP, Kubernetes and beyond.

The standout feature is seamless compatibility with Kubernetes Gatekeeper. By setting `inputFormat: kubernetes‑admission` in a PulumiPolicy.yaml file, any existing Gatekeeper constraint template can be imported unchanged and executed during `pulumi preview`. This shifts enforcement left, catching misconfigurations before they reach the API server, and eliminates the need to maintain duplicate policy sets. Organizations can now reuse the extensive Gatekeeper Library—covering pod security, image provenance, and resource limits—across both admission control and IaC pipelines, delivering consistent guardrails throughout the lifecycle.

Beyond Kubernetes, OPA policies integrate with Pulumi Insights to provide continuous compliance monitoring. Audits can run against live stacks without redeployment, and self‑hosted runners keep evaluation data within corporate firewalls. Pre‑built compliance packs for frameworks such as CIS, NIST, and PCI DSS sit alongside custom Rego rules in shared policy groups, giving security and operations teams a single pane of glass. By supporting multiple languages in one policy group, Pulumi empowers diverse engineering teams to adopt a unified governance model while preserving flexibility for future extensions.