In Kubernetes, what is the Open Policy Agent (OPA) used for?

• A. The Kubernetes built-in admission controller
• B. The monitoring stack for policy violations
• C. The Open Policy Agent can validate requests and apply policies across the cluster
• D. The logging subsystem for policy audits

Answer: (C)

Open Policy Agent acts as a policy decision point that can validate Kubernetes API requests against policies and enforce them across the cluster. In practice you run OPA as an external admission controller (often via Gatekeeper), so when a request to create or modify a resource arrives, the API server consults OPA. OPA evaluates the request against policies written in Rego and returns a decision to allow or deny, sometimes with a reason. This enables consistent rules everywhere, such as requiring non-root containers, enforcing specific labels, or restricting which namespaces can be used. It’s not the built-in Kubernetes admission controllers, nor a monitoring or logging subsystem—the strength of OPA is centralized policy enforcement across the cluster.