> For the complete documentation index, see [llms.txt](https://cthfm-k8s.gitbook.io/kubernetes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cthfm-k8s.gitbook.io/kubernetes/security-tools/open-policy-agent-opa/getting-started-with-opa.md).

# Getting Started with OPA

## **Setting Up OPA Overview**

To get started with OPA, you first need to install it on your local machine or within your development environment. OPA can be installed in several ways, depending on your operating system and preferences.

### **Installation Methods:**

* **Via Precompiled Binaries**:
  * Download the appropriate OPA binary from the [OPA GitHub releases page](https://github.com/open-policy-agent/opa/releases).
  * Extract the binary and move it to a directory in your PATH (e.g., `/usr/local/bin` on Unix-based systems).
  * Verify the installation by running `opa version` in your terminal.
* **Via Homebrew (macOS)**:
  * Install OPA using Homebrew by running:

    ```
    brew install opa
    ```
  * Verify the installation by running `opa version`.
* **Via Docker**:
  * OPA is also available as a Docker image, which is ideal for containerized environments. Pull the latest OPA image using:

    ```bash
    docker pull openpolicyagent/opa:latest
    ```
  * Run OPA in a container:

    ```arduino
    docker run -it openpolicyagent/opa:latest run --server
    ```

### **Introduction to the OPA CLI**

The OPA CLI is a powerful tool for interacting with OPA, allowing you to evaluate policies, debug Rego code, and manage OPA instances. The CLI provides various commands to work with policies and data.

**Key Commands:**

* **`opa run`**: Starts the OPA server or evaluates policies directly from the command line.
* **`opa eval`**: Evaluates a Rego policy and returns the result. This is useful for testing and debugging.
* **`opa test`**: Runs tests against your Rego policies to ensure they behave as expected.

**Example Usage:**

* To start an interactive OPA shell:

  ```arduino
  opa run
  ```

  This will drop you into a shell where you can directly interact with OPA, write policies, and evaluate queries.
* To evaluate a simple policy:

  ```bash
  opa eval "data.example.allow"
  ```

  This command evaluates the policy defined in `data.example.allow` and returns the result.

### **Running Your First OPA Policy**

Now that OPA is installed and you’re familiar with the CLI, let’s write and evaluate your first policy. In this example, we’ll create a simple policy that checks if a user is authorized to perform an action.

#### **Step 1: Writing the Policy**

Create a new file called `example.rego` with the following content:

```rego
package example

default allow = false

allow {
    input.user == "alice"
    input.action == "read"
}
```

* **Explanation**:
  * The policy is defined in the `example` package.
  * The `allow` rule determines whether the action is permitted. The default value is `false`, meaning actions are denied by default.
  * The `allow` rule only returns `true` (i.e., allows the action) if the `input.user` is `"alice"` and the `input.action` is `"read"`.

#### **Step 2: Evaluating the Policy**

To evaluate this policy, use the following command:

```bash
opa eval --input - --data example.rego "data.example.allow" <<EOF
{
  "user": "alice",
  "action": "read"
}
EOF
```

* **Explanation**:
  * The `--input` flag provides the input data in JSON format.
  * The `--data` flag loads the `example.rego` file containing the policy.
  * The `"data.example.allow"` argument specifies the policy to evaluate.

**Step 3: Understanding the Output**

If the input matches the conditions defined in the policy, OPA will return:

```json
code{
  "result": [
    {
      "expressions": [
        {
          "value": true
        }
      ]
    }
  ]
}
```

This output indicates that the action is allowed for the user `"alice"` to perform the `"read"` action.

If the input does not match, the result would be `false`, meaning the action is denied.

**Debugging and Testing Rego Policies**

Debugging and testing are crucial when working with policies to ensure they behave as expected.

* **Using `opa eval` for Debugging**:
  * Add trace statements in your Rego code using the `trace` function to help debug the evaluation process. For example:

    ```rego
    allow {
        trace("Checking if user is alice")
        input.user == "alice"
        input.action == "read"
    }
    ```
  * Run the evaluation with the `--explain=full` flag to get detailed traces of the evaluation.
* **Writing Tests**:
  * OPA allows you to write tests for your policies using the `opa test` command. Here’s an example of a test file:

    ```rego
    package example

    test_allow_read {
        result := data.example.allow with input as {"user": "alice", "action": "read"}
        result == true
    }

    test_deny_write {
        result := data.example.allow with input as {"user": "bob", "action": "write"}
        result == false
    }
    ```
  * Run the tests using:

    ```bash
    opa test example.rego
    ```

### **Summary**&#x20;

In this lesson, you’ve learned how to set up OPA, use the OPA CLI, and write and evaluate a simple policy. You’ve also explored how to debug and test Rego policies to ensure they work correctly. This foundational knowledge will be critical as you delve into more complex policies and integrations in future lessons.