OPA/Rego is now a stable, first-class policy language for Pulumi with Kubernetes Gatekeeper compatibility and full feature parity.

The Pulumi blog provides developers with resources, tutorials, and best practices for infrastructure as code (IaC) and cloud-native development using Pulumi's open-source tools. Developers can learn about deploying and managing infrastructure using familiar programming languages such as JavaScript, TypeScript, Python, and Go. Additionally, the blog covers topics such as cloud architecture patterns, multi-cloud deployments, and serverless computing, enabling developers to build and deploy modern cloud applications with ease.

Pulumi

Pulumi's OPA/Rego policy support has reached stable status with the v1.1.0 release of pulumi-policy-opa. It now has full feature parity with the TypeScript and Python policy SDKs, supporting resource and stack-level policies, enforcement levels, policy configuration, and OPA metadata annotations. A key new feature is Kubernetes Gatekeeper compatibility mode: by setting `inputFormat: kubernetes-admission` in PulumiPolicy.yaml, existing Gatekeeper constraint template `.rego` files can be dropped directly into a Pulumi policy pack and enforced against Kubernetes resources without modification. This shifts policy enforcement left, catching violations during `pulumi preview` before resources reach the cluster. OPA policies integrate with Pulumi Insights for audit scans, self-hosted execution, and pre-built compliance packs for CIS, NIST, and PCI DSS.

From Kubernetes Gatekeeper to Full-Stack Governance with OPA

Walkthrough: Reusing policies from the gatekeeper-library

Part of the Pulumi Insights governance story