Promote OPA Policies from Git with a Test and Approval Gate

Give every Open Policy Agent (OPA) change a safe, auditable path to production. This blueprint orchestrates the full OPA policy lifecycle: it pulls Rego policies from a Git repository, runs the opa test suite, holds promotion for an explicit human approval, and only then uploads the reviewed module to a running OPA server. Untested or unapproved Rego never reaches the enforcement point, which closes the gap between a policy commit and the authorization decisions it controls for Kubernetes admission, API authorization, and other guardrails.

How it works

1. clone_policies (io.kestra.plugin.git.Clone) clones the repo at policy_repo and policy_branch into a policies directory.
2. test_policies (io.kestra.plugin.scripts.shell.Commands) runs opa test policies/ -v inside the openpolicyagent/opa:latest-debug container via the Docker task runner.
3. notify_approval (io.kestra.plugin.googleworkspace.chat.GoogleChatIncomingWebhook) posts a Google Chat message telling the team that a tested policy is waiting.
4. approve_promotion (io.kestra.plugin.core.flow.Pause) blocks for up to approval_timeout (default PT2H) until a human resumes the execution.
5. upload_policy (io.kestra.plugin.ee.opa.policy.Upload) reads the policy_file and creates or replaces the module identified by policy_id on the OPA server.

What you get

• A test gate that stops broken Rego before it is deployed.
• A human approval checkpoint with a Google Chat notification.
• Idempotent create-or-replace upload of a single policy module.
• A full execution record of who promoted what, and when.

Who it's for

• Platform and security engineers managing OPA enforcement points.
• DevSecOps teams treating policy as code with review gates.
• SREs who need an auditable promotion path for authorization rules.

Why orchestrate this with Kestra

OPA itself has no built-in pipeline to test, review, and deploy Rego from a repository. Kestra fills that gap with event triggers, automatic retries, full execution lineage, and a Pause task for human-in-the-loop approval, all declared in plain YAML. You get one auditable workflow from commit to enforcement instead of scattered scripts.

Prerequisites

• A Git repository with Rego policies and tests that opa test can run.
• A reachable OPA server with the REST API enabled.

Secrets

• OPA_URL: base URL of the OPA server (for example, https://opa.example.com).
• OPA_TOKEN: bearer token for the OPA server, if authentication is enabled.
• GOOGLE_CHAT_WEBHOOK_URL: Google Chat incoming webhook URL for the approval notification.

Quick start

1. Add OPA_URL, OPA_TOKEN, and GOOGLE_CHAT_WEBHOOK_URL to your Kestra namespace secrets.
2. Set policy_repo, policy_branch, policy_id, and policy_file for your Rego project.
3. Run the flow, watch opa test pass, then resume the Pause to upload the module.

How to extend

• Replace the disabled Schedule trigger with a Git push webhook to promote on merge.
• Add a smoke opa eval step against sample input before the approval pause.
• Loop over multiple policy_file values to promote several modules at once.
• Notify a different channel by swapping the Google Chat task for Slack or email.

Links

• Plugin docs: plugin-opa
• Orchestrate OPA with Kestra