AI
OPA as a Unified Policy Engine
OPA gives teams one language for policies that previously lived in many places: Kubernetes admission, git repo access controls, user authorization, CI runner permissions. You write Rego, load it into an OPA instance, send JSON describing the decision, and get a JSON answer back. OPA also reloads policies as they change and writes audit logs for every decision. The pitch is consistency across teams who previously implemented similar logic in different languages, often inconsistently.
What the 2025 Community Survey Showed
The end-of-2025 survey showed two notable shifts. First, the most advanced use case for OPA is now running it in production, a significant change from five years ago. Second, most people first hear about OPA from a colleague or at an event, not from documentation or search. A January study of policy code published on GitHub found a significant share written in Rego, which the maintainers cited as evidence the language has real adoption outside controlled environments.
String Interpolation Replaces sprintf
Rego’s most recent major feature is string interpolation. Previously, sprintf handled dynamic strings, but sprintf maps closely to Go’s formatting verbs, which breaks or requires reimplementation when targeting Rust, C++, Java, or WebAssembly runtimes. The new syntax uses a dollar-sign prefix and supports full expression evaluation inside template strings, including function calls like to_lower. Regal lints and formats inside template strings. The motivation also came from survey data: 81% of respondents work primarily in languages that already have string interpolation.
The or Keyword and LLM-Generated Rego
An explicit or keyword is planned for the next few months. Anders Eknert wrote a blog post titled “how to express or in Rego” years ago; it remains the most-read OPA post online, signaling a persistent pain point. Separately, survey data showed growing use of LLMs to write Rego, but users report hallucinated built-ins and outdated syntax. LLMs frequently emit import rego.v1, which has not been required for some time. The team flagged this as a signal a PR may be AI-generated.
Regal: 107 Rules, 400ms for 300 Files
Regal started as a linter to automate answers to the most common questions on the OPA Slack. It now ships 107 lint rules and a full language server with a debugger, syntax highlighting, go-to-definition, and autocomplete. IntelliJ editor support landed recently. Regal lints its own 300 policy files in 400 milliseconds. Planned additions include find-references, rename-across-project, and better integration with AI coding tools.
OCP, Gatekeeper, and Conftest Updates
OPA Control Plane (OCP) provides a centralized way to manage policies across distributed OPA instances. Recent additions include AWS S3 data source support, intermediate representation and WebAssembly build targets, and configurable bundle revisions. Gatekeeper shipped two releases since the last KubeCon, adding gator bench for policy benchmarking and gator policy for discovering and installing policies from the public Gatekeeper library. Conftest, which runs OPA against local files, gained improvements to output formatting and pre-commit hooks.
Notable Quotes
and 81% of all users are people who responded to so pretty much none of you in here but our other users said they are you mostly using languages that have string interpolation. So making it easier to transition from uh one language to Rego. Anders Eknert · ▶ 10:46
I wrote a blog on this for a few years ago. It’s called like how to express ore in Rego. It’s still the most read blog on OPA and Rego uh out there. Anders Eknert · ▶ 12:11
if you’re reviewing uh Rego PR in your team and you see import Rego V1, that hasn’t been required for quite some time. So if you see that it’s a little bit of a red flag. It’s like hm was this was this generated by cord code or something. Charlie Egan · ▶ 17:01
itself contains about 300 policy files and we lint those 300 in I think 400 milliseconds. Anders Eknert · ▶ 21:25
Key Takeaways
- String interpolation replaces sprintf for most Rego use cases across all runtimes.
- Regal lints 300 policy files in 400 milliseconds and now supports IntelliJ.
- An explicit
orkeyword is in development; LLM-generated Rego still emits outdated syntax.
About the Speaker(s)
Charlie Egan has worked in the cloud-native space since 2018. He first used OPA in 2019 for a Kubernetes admission use case, later worked on a product handling X.509 policy in Kubernetes environments, and joined Styra at the end of 2022. He has been an OPA maintainer since then and focuses on authentication and authorization across the stack.