---
title: "Fairwinds Insights Basic Tutorial: Validating OPA Policies in the CLI for Cloud-Native Infrastructure"
description: Learn how to validate OPA policies in the CLI with this beginner's guide. Discover the power of OPA and how it can enhance your cloud-native infrastructure.
---

[Fairwinds | Blog ](https://www.fairwinds.com/blog)

# [Fairwinds Insights Basic Tutorial: Validating OPA Policies in the CLI for Cloud-Native Infrastructure](https://www.fairwinds.com/blog/fairwinds-insights-basics-tutorial-validating-opa-policies-in-the-cli)

 Written by [Robert Brennan](https://www.fairwinds.com/blog/author/robert-brennan) | Apr 25, 2023 2:41:19 PM

The [Open Policy Agent](https://www.openpolicyagent.org/) (OPA) is an open source, general-purpose policy engine that provides a framework for validating structured data across your cloud-native stack. It encourages users to write policy-as-code to extend the community’s move towards [infrastructure as code](https://www.fairwinds.com/blog/why-infrastructure-as-code-scanning-matters-for-kubernetes-configuration) (IaC). OPA can validate any kind of structured data, including Terraform, HTTP requests, Envoy, Kafka, SQL, Linux, and Dockerfiles; it is frequently used and associated with Kubernetes manifests.

The OPA team maintains a suite of tools for configuration validation using a domain-specific language called Rego. Rego can be a bit challenging for those unfamiliar with it, because the syntax is unlike a typical programming language. However, like any good domain-specific language (DSL), it’s quite powerful once you become familiar with it. If you want to learn [how to start thinking in Rego, read this linked article](https://medium.com/@mathurvarun98/how-to-write-great-rego-policies-dc6117679c9f).

The Kubernetes community has chosen OPA for creating configuration policies. To support that need, you can use the [Fairwinds Insights](https://www.fairwinds.com/insights) command line interface (CLI) to test and validate OPA policies. The CLI helps you in two ways, by: 

1. Validating the OPA policy syntax
2. Validating the Action Items that the policy outputs in [Fairwinds Insights](https://www.fairwinds.com/blog/managing-opa-policies-with-fairwinds-insights)

This improves the feedback loop for developers when working with OPA policies and allows you to test your policies locally before you upload them to Fairwinds Insights.

## Installing the Insights CLI

Your first step is to install the Fairwinds Insights CLI. You can do that by visiting our [GitHub page for the Insights CLI](https://github.com/FairwindsOps/insights-cli), which includes links to the CLI documentation and installation options.

Our team created a video that [walks you through the steps](https://training.fairwinds.com/validating-opa-policies-in-the-cli) you need to take to validate OPA policies in the CLI. If you’re not already using Insights, the [free tier](https://www.fairwinds.com/insights-pricing) is available for environments up to 20 nodes, two clusters, and one repo, so you can use it to get started and follow these steps. First, run a `--help` command to see which validation options are currently available. At the command line, type: `insights-cli validate opa --help`. In the demo video, you can see it only validates a single policy, but you can also validate multiple policies, such as one might use in continuous integration/continuous deployment (CI/CD).

## Validating OPA Policy 

Here’s an example OPA policy that makes sure the “department” label is set on every Deployment. We’ll call this file policy.yaml

`package fairwinds`

`labelrequired[actionItem] {`

`    requiredLabels := {"department"}`

`    kinds := {"Deployment"}`

`    kind := lower(kinds[val])`

`    lower(input.kind) == kind`

`    provided := {label | input.metadata.labels[label]}`

`    missing := requiredLabels - provided`

`    count(missing) > 0`

`    description := sprintf("Label %v is missing", [missing])`

`    actionItem := {`

`        "title": "Label is missing",`

`        "description": description,`

`        "severity": .2,`

`        "remediation": "Add the label",`

`        "category": "Reliability"`

`    }`

`}`

In order to validate this policy, we’d want to supply a Kubernetes Deployment that passes the policy and another one that fails. Here’s an example Deployment that should pass validation. We’re going to call this policy.success.yaml, which signals to the insights-cli that this should pass the OPA policy.

`apiVersion: apps/v1`

`kind: Deployment`

`metadata:`

`  name: policy-test`

`  labels:`

`    department: development`

`spec:`

`  replicas: 1`

`  template:`

`    spec:`

`      containers:`

`      - image: busybox`

Let’s see what happens when we use the Insights CLI to validate the policy above, using this Kubernetes manifest:

`❯ insights-cli validate opa -r policy.rego -k policy.success.yaml`

`OPA policy validated successfully.`

Great! Looks like everything passes. What happens if we remove the label?

`❯ cat policy.success.yaml | grep -v department > policy.failure.yaml`

`❯ insights-cli validate opa -r policy.rego -k policy.failure.yaml`

`✔ Action Item:`

`        Title: Label is missing`

`        Category: Reliability`

`        Severity: 0.2`

`        Description: Label {"department"} is missing`

`        Resource Namespace: notset`

`        Resource Kind: Deployment`

`        Resource Name: policy-test`

`        Remediation: Add the label`

`        Event Type: policy`

`OPA policy validated successfully.`

We generated an Action Item, as expected! So we’ve confirmed that Insights will warn us if any of our Deployments are missing the “department” label.

## Validating Namespaces

What if we want to get a bit more specific? Maybe we don’t want to enforce our policy in the kube-system namespace, which contains a bunch of deployments we don’t manage. Fortunately, with Rego, that’s easy! And again we can use the CLI to validate that everything works as expected.

To exempt the kube-system namespace, we’ll add a new function to the policy:

`blockedNamespace(elem) {`

`    blockedNamespaces := ["kube-system"]`

`    ns := blockedNamespaces[_]`

`    elem.metadata.namespace == ns`

`}`

Then, in `labelrequired` function, we just have to add the line

not `blockedNamespace(input)`

We can tell the insights-cli which namespace we’re working in using the -N flag. If we set that to kube-system, we should see a complaint about policy.failure.yaml, which no longer generates an Action Item.

`❯ insights-cli validate opa -r policy.rego -k policy.failure.yaml -N kube-system`

`OPA policy failed validation: 0 action items were returned, but 1 is expected`

`exit status 1`

## Getting Feedback During Policy Execution

If you’re having trouble debugging an issue with your policy, you can use the “print” statement inside your rego code to get more feedback during policy execution. E.g. we can print the input’s kind to make sure we’re looking at the right thing:

`labelrequired[actionItem] {`

`    print("The Kind is", input.kind)`

`    not blockedNamespace(input)`

`    # …`

`}`

`❯ insights-cli validate opa -r policy.rego -k policy.success.yaml`

`The Kind is Deployment`

`OPA policy validated successfully.`

## Using OPA in Insights

Going through these steps, you now know how to validate that this policy is working as you intend it to. Excellent! It’s time to upload that policy to Insights. Just make sure that the OPA report is enabled in Report Hub and you are ready to start using OPA for policy management in Kubernetes. 

​​Watch the video to walk through the steps of [Validating OPA Policies in the CLI](https://training.fairwinds.com/validating-opa-policies-in-the-cli) step by step. 

[View full post](https://www.fairwinds.com/blog/fairwinds-insights-basics-tutorial-validating-opa-policies-in-the-cli)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Robert Brennan"
  },
  "dateModified" : "2024-02-08T15:59:25.397Z",
  "datePublished" : "2023-04-25T14:41:19Z",
  "headline" : "Fairwinds Insights Basic Tutorial: Validating OPA Policies in the CLI for Cloud-Native Infrastructure",
  "image" : {
    "@type" : "ImageObject",
    "height" : 692,
    "url" : "https://2184645.fs1.hubspotusercontent-na1.net/hubfs/2184645/Train%20moving%20fast%20in%20tunnel.jpeg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://www.fairwinds.com/blog/fairwinds-insights-basics-tutorial-validating-opa-policies-in-the-cli",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Fairwinds | Blog"
  }
}
```