# open-policy-agent/library architecture

> Architecture diagram of the GitHub repository open-policy-agent/library, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-24). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/open-policy-agent/library
- Repository: https://github.com/open-policy-agent/library

## Overview

This repository is a community Rego policy library for analyzing infrastructure and Kubernetes-related JSON, not a running service. Its user workflow is to find reusable policy logic, adapt it into policies for a target domain, and evaluate those policies with OPA. The tree shows Terraform and AWS libraries, Docker examples, Kubernetes admission, mutation, and audit policies, and Istio audits. README-level relationships describe reuse and OPA library consumption; source excerpts were unavailable, so internal calls and data flow are not inferred.

Main entry points: [`terraform/library.rego`](https://github.com/open-policy-agent/library/blob/master/terraform/library.rego) (Terraform helpers), [`aws/library.rego`](https://github.com/open-policy-agent/library/blob/master/aws/library.rego) (AWS helpers), [`terraform/example.rego`](https://github.com/open-policy-agent/library/blob/master/terraform/example.rego) (Terraform examples), [`aws/example.rego`](https://github.com/open-policy-agent/library/blob/master/aws/example.rego) (AWS examples)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cloud["Cloud policies"]
  node_terraform["Terraform policies"]
  node_aws["AWS policies"]
  node_docker["Docker policies"]
end

subgraph group_kubernetes["Kubernetes policies"]
  node_k8s_admission["Admission policies"]
  node_k8s_mutation["Admission mutation"]
  node_k8s_audit["Cluster audits"]
  node_k8s_inputs["Kubernetes inputs"]
end

subgraph group_mesh["Mesh auditing"]
  node_istio_audit["Istio audits"]
end

subgraph group_library["Policy library"]
  node_terraform_library["Terraform helpers<br/>[library.rego]"]
  node_aws_library["AWS helpers<br/>[library.rego]"]
  node_terraform_examples["Terraform examples<br/>[example.rego]"]
  node_aws_examples["AWS examples<br/>[example.rego]"]
  node_docker_examples["Docker examples<br/>[example.rego]"]
end

node_author(("Policy author"))
node_opa(("Open Policy Agent"))

node_author -->|"reuses helpers"| node_terraform_library
node_author -->|"reuses helpers"| node_aws_library
node_opa -->|"pulls library"| node_terraform_library
node_opa -->|"pulls library"| node_aws_library
node_terraform_examples -->|"demonstrates use"| node_terraform_library
node_aws_examples -->|"demonstrates use"| node_aws_library
node_author -->|"adapts policies"| node_terraform
node_author -->|"adapts policies"| node_aws
node_author -->|"adapts policies"| node_docker
node_author -->|"adapts policies"| node_k8s_admission
node_author -->|"adapts policies"| node_k8s_mutation
node_author -->|"adapts policies"| node_k8s_audit
node_author -->|"adapts policies"| node_istio_audit

click node_terraform "https://github.com/open-policy-agent/library/tree/master/terraform"
click node_aws "https://github.com/open-policy-agent/library/tree/master/aws"
click node_docker "https://github.com/open-policy-agent/library/tree/master/docker"
click node_k8s_admission "https://github.com/open-policy-agent/library/tree/master/kubernetes/admission"
click node_k8s_mutation "https://github.com/open-policy-agent/library/tree/master/kubernetes/mutating-admission"
click node_k8s_audit "https://github.com/open-policy-agent/library/tree/master/kubernetes/audit"
click node_k8s_inputs "https://github.com/open-policy-agent/library/tree/master/kubernetes/inputs"
click node_istio_audit "https://github.com/open-policy-agent/library/tree/master/istio/audit"
click node_terraform_library "https://github.com/open-policy-agent/library/blob/master/terraform/library.rego"
click node_aws_library "https://github.com/open-policy-agent/library/blob/master/aws/library.rego"
click node_terraform_examples "https://github.com/open-policy-agent/library/blob/master/terraform/example.rego"
click node_aws_examples "https://github.com/open-policy-agent/library/blob/master/aws/example.rego"
click node_docker_examples "https://github.com/open-policy-agent/library/blob/master/docker/example.rego"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_terraform,node_aws,node_docker toneBlue
class node_k8s_admission,node_k8s_mutation,node_k8s_audit,node_k8s_inputs toneAmber
class node_istio_audit toneMint
class node_terraform_library,node_aws_library,node_terraform_examples,node_aws_examples,node_docker_examples toneRose
class node_author,node_opa toneIndigo
```

## Components

### Cloud policies

- [Terraform policies](https://github.com/open-policy-agent/library/tree/master/terraform): `terraform`
- [AWS policies](https://github.com/open-policy-agent/library/tree/master/aws): `aws`
- [Docker policies](https://github.com/open-policy-agent/library/tree/master/docker): `docker`

### Kubernetes policies

- [Admission policies](https://github.com/open-policy-agent/library/tree/master/kubernetes/admission): `kubernetes/admission`
- [Admission mutation](https://github.com/open-policy-agent/library/tree/master/kubernetes/mutating-admission): `kubernetes/mutating-admission`
- [Cluster audits](https://github.com/open-policy-agent/library/tree/master/kubernetes/audit): `kubernetes/audit`
- [Kubernetes inputs](https://github.com/open-policy-agent/library/tree/master/kubernetes/inputs): `kubernetes/inputs`

### Mesh auditing

- [Istio audits](https://github.com/open-policy-agent/library/tree/master/istio/audit): `istio/audit`

### Policy library

- [Terraform helpers](https://github.com/open-policy-agent/library/blob/master/terraform/library.rego): `terraform/library.rego`
- [AWS helpers](https://github.com/open-policy-agent/library/blob/master/aws/library.rego): `aws/library.rego`
- [Terraform examples](https://github.com/open-policy-agent/library/blob/master/terraform/example.rego): `terraform/example.rego`
- [AWS examples](https://github.com/open-policy-agent/library/blob/master/aws/example.rego): `aws/example.rego`
- [Docker examples](https://github.com/open-policy-agent/library/blob/master/docker/example.rego): `docker/example.rego`

### Other components

- **Policy author**
- **Open Policy Agent**

## Connections

- Policy author → Terraform helpers: reuses helpers
- Policy author → AWS helpers: reuses helpers
- Open Policy Agent → Terraform helpers: pulls library
- Open Policy Agent → AWS helpers: pulls library
- Terraform examples → Terraform helpers: demonstrates use
- AWS examples → AWS helpers: demonstrates use
- Policy author → Terraform policies: adapts policies
- Policy author → AWS policies: adapts policies
- Policy author → Docker policies: adapts policies
- Policy author → Admission policies: adapts policies
- Policy author → Admission mutation: adapts policies
- Policy author → Cluster audits: adapts policies
- Policy author → Istio audits: adapts policies