Unit 1: Open Policy Agent (OPA) — Rego policy evaluation at SYN time

[TeoSlayer]

Scope

Evaluate OPA Rego policies at connection time (SYN). Enterprises already write Rego policies for Kubernetes admission, Envoy, and Terraform — same language for Pilot.

Deliverables

• OPA integration point at daemon SYN handler
• Policy input: source node (address, tags, networks), destination node, destination port
• Policy decision: allow/deny with reason
• Policy bundle loading from file or HTTP endpoint
• Hot-reload: policy changes take effect without daemon restart
• Example policies: backend→database on port 5432, frontend→API on 80/443, monitoring→anything on 9090

Files

• pkg/daemon/policy.go — OPA evaluator
• pkg/daemon/daemon.go — SYN handler integration
• tests/ — policy evaluation tests

Priority: HIGH

[TeoSlayer]

Context: OPA is the de facto standard for policy-as-code in cloud-native infrastructure. Enterprises already have Rego expertise from Kubernetes (Gatekeeper), Envoy (ext_authz), and Terraform (Sentinel). Evaluating at SYN time means the policy decision happens before any data flows — rejected connections never reach the application. This is the network-layer equivalent of Kubernetes admission controllers.