Not related to OPA. This is not an admission webhook, nor deals with gatekeeper and such, it does not enforce policies. It's a simple abstraction on the certs creation mechanisms and native Kubernetes RBAC.