[ { "children": [], "example": "", "flags": [ { "default": "true", "description": "report memory allocations with benchmark results", "name": "--benchmem", "shorthand": "", "type": "bool" }, { "default": "", "description": "set bundle file(s) or directory path(s). This flag can be repeated.", "name": "--bundle", "shorthand": "-b", "type": "string" }, { "default": "", "description": "set path of configuration file", "name": "--config-file", "shorthand": "-c", "type": "string" }, { "default": "1", "description": "number of times to repeat each benchmark", "name": "--count", "shorthand": "", "type": "int" }, { "default": "", "description": "set policy or data file(s). This flag can be repeated.", "name": "--data", "shorthand": "-d", "type": "string" }, { "default": "false", "description": "run benchmarks against a running opa server", "name": "--e2e", "shorthand": "", "type": "bool" }, { "default": "true", "description": "exits with non-zero exit code on undefined/empty result and errors", "name": "--fail", "shorthand": "", "type": "bool" }, { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json,gobench}" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "", "description": "set query import(s). This flag can be repeated.", "name": "--import", "shorthand": "", "type": "string" }, { "default": "", "description": "set input file path", "name": "--input", "shorthand": "-i", "type": "string" }, { "default": "true", "description": "report query performance metrics", "name": "--metrics", "shorthand": "", "type": "bool" }, { "default": "false", "description": "optimize default in-memory store for read speed. Has possible negative impact on memory footprint and write speed. See https://www.openpolicyagent.org/docs/latest/policy-performance/#storage-optimization for more details.", "name": "--optimize-store-for-read-speed", "shorthand": "", "type": "bool" }, { "default": "", "description": "set query package", "name": "--package", "shorthand": "", "type": "string" }, { "default": "false", "description": "perform partial evaluation", "name": "--partial", "shorthand": "-p", "type": "bool" }, { "default": "", "description": "set schema file path or directory path", "name": "--schema", "shorthand": "-s", "type": "string" }, { "default": "10", "description": "set the time (in seconds) that the server will wait to gracefully shut down. This flag is valid in 'e2e' mode only.", "name": "--shutdown-grace-period", "shorthand": "", "type": "int" }, { "default": "0", "description": "set the time (in seconds) that the server will wait before initiating shutdown. This flag is valid in 'e2e' mode only.", "name": "--shutdown-wait-period", "shorthand": "", "type": "int" }, { "default": "false", "description": "read query from stdin", "name": "--stdin", "shorthand": "", "type": "bool" }, { "default": "false", "description": "read input document from stdin", "name": "--stdin-input", "shorthand": "-I", "type": "bool" }, { "default": "rego", "description": "set the runtime to exercise", "name": "--target", "shorthand": "-t", "type": "{rego,wasm}" }, { "default": "[input]", "description": "set paths to treat as unknown during partial evaluation", "name": "--unknowns", "shorthand": "-u", "type": "stringArray" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "bench", "long": "Benchmark a Rego query and print the results.\n\nThe benchmark command works very similar to 'eval' and will evaluate the query in the same fashion. The\nevaluation will be repeated a number of times and performance results will be returned.\n\nExample with bundle and input data:\n\n\topa bench -b ./policy-bundle -i input.json 'data.authz.allow'\n\nTo run benchmarks against a running opa server to evaluate server overhead use the --e2e flag.\nTo enable more detailed analysis use the --metrics and --benchmem flags.\n\nThe optional \"gobench\" output format conforms to the Go Benchmark Data Format.\n", "parent_flags": null, "short": "Benchmark a Rego query", "use": "bench \u003cquery\u003e", "useline": "opa bench \u003cquery\u003e [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "load paths as bundle files or root directories", "name": "--bundle", "shorthand": "-b", "type": "bool" }, { "default": "", "description": "set capabilities version or capabilities.json file path", "name": "--capabilities", "shorthand": "", "type": "string" }, { "default": "", "description": "set path of JSON file containing optional claims (see: https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format)", "name": "--claims-file", "shorthand": "", "type": "string" }, { "default": "false", "description": "enable debug output", "name": "--debug", "shorthand": "", "type": "bool" }, { "default": "", "description": "set slash separated entrypoint path", "name": "--entrypoint", "shorthand": "-e", "type": "string" }, { "default": "[]", "description": "set file names to exclude during bundle verification", "name": "--exclude-files-verify", "shorthand": "", "type": "stringSlice" }, { "default": "false", "description": "follow symlinks in the input set of paths when building the bundle", "name": "--follow-symlinks", "shorthand": "", "type": "bool" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "0", "description": "set optimization level", "name": "--optimize", "shorthand": "-O", "type": "int" }, { "default": "bundle.tar.gz", "description": "set the output filename", "name": "--output", "shorthand": "-o", "type": "string" }, { "default": "partial", "description": "set the namespace to use for partially evaluated files in an optimized bundle", "name": "--partial-namespace", "shorthand": "", "type": "string" }, { "default": "false", "description": "exclude dependents of entrypoints", "name": "--prune-unused", "shorthand": "", "type": "bool" }, { "default": "", "description": "set output bundle revision", "name": "--revision", "shorthand": "-r", "type": "string" }, { "default": "", "description": "scope to use for bundle signature verification", "name": "--scope", "shorthand": "", "type": "string" }, { "default": "RS256", "description": "name of the signing algorithm", "name": "--signing-alg", "shorthand": "", "type": "string" }, { "default": "", "description": "set the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)", "name": "--signing-key", "shorthand": "", "type": "string" }, { "default": "", "description": "name of the plugin to use for signing/verification (see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-plugin)", "name": "--signing-plugin", "shorthand": "", "type": "string" }, { "default": "rego", "description": "set the output bundle target type", "name": "--target", "shorthand": "-t", "type": "{rego,wasm,plan}" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" }, { "default": "", "description": "set the secret (HMAC) or path of the PEM file containing the public key (RSA and ECDSA)", "name": "--verification-key", "shorthand": "", "type": "string" }, { "default": "default", "description": "name assigned to the verification key used for bundle verification", "name": "--verification-key-id", "shorthand": "", "type": "string" }, { "default": "false", "description": "enable print statements inside of WebAssembly modules compiled by the compiler", "name": "--wasm-include-print", "shorthand": "", "type": "bool" } ], "id": "build", "long": "Build an opa bundle.\n\nThe 'build' command packages opa policy and data files into bundles. Bundles are\ngzipped tarballs containing policies and data. Paths referring to directories are\nloaded recursively.\n\n $ ls\n example.rego\n\n $ opa build -b .\n\nYou can load bundles into opa on the command-line:\n\n $ ls\n bundle.tar.gz example.rego\n\n $ opa run bundle.tar.gz\n\nYou can also configure opa to download bundles from remote HTTP endpoints:\n\n $ opa run --server \\\n --set bundles.example.resource=bundle.tar.gz \\\n --set services.example.url=http://localhost:8080\n\nInside another terminal in the same directory, serve the bundle via HTTP:\n\n $ python3 -m http.server --bind localhost 8080\n\nFor more information on bundles see https://www.openpolicyagent.org/docs/latest/management-bundles/.\n\nCommon Flags\n------------\n\nWhen -b is specified the 'build' command assumes paths refer to existing bundle files\nor directories following the bundle structure. If multiple bundles are provided, their\ncontents are merged. If there are any merge conflicts (e.g., due to conflicting bundle\nroots), the command fails. When loading an existing bundle file, the .manifest from\nthe input bundle will be included in the output bundle. Flags that set .manifest fields\n(such as --revision) override input bundle .manifest fields.\n\nThe -O flag controls the optimization level. By default, optimization is disabled (-O=0).\nWhen optimization is enabled the 'build' command generates a bundle that is semantically\nequivalent to the input files however the structure of the files in the bundle may have\nbeen changed by rewriting, inlining, pruning, etc. Higher optimization levels may result\nin longer build times. The --partial-namespace flag can used in conjunction with the -O flag\nto specify the namespace for the partially evaluated files in the optimized bundle.\n\nThe 'build' command supports targets (specified by -t):\n\n rego The default target emits a bundle containing a set of policy and data files\n that are semantically equivalent to the input files. If optimizations are\n disabled the output may simply contain a copy of the input policy and data\n files. If optimization is enabled at least one entrypoint must be supplied,\n either via the -e option, or via entrypoint metadata annotations.\n\n wasm The wasm target emits a bundle containing a WebAssembly module compiled from\n the input files for each specified entrypoint. The bundle may contain the\n original policy or data files.\n\n plan The plan target emits a bundle containing a plan, i.e., an intermediate\n\t\t\trepresentation compiled from the input files for each specified entrypoint.\n\t\t\tThis is for further processing, opa cannot evaluate a \"plan bundle\" like it\n\t\t\tcan evaluate a wasm or rego bundle.\n\nThe -e flag tells the 'build' command which documents (entrypoints) will be queried by\nthe software asking for policy decisions, so that it can focus optimization efforts and\nensure that document is not eliminated by the optimizer.\nNote: Unless the --prune-unused flag is used, any rule transitively referring to a\npackage or rule declared as an entrypoint will also be enumerated as an entrypoint.\n\nSigning\n-------\n\nThe 'build' command can be used to verify the signature of a signed bundle and\nalso to generate a signature for the output bundle the command creates.\n\nIf the directory path(s) provided to the 'build' command contain a \".signatures.json\" file,\nit will attempt to verify the signatures included in that file. The bundle files\nor directory path(s) to verify must be specified using --bundle.\n\nFor more information on the bundle signing and verification, see\nhttps://www.openpolicyagent.org/docs/latest/management-bundles/#signing.\n\nExample:\n\n $ opa build --verification-key /path/to/public_key.pem --signing-key /path/to/private_key.pem --bundle foo\n\nWhere foo has the following structure:\n\n foo/\n |\n +-- bar/\n | |\n | +-- data.json\n |\n +-- policy.rego\n |\n +-- .manifest\n |\n +-- .signatures.json\n\n\nThe 'build' command will verify the signatures using the public key provided by the --verification-key flag.\nThe default signing algorithm is RS256 and the --signing-alg flag can be used to specify\na different one. The --verification-key-id and --scope flags can be used to specify the name for the key\nprovided using the --verification-key flag and scope to use for bundle signature verification respectively.\n\nIf the verification succeeds, the 'build' command will write out an updated \".signatures.json\" file\nto the output bundle. It will use the key specified by the --signing-key flag to sign\nthe token in the \".signatures.json\" file.\n\nTo include additional claims in the payload use the --claims-file flag to provide a JSON file\ncontaining optional claims.\n\nFor more information on the format of the \".signatures.json\" file\nsee https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.\n\nCapabilities\n------------\n\nThe 'build' command can validate policies against a configurable set of opa capabilities.\nThe capabilities define the built-in functions and other language features that policies\nmay depend on. For example, the following capabilities file only permits the policy to\ndepend on the \"plus\" built-in function ('+'):\n\n {\n \"builtins\": [\n {\n \"name\": \"plus\",\n \"infix\": \"+\",\n \"decl\": {\n \"type\": \"function\",\n \"args\": [\n {\n \"type\": \"number\"\n },\n {\n \"type\": \"number\"\n }\n ],\n \"result\": {\n \"type\": \"number\"\n }\n }\n }\n ]\n }\n\nCapabilities can be used to validate policies against a specific version of opa.\nThe opa repository contains a set of capabilities files for each opa release. For example,\nthe following command builds a directory of policies ('./policies') and validates them\nagainst opa v0.22.0:\n\n opa build ./policies --capabilities v0.22.0\n", "parent_flags": null, "short": "Build an opa bundle", "use": "build \u003cpath\u003e [\u003cpath\u003e [...]]", "useline": "opa build \u003cpath\u003e [\u003cpath\u003e [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "print current capabilities", "name": "--current", "shorthand": "", "type": "bool" }, { "default": "", "description": "print capabilities defined by a file", "name": "--file", "shorthand": "", "type": "string" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "", "description": "print capabilities of a specific version", "name": "--version", "shorthand": "", "type": "string" } ], "id": "capabilities", "long": "Show capabilities for opa.\n\nThe 'capabilities' command prints the opa capabilities, prior to and including the version of opa used.\n\nPrint a list of all existing capabilities version names\n\n $ opa capabilities\n v0.17.0\n v0.17.1\n ...\n v0.37.1\n v0.37.2\n v0.38.0\n ...\n\nPrint the capabilities of the current version\n\n $ opa capabilities --current\n {\n \"builtins\": [...],\n \"future_keywords\": [...],\n \"wasm_abi_versions\": [...]\n }\n\nPrint the capabilities of a specific version\n\n $ opa capabilities --version v0.32.1\n {\n \"builtins\": [...],\n \"future_keywords\": null,\n \"wasm_abi_versions\": [...]\n }\n\nPrint the capabilities of a capabilities file\n\n $ opa capabilities --file ./capabilities/v0.32.1.json\n {\n \"builtins\": [...],\n \"future_keywords\": null,\n \"wasm_abi_versions\": [...]\n }\n\n", "parent_flags": null, "short": "Print the capabilities of opa", "use": "capabilities", "useline": "opa capabilities [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "load paths as bundle files or root directories", "name": "--bundle", "shorthand": "-b", "type": "bool" }, { "default": "", "description": "set capabilities version or capabilities.json file path", "name": "--capabilities", "shorthand": "", "type": "string" }, { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json}" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "10", "description": "set the number of errors to allow before compilation fails early", "name": "--max-errors", "shorthand": "-m", "type": "int" }, { "default": "false", "description": "check for Rego v0 and v1 compatibility (policies must be compatible with both Rego versions)", "name": "--rego-v1", "shorthand": "", "type": "bool" }, { "default": "", "description": "set schema file path or directory path", "name": "--schema", "shorthand": "-s", "type": "string" }, { "default": "false", "description": "enable compiler strict mode", "name": "--strict", "shorthand": "-S", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "check for Rego v0 and v1 compatibility (policies must be compatible with both Rego versions)", "name": "--v0-v1", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "check", "long": "Check Rego source files for parse and compilation errors.\n\t\nIf the 'check' command succeeds in parsing and compiling the source file(s), no output\nis produced. If the parsing or compiling fails, 'check' will output the errors\nand exit with a non-zero exit code.", "parent_flags": null, "short": "Check Rego source files", "use": "check \u003cpath\u003e [path [...]]", "useline": "opa check \u003cpath\u003e [path [...]] [flags]" }, { "children": [], "example": "\nGiven a policy like this:\n\n\tpackage policy\n\n\tallow if is_admin\n\n\tis_admin if \"admin\" in input.user.roles\n\nTo evaluate the dependencies of a simple query (e.g. data.policy.allow),\nwe'd run opa deps like demonstrated below:\n\n\t$ opa deps --data policy.rego data.policy.allow\n\t+------------------+----------------------+\n\t| BASE DOCUMENTS | VIRTUAL DOCUMENTS |\n\t+------------------+----------------------+\n\t| input.user.roles | data.policy.allow |\n\t| | data.policy.is_admin |\n\t+------------------+----------------------+\n\nFrom the output we're able to determine that the allow rule depends on\nthe input.user.roles base document, as well as the virtual document (rule)\ndata.policy.is_admin.\n", "flags": [ { "default": "", "description": "set bundle file(s) or directory path(s). This flag can be repeated.", "name": "--bundle", "shorthand": "-b", "type": "string" }, { "default": "", "description": "set policy or data file(s). This flag can be repeated.", "name": "--data", "shorthand": "-d", "type": "string" }, { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json}" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "deps", "long": "Print dependencies of provided query.\n\nDependencies are categorized as either base documents, which is any data loaded\nfrom the outside world, or virtual documents, i.e values that are computed from rules.\n", "parent_flags": null, "short": "Analyze Rego query dependencies", "use": "deps \u003cquery\u003e", "useline": "opa deps \u003cquery\u003e [flags]" }, { "children": [], "example": "\n\nTo evaluate a simple query:\n\n $ opa eval 'x := 1; y := 2; x \u003c y'\n\nTo evaluate a query against JSON data:\n\n $ opa eval --data data.json 'name := data.names[_]'\n\nTo evaluate a query against JSON data supplied with a file:// URL:\n\n $ opa eval --data file:///path/to/file.json 'data'\n\n\nFile \u0026 Bundle Loading\n---------------------\n\nThe --bundle flag will load data files and Rego files contained\nin the bundle specified by the path. It can be either a\ncompressed tar archive bundle file or a directory tree.\n\n $ opa eval --bundle /some/path 'data'\n\nWhere /some/path contains:\n\n foo/\n |\n +-- bar/\n | |\n | +-- data.json\n |\n +-- baz.rego\n |\n +-- manifest.yaml\n\nThe JSON file 'foo/bar/data.json' would be loaded and rooted under\n'data.foo.bar' and the 'foo/baz.rego' would be loaded and rooted under the\npackage path contained inside the file. Only data files named data.json or\ndata.yaml will be loaded. In the example above the manifest.yaml would be\nignored.\n\nSee https://www.openpolicyagent.org/docs/latest/management-bundles/ for more details\non bundle directory structures.\n\nThe --data flag can be used to recursively load ALL *.rego, *.json, and\n*.yaml files under the specified directory.\n\nThe -O flag controls the optimization level. By default, optimization is disabled (-O=0).\nWhen optimization is enabled the 'eval' command generates a bundle from the files provided\nwith either the --bundle or --data flag. This bundle is semantically equivalent to the input\nfiles however the structure of the files in the bundle may have been changed by rewriting, inlining,\npruning, etc. This resulting optimized bundle is used to evaluate the query. If optimization is\nenabled at least one entrypoint must be supplied, either via the -e option, or via entrypoint\nmetadata annotations.\n\nOutput Formats\n--------------\n\nSet the output format with the --format flag.\n\n --format=json : output raw query results as JSON\n --format=values : output line separated JSON arrays containing expression values\n --format=bindings : output line separated JSON objects containing variable bindings\n --format=pretty : output query results in a human-readable format\n --format=source : output partial evaluation results in a source format\n --format=raw : output the values from query results in a scripting friendly format\n --format=discard : output the result field as \"discarded\" when non-nil\n\nSchema\n------\n\nThe -s/--schema flag provides one or more JSON Schemas used to validate references to the input or data documents.\nLoads a single JSON file, applying it to the input document; or all the schema files under the specified directory.\n\n $ opa eval --data policy.rego --input input.json --schema schema.json\n $ opa eval --data policy.rego --input input.json --schema schemas/\n\nCapabilities\n------------\n\nWhen passing a capabilities definition file via --capabilities, one can restrict which\nhosts remote schema definitions can be retrieved from. For example, a capabilities.json\ncontaining\n\n {\n \"builtins\": [ ... ],\n \"allow_net\": [ \"kubernetesjsonschema.dev\" ]\n }\n\nwould disallow fetching remote schemas from any host but \"kubernetesjsonschema.dev\".\nSetting allow_net to an empty array would prohibit fetching any remote schemas.\n\nNot providing a capabilities file, or providing a file without an allow_net key, will\npermit fetching remote schemas from any host.\n\nNote that the metaschemas http://json-schema.org/draft-04/schema, http://json-schema.org/draft-06/schema,\nand http://json-schema.org/draft-07/schema, are always available, even without network\naccess.\n", "flags": [ { "default": "", "description": "set bundle file(s) or directory path(s). This flag can be repeated.", "name": "--bundle", "shorthand": "-b", "type": "string" }, { "default": "", "description": "set capabilities version or capabilities.json file path", "name": "--capabilities", "shorthand": "", "type": "string" }, { "default": "1", "description": "number of times to repeat each benchmark", "name": "--count", "shorthand": "", "type": "int" }, { "default": "false", "description": "report coverage", "name": "--coverage", "shorthand": "", "type": "bool" }, { "default": "", "description": "set policy or data file(s). This flag can be repeated.", "name": "--data", "shorthand": "-d", "type": "string" }, { "default": "false", "description": "disable 'early exit' optimizations", "name": "--disable-early-exit", "shorthand": "", "type": "bool" }, { "default": "false", "description": "disable indexing optimizations", "name": "--disable-indexing", "shorthand": "", "type": "bool" }, { "default": "[]", "description": "set paths of documents to exclude from inlining", "name": "--disable-inlining", "shorthand": "", "type": "stringArray" }, { "default": "", "description": "set slash separated entrypoint path", "name": "--entrypoint", "shorthand": "-e", "type": "string" }, { "default": "off", "description": "enable query explanations", "name": "--explain", "shorthand": "", "type": "{off,full,notes,fails,debug}" }, { "default": "false", "description": "exits with non-zero exit code on undefined/empty result and errors", "name": "--fail", "shorthand": "", "type": "bool" }, { "default": "false", "description": "exits with non-zero exit code on defined/non-empty result and errors", "name": "--fail-defined", "shorthand": "", "type": "bool" }, { "default": "json", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{json,values,bindings,pretty,source,raw,discard}" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "", "description": "set query import(s). This flag can be repeated.", "name": "--import", "shorthand": "", "type": "string" }, { "default": "", "description": "set input file path", "name": "--input", "shorthand": "-i", "type": "string" }, { "default": "false", "description": "enable query instrumentation metrics (implies --metrics)", "name": "--instrument", "shorthand": "", "type": "bool" }, { "default": "false", "description": "report query performance metrics", "name": "--metrics", "shorthand": "", "type": "bool" }, { "default": "false", "description": "evaluate nondeterministic builtins (if all arguments are known) during partial eval", "name": "--nondeterminstic-builtins", "shorthand": "", "type": "bool" }, { "default": "0", "description": "set optimization level", "name": "--optimize", "shorthand": "-O", "type": "int" }, { "default": "false", "description": "optimize default in-memory store for read speed. Has possible negative impact on memory footprint and write speed. See https://www.openpolicyagent.org/docs/latest/policy-performance/#storage-optimization for more details.", "name": "--optimize-store-for-read-speed", "shorthand": "", "type": "bool" }, { "default": "", "description": "set query package", "name": "--package", "shorthand": "", "type": "string" }, { "default": "false", "description": "perform partial evaluation", "name": "--partial", "shorthand": "-p", "type": "bool" }, { "default": "80", "description": "set limit after which pretty output gets truncated", "name": "--pretty-limit", "shorthand": "", "type": "int" }, { "default": "false", "description": "perform expression profiling", "name": "--profile", "shorthand": "", "type": "bool" }, { "default": "10", "description": "set number of profiling results to show", "name": "--profile-limit", "shorthand": "", "type": "int" }, { "default": "", "description": "set sort order of expression profiler results. Accepts: total_time_ns, num_eval, num_redo, num_gen_expr, file, line. This flag can be repeated.", "name": "--profile-sort", "shorthand": "", "type": "string" }, { "default": "", "description": "set schema file path or directory path", "name": "--schema", "shorthand": "-s", "type": "string" }, { "default": "false", "description": "disable inlining of rules that depend on unknowns", "name": "--shallow-inlining", "shorthand": "", "type": "bool" }, { "default": "false", "description": "collect and return all encountered built-in errors, built in errors are not fatal", "name": "--show-builtin-errors", "shorthand": "", "type": "bool" }, { "default": "false", "description": "read query from stdin", "name": "--stdin", "shorthand": "", "type": "bool" }, { "default": "false", "description": "read input document from stdin", "name": "--stdin-input", "shorthand": "-I", "type": "bool" }, { "default": "false", "description": "enable compiler strict mode", "name": "--strict", "shorthand": "-S", "type": "bool" }, { "default": "false", "description": "treat the first built-in function error encountered as fatal", "name": "--strict-builtin-errors", "shorthand": "", "type": "bool" }, { "default": "rego", "description": "set the runtime to exercise", "name": "--target", "shorthand": "-t", "type": "{rego,wasm}" }, { "default": "0s", "description": "set eval timeout (default unlimited)", "name": "--timeout", "shorthand": "", "type": "duration" }, { "default": "[input]", "description": "set paths to treat as unknown during partial evaluation", "name": "--unknowns", "shorthand": "-u", "type": "stringArray" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "show local variable values in pretty trace output", "name": "--var-values", "shorthand": "", "type": "bool" } ], "id": "eval", "long": "Evaluate a Rego query and print the result.", "parent_flags": null, "short": "Evaluate a Rego query", "use": "eval \u003cquery\u003e", "useline": "opa eval \u003cquery\u003e [flags]" }, { "children": [], "example": " Loading input from stdin:\n opa exec [\u003cpath\u003e [...]] --stdin-input [flags]\n", "flags": [ { "default": "", "description": "set bundle file(s) or directory path(s). This flag can be repeated.", "name": "--bundle", "shorthand": "-b", "type": "string" }, { "default": "", "description": "set path of configuration file", "name": "--config-file", "shorthand": "-c", "type": "string" }, { "default": "", "description": "set decision to evaluate", "name": "--decision", "shorthand": "", "type": "string" }, { "default": "false", "description": "exits with non-zero exit code on undefined/empty result and errors", "name": "--fail", "shorthand": "", "type": "bool" }, { "default": "false", "description": "exits with non-zero exit code on defined/non-empty result and errors", "name": "--fail-defined", "shorthand": "", "type": "bool" }, { "default": "false", "description": "exits with non-zero exit code on non-empty result and errors", "name": "--fail-non-empty", "shorthand": "", "type": "bool" }, { "default": "json", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{json}" }, { "default": "json", "description": "set log format", "name": "--log-format", "shorthand": "", "type": "{text,json,json-pretty}" }, { "default": "error", "description": "set log level", "name": "--log-level", "shorthand": "-l", "type": "{debug,info,error}" }, { "default": "", "description": "set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)", "name": "--log-timestamp-format", "shorthand": "", "type": "string" }, { "default": "[]", "description": "override config values on the command line (use commas to specify multiple values)", "name": "--set", "shorthand": "", "type": "stringArray" }, { "default": "[]", "description": "override config values with files on the command line (use commas to specify multiple values)", "name": "--set-file", "shorthand": "", "type": "stringArray" }, { "default": "false", "description": "read input document from stdin rather than a static file", "name": "--stdin-input", "shorthand": "-I", "type": "bool" }, { "default": "0s", "description": "set exec timeout with a Go-style duration, such as '5m 30s'. (default unlimited)", "name": "--timeout", "shorthand": "", "type": "duration" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "exec", "long": "Execute against input files.\n\nThe 'exec' command executes opa against one or more input files. If the paths\nrefer to directories, opa will execute against files contained inside those\ndirectories, recursively.\n\nThe 'exec' command accepts a --config-file/-c or series of --set options as\narguments. These options behave the same as way as 'opa run'. Since the 'exec'\ncommand is intended to execute opa in one-shot, the 'exec' command will\nmanually trigger plugins before and after policy execution:\n\nBefore: Discovery -\u003e Bundle -\u003e Status\nAfter: Decision Logs\n\nBy default, the 'exec' command executes the \"default decision\" (specified in\nthe opa configuration) against each input file. This can be overridden by\nspecifying the --decision argument and pointing at a specific policy decision,\n\ne.g., opa exec --decision /foo/bar/baz ...\n", "parent_flags": null, "short": "Execute against input files", "use": "exec \u003cpath\u003e [\u003cpath\u003e [...]]", "useline": "opa exec \u003cpath\u003e [\u003cpath\u003e [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "", "description": "set capabilities version or capabilities.json file path", "name": "--capabilities", "shorthand": "", "type": "string" }, { "default": "true", "description": "assert that the formatted code is valid and can be successfully parsed", "name": "--check-result", "shorthand": "", "type": "bool" }, { "default": "false", "description": "only display a diff of the changes", "name": "--diff", "shorthand": "-d", "type": "bool" }, { "default": "false", "description": "drop v0 imports from the formatted code, such as 'rego.v1' and 'future.keywords'", "name": "--drop-v0-imports", "shorthand": "", "type": "bool" }, { "default": "false", "description": "non zero exit code on reformat", "name": "--fail", "shorthand": "", "type": "bool" }, { "default": "false", "description": "list all files who would change when formatted", "name": "--list", "shorthand": "-l", "type": "bool" }, { "default": "false", "description": "format module(s) to be compatible with both Rego v0 and v1", "name": "--rego-v1", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "format module(s) to be compatible with both Rego v0 and v1", "name": "--v0-v1", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "overwrite the original source file", "name": "--write", "shorthand": "-w", "type": "bool" } ], "id": "fmt", "long": "Format Rego source files.\n\nThe 'fmt' command takes a Rego source file and outputs a reformatted version. If no file path\nis provided - this tool will use stdin.\nThe format of the output is not defined specifically; whatever this tool outputs\nis considered correct format (with the exception of bugs).\n\nIf the '-w' option is supplied, the 'fmt' command will overwrite the source file\ninstead of printing to stdout.\n\nIf the '-d' option is supplied, the 'fmt' command will output a diff between the\noriginal and formatted source.\n\nIf the '-l' option is supplied, the 'fmt' command will output the names of files\nthat would change if formatted. The '-l' option will suppress any other output\nto stdout from the 'fmt' command.\n\nIf the '--fail' option is supplied, the 'fmt' command will return a non zero exit\ncode if a file would be reformatted.\n\nThe 'fmt' command can be run in several compatibility modes for consuming and outputting\ndifferent Rego versions:\n\n* `opa fmt`:\n * v1 Rego is formatted to v1\n * `rego.v1`/`future.keywords` imports are NOT removed\n * `rego.v1`/`future.keywords` imports are NOT added if missing\n * v0 rego is rejected\n* `opa fmt --v0-compatible`:\n * v0 Rego is formatted to v0\n * v1 Rego is rejected\n* `opa fmt --v0-v1`:\n * v0 Rego is formatted to be compatible with v0 AND v1\n * v1 Rego is rejected\n* `opa fmt --v0-v1 --v1-compatible`:\n * v1 Rego is formatted to be compatible with v0 AND v1\n * v0 Rego is rejected\n", "parent_flags": null, "short": "Format Rego source files", "use": "fmt [path [...]]", "useline": "opa fmt [path [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "list annotations", "name": "--annotations", "shorthand": "-a", "type": "bool" }, { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json}" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "inspect", "long": "Inspect opa bundle(s).\n\nThe 'inspect' command provides a summary of the contents in opa bundle(s) or a single Rego file.\nBundles are gzipped tarballs containing policies and data. The 'inspect' command reads bundle(s) and lists\nthe following:\n\n* packages that are contributed by .rego files\n* data locations defined by the data.json and data.yaml files\n* manifest data\n* signature data\n* information about the Wasm module files\n* package- and rule annotations\n\nExample:\n\n $ ls\n bundle.tar.gz\n $ opa inspect bundle.tar.gz\n\nYou can provide exactly one opa bundle, to a bundle directory, or direct path to a Rego file to the 'inspect'\ncommand on the command-line. If you provide a path referring to a directory, the 'inspect' command will load that path as\na bundle and summarize its structure and contents. If you provide a path referring to a Rego file, the 'inspect' command\nwill load that file and summarize its structure and contents.\n", "parent_flags": null, "short": "Inspect opa bundle(s)", "use": "inspect \u003cpath\u003e [\u003cpath\u003e [...]]", "useline": "opa inspect \u003cpath\u003e [\u003cpath\u003e [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json}" }, { "default": "", "description": "include or exclude optional elements. By default comments are included. Current options: locations, comments. E.g. --json-include locations,-comments will include locations and exclude comments.", "name": "--json-include", "shorthand": "", "type": "string" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" } ], "id": "parse", "long": "Parse Rego source file and print AST.", "parent_flags": null, "short": "Parse Rego source file", "use": "parse \u003cpath\u003e", "useline": "opa parse \u003cpath\u003e [flags]" }, { "children": [], "example": "", "flags": [ { "default": "[localhost:8181]", "description": "set listening address of the server (e.g., [ip]:\u003cport\u003e for TCP, unix://\u003cpath\u003e for UNIX domain socket)", "name": "--addr", "shorthand": "-a", "type": "stringSlice" }, { "default": "off", "description": "set authentication scheme", "name": "--authentication", "shorthand": "", "type": "{token,tls,off}" }, { "default": "off", "description": "set authorization scheme", "name": "--authorization", "shorthand": "", "type": "{basic,off}" }, { "default": "false", "description": "load paths as bundle files or root directories", "name": "--bundle", "shorthand": "-b", "type": "bool" }, { "default": "", "description": "set path of configuration file", "name": "--config-file", "shorthand": "-c", "type": "string" }, { "default": "[]", "description": "set read-only diagnostic listening address of the server for /health and /metric APIs (e.g., [ip]:\u003cport\u003e for TCP, unix://\u003cpath\u003e for UNIX domain socket)", "name": "--diagnostic-addr", "shorthand": "", "type": "stringSlice" }, { "default": "false", "description": "disables version check against GitHub releases (see: https://www.openpolicyagent.org/docs/privacy)", "name": "--disable-telemetry", "shorthand": "", "type": "bool" }, { "default": "[]", "description": "set file names to exclude during bundle verification", "name": "--exclude-files-verify", "shorthand": "", "type": "stringSlice" }, { "default": "pretty", "description": "set shell output format, i.e, pretty, json", "name": "--format", "shorthand": "-f", "type": "string" }, { "default": "false", "description": "enable H2C for HTTP listeners", "name": "--h2c", "shorthand": "", "type": "bool" }, { "default": "/Users/charlieegan3/.opa_history", "description": "set path of history file", "name": "--history", "shorthand": "-H", "type": "string" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "json", "description": "set log format", "name": "--log-format", "shorthand": "", "type": "{text,json,json-pretty}" }, { "default": "info", "description": "set log level", "name": "--log-level", "shorthand": "-l", "type": "{debug,info,error}" }, { "default": "", "description": "set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)", "name": "--log-timestamp-format", "shorthand": "", "type": "string" }, { "default": "10", "description": "set the number of errors to allow before compilation fails early", "name": "--max-errors", "shorthand": "-m", "type": "int" }, { "default": "1.2", "description": "set minimum TLS version to be used by opa's server", "name": "--min-tls-version", "shorthand": "", "type": "{1.0,1.1,1.2,1.3}" }, { "default": "false", "description": "optimize default in-memory store for read speed. Has possible negative impact on memory footprint and write speed. See https://www.openpolicyagent.org/docs/latest/policy-performance/#storage-optimization for more details.", "name": "--optimize-store-for-read-speed", "shorthand": "", "type": "bool" }, { "default": "false", "description": "enables pprof endpoints", "name": "--pprof", "shorthand": "", "type": "bool" }, { "default": "0", "description": "wait (in seconds) for configured plugins before starting server (value \u003c= 0 disables ready check)", "name": "--ready-timeout", "shorthand": "", "type": "int" }, { "default": "", "description": "scope to use for bundle signature verification", "name": "--scope", "shorthand": "", "type": "string" }, { "default": "false", "description": "start the runtime in server mode", "name": "--server", "shorthand": "-s", "type": "bool" }, { "default": "[]", "description": "override config values on the command line (use commas to specify multiple values)", "name": "--set", "shorthand": "", "type": "stringArray" }, { "default": "[]", "description": "override config values with files on the command line (use commas to specify multiple values)", "name": "--set-file", "shorthand": "", "type": "stringArray" }, { "default": "10", "description": "set the time (in seconds) that the server will wait to gracefully shut down", "name": "--shutdown-grace-period", "shorthand": "", "type": "int" }, { "default": "0", "description": "set the time (in seconds) that the server will wait before initiating shutdown", "name": "--shutdown-wait-period", "shorthand": "", "type": "int" }, { "default": "RS256", "description": "name of the signing algorithm", "name": "--signing-alg", "shorthand": "", "type": "string" }, { "default": "false", "description": "disables type checking on known input schemas", "name": "--skip-known-schema-check", "shorthand": "", "type": "bool" }, { "default": "false", "description": "disables bundle signature verification", "name": "--skip-verify", "shorthand": "", "type": "bool" }, { "default": "false", "description": "disables version check against GitHub releases (see: https://www.openpolicyagent.org/docs/privacy)", "name": "--skip-version-check", "shorthand": "", "type": "bool" }, { "default": "", "description": "set path of TLS CA cert file", "name": "--tls-ca-cert-file", "shorthand": "", "type": "string" }, { "default": "", "description": "set path of TLS certificate file", "name": "--tls-cert-file", "shorthand": "", "type": "string" }, { "default": "0s", "description": "set certificate refresh period", "name": "--tls-cert-refresh-period", "shorthand": "", "type": "duration" }, { "default": "[]", "description": "set list of enabled TLS 1.0–1.2 cipher suites (IANA)", "name": "--tls-cipher-suites", "shorthand": "", "type": "stringSlice" }, { "default": "", "description": "set path of TLS private key file", "name": "--tls-private-key-file", "shorthand": "", "type": "string" }, { "default": "755", "description": "specify the permissions for the Unix domain socket if used to listen for incoming connections", "name": "--unix-socket-perm", "shorthand": "", "type": "string" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" }, { "default": "", "description": "set the secret (HMAC) or path of the PEM file containing the public key (RSA and ECDSA)", "name": "--verification-key", "shorthand": "", "type": "string" }, { "default": "default", "description": "name assigned to the verification key used for bundle verification", "name": "--verification-key-id", "shorthand": "", "type": "string" }, { "default": "false", "description": "watch command line files for changes", "name": "--watch", "shorthand": "-w", "type": "bool" } ], "id": "run", "long": "Start an instance of opa.\n\nTo run the interactive shell:\n\n $ opa run\n\nTo run the server:\n\n $ opa run -s\n\nThe 'run' command starts an instance of the opa runtime. The opa runtime can be\nstarted as an interactive shell or a server.\n\nWhen the runtime is started as a shell, users can define rules and evaluate\nexpressions interactively. When the runtime is started as a server, opa exposes\nan HTTP API for managing policies, reading and writing data, and executing\nqueries.\n\nThe runtime can be initialized with one or more files that contain policies or\ndata. If the '--bundle' option is specified the paths will be treated as policy\nbundles and loaded following standard bundle conventions. The path can be a\ncompressed archive file or a directory which will be treated as a bundle.\nWithout the '--bundle' flag opa will recursively load ALL rego, JSON, and YAML\nfiles.\n\nWhen loading from directories, only files with known extensions are considered.\nThe current set of file extensions that opa will consider are:\n\n .json # JSON data\n .yaml or .yml # YAML data\n .rego # Rego file\n\nNon-bundle data file and directory paths can be prefixed with the desired\ndestination in the data document with the following syntax:\n\n \u003cdotted-path\u003e:\u003cfile-path\u003e\n\nTo set a data file as the input document in the interactive shell use the\n\"repl.input\" path prefix with the input file:\n\n repl.input:\u003cfile-path\u003e\n\nExample:\n\n $ opa run repl.input:input.json\n\nWhich will load the \"input.json\" file at path \"data.repl.input\".\n\nUse the \"help input\" command in the interactive shell to see more options.\n\n\nFile paths can be specified as URLs to resolve ambiguity in paths containing colons:\n\n $ opa run file:///c:/path/to/data.json\n\nOn Windows, a path beginning with a drive letter is read as a path rather than a\ndestination, so \"C:\\path\\to\\data.json\" loads at the root of the data document. A\nsingle-character destination must therefore be followed by a qualified path:\n\n $ opa run c:C:\\path\\to\\data.json\n\nWhich will load the \"data.json\" file at path \"data.c\".\n\nURL paths to remote public bundles (http or https) will be parsed as shorthand\nconfiguration equivalent of using repeated --set flags to accomplish the same:\n\n\t$ opa run -s https://example.com/bundles/bundle.tar.gz\n\nThe above shorthand command is identical to:\n\n $ opa run -s --set \"services.cli1.url=https://example.com\" \\\n --set \"bundles.cli1.service=cli1\" \\\n --set \"bundles.cli1.resource=/bundles/bundle.tar.gz\" \\\n --set \"bundles.cli1.persist=true\"\n\nThe 'run' command can also verify the signature of a signed bundle.\nA signed bundle is a normal opa bundle that includes a file\nnamed \".signatures.json\". For more information on signed bundles\nsee https://www.openpolicyagent.org/docs/latest/management-bundles/#signing.\n\nThe key to verify the signature of signed bundle can be provided\nusing the --verification-key flag. For example, for RSA family of algorithms,\nthe command expects a PEM file containing the public key.\nFor HMAC family of algorithms (eg. HS256), the secret can be provided\nusing the --verification-key flag.\n\nThe --verification-key-id flag can be used to optionally specify a name for the\nkey provided using the --verification-key flag.\n\nThe --signing-alg flag can be used to specify the signing algorithm.\nThe 'run' command uses RS256 (by default) as the signing algorithm.\n\nThe --scope flag can be used to specify the scope to use for\nbundle signature verification.\n\nExample:\n\n $ opa run --verification-key secret --signing-alg HS256 --bundle bundle.tar.gz\n\nThe 'run' command will read the bundle \"bundle.tar.gz\", check the\n\".signatures.json\" file and perform verification using the provided key.\nAn error will be generated if \"bundle.tar.gz\" does not contain a \".signatures.json\" file.\nFor more information on the bundle verification process see\nhttps://www.openpolicyagent.org/docs/latest/management-bundles/#signature-verification.\n\nThe 'run' command can ONLY be used with the --bundle flag to verify signatures\nfor existing bundle files or directories following the bundle structure.\n\nTo skip bundle verification, use the --skip-verify flag.\n\nThe --watch flag can be used to monitor policy and data file-system changes. When a change is detected, the updated policy\nand data is reloaded into OPA. Watching individual files (rather than directories) is generally not recommended as some\nupdates might cause them to be dropped by OPA.\n\nOPA will automatically perform type checking based on a schema inferred from known input documents and report any errors\nresulting from the schema check. Currently this check is performed on OPA's Authorization Policy Input document and will\nbe expanded in the future. To disable this, use the --skip-known-schema-check flag.\n\nThe --v0-compatible flag can be used to opt-in to OPA features and behaviors that were the default in OPA v0.x.\nBehaviors enabled by this flag include:\n- setting OPA's listening address to \":8181\" by default, corresponding to listening on every network interface.\n- expecting v0 Rego syntax in policy modules instead of the default v1 Rego syntax.\n\nThe --tls-cipher-suites flag can be used to specify the list of enabled TLS 1.0–1.2 cipher suites. Note that TLS 1.3\ncipher suites are not configurable. Following are the supported TLS 1.0 - 1.2 cipher suites (IANA):\nTLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,\nTLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n\nSee https://godoc.org/crypto/tls#pkg-constants for more information.\n", "parent_flags": null, "short": "Start opa in interactive or server mode", "use": "run", "useline": "opa run [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "load paths as bundle files or root directories", "name": "--bundle", "shorthand": "-b", "type": "bool" }, { "default": "", "description": "set path of JSON file containing optional claims (see: https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format)", "name": "--claims-file", "shorthand": "", "type": "string" }, { "default": ".", "description": "set the location for the .signatures.json file", "name": "--output-file-path", "shorthand": "-o", "type": "string" }, { "default": "RS256", "description": "name of the signing algorithm", "name": "--signing-alg", "shorthand": "", "type": "string" }, { "default": "", "description": "set the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)", "name": "--signing-key", "shorthand": "", "type": "string" }, { "default": "", "description": "name of the plugin to use for signing/verification (see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-plugin)", "name": "--signing-plugin", "shorthand": "", "type": "string" } ], "id": "sign", "long": "Generate an opa bundle signature.\n\nThe 'sign' command generates a digital signature for policy bundles. It generates a\n\".signatures.json\" file that dictates which files should be included in the bundle,\nwhat their SHA hashes are, and is cryptographically secure.\n\nThe signatures file is a JSON file with an array containing a single JSON Web Token (JWT)\nthat encapsulates the signature for the bundle.\n\nThe --signing-alg flag can be used to specify the algorithm to sign the token. The 'sign'\ncommand uses RS256 (by default) as the signing algorithm.\nSee https://www.openpolicyagent.org/docs/latest/configuration/#keys\nfor a list of supported signing algorithms.\n\nThe key to be used for signing the JWT MUST be provided using the --signing-key flag.\nFor example, for RSA family of algorithms, the command expects a PEM file containing\nthe private key.\nFor HMAC family of algorithms (e.g. HS256), the secret can be provided using\nthe --signing-key flag.\n\nopa 'sign' can ONLY be used with the --bundle flag to load paths that refer to\nexisting bundle files or directories following the bundle structure.\n\n\t$ opa sign --signing-key /path/to/private_key.pem --bundle foo\n\nWhere foo has the following structure:\n\n\tfoo/\n\t |\n\t +-- bar/\n\t | |\n\t | +-- data.json\n\t |\n\t +-- policy.rego\n\t |\n\t +-- .manifest\n\nThis will create a \".signatures.json\" file in the current directory.\nThe --output-file-path flag can be used to specify a different location for\nthe \".signatures.json\" file.\n\nThe content of the \".signatures.json\" file is shown below:\n\n\t{\n\t \"signatures\": [\n\t\t\"eyJhbGciOiJSUzI1NiJ9.eyJmaWxlcyI6W3sibmFtZSI6Ii5tYW5pZmVzdCIsImhhc2giOiIxODc0NWRlNzJjMDFlODBjZDlmNTIwZjQxOGMwMDlhYzRkMmMzZDAyYjE3YTUwZTJkMDQyMTU4YmMzNTJhMzJkIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9LHsibmFtZSI6ImJhci9kYXRhLmpzb24iLCJoYXNoIjoiOTNhMjM5NzFhOTE0ZTVlYWNiZjBhOGQyNTE1NGNkYTMwOWMzYzFjNzJmYmI5OTE0ZDQ3YzYwZjNjYjY4MTU4OCIsImFsZ29yaXRobSI6IlNIQS0yNTYifSx7Im5hbWUiOiJwb2xpY3kucmVnbyIsImhhc2giOiJkMGYyNDJhYWUzNGRiNTRlZjU2NmJlYTRkNDVmY2YxOTcwMGM1ZDhmODdhOWRiOTMyZGZhZDZkMWYwZjI5MWFjIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9XX0.lNsmRqrmT1JI4Z_zpY6IzHRZQAU306PyOjZ6osquixPuTtdSBxgbsdKDcp7Civw3B77BgygVsvx4k3fYr8XCDKChm0uYKScrpFr9_yS6g5mVTQws3KZncZXCQHdupRFoqMS8vXAVgJr52C83AinYWABwH2RYq_B0ZPf_GDzaMgzpep9RlDNecGs57_4zlyxmP2ESU8kjfX8jAA6rYFKeGXJHMD-j4SassoYIzYRv9YkHx8F8Y2ae5Kd5M24Ql0kkvqc_4eO_T9s4nbQ4q5qGHGE-91ND1KVn2avcUyVVPc0-XCR7EH8HnHgCl0v1c7gX1RL7ET7NJbPzfmzQAzk0ZW0dEHI4KZnXSpqy8m-3zAc8kIARm2QwoNEWpy3MWiooPeZVSa9d5iw1aLrbyumfjBP0vCQEPes-Aa6PrARwd5jR9SacO5By0-4emzskvJYRZqbfJ9tXSXDMcAFOAm6kqRPJaj8AO4CyajTC_Lt32_0OLeXqYgNpt3HDqLqGjrb-8fVeQc-hKh0aES8XehQqXj4jMwfsTyj5alsXZm08LwzcFlfQZ7s1kUtmr0_BBNJYcdZUdlu6Qio3LFSRYXNuu6edAO1VH5GKqZISvE1uvDZb2E0Z-rtH-oPp1iSpfvsX47jKJ42LVpI6OahEBri44dzHOIwwm3CIuV8gFzOwR0k\"\n\t ]\n\t}\n\nAnd the decoded JWT payload has the following form:\n\n\t{\n\t \"files\": [\n\t\t{\n\t\t \"name\": \".manifest\",\n\t\t \"hash\": \"18745de72c01e80cd9f520f418c009ac4d2c3d02b17a50e2d042158bc352a32d\",\n\t\t \"algorithm\": \"SHA-256\"\n\t\t},\n\t\t{\n\t\t \"name\": \"policy.rego\",\n\t\t \"hash\": \"d0f242aae34db54ef566bea4d45fcf19700c5d8f87a9db932dfad6d1f0f291ac\",\n\t\t \"algorithm\": \"SHA-256\"\n\t\t},\n\t\t{\n\t\t \"name\": \"bar/data.json\",\n\t\t \"hash\": \"93a23971a914e5eacbf0a8d25154cda309c3c1c72fbb9914d47c60f3cb681588\",\n\t\t \"algorithm\": \"SHA-256\"\n\t\t}\n\t ]\n\t}\n\nThe \"files\" field is generated from the files under the directory path(s)\nprovided to the 'sign' command. During bundle signature verification, opa will check\neach file name (ex. \"foo/bar/data.json\") in the \"files\" field\nexists in the actual bundle. The file content is hashed using SHA256.\n\nTo include additional claims in the payload use the --claims-file flag to provide\na JSON file containing optional claims.\n\nFor more information on the format of the \".signatures.json\" file see\nhttps://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.\n", "parent_flags": null, "short": "Generate an opa bundle signature", "use": "sign \u003cpath\u003e [\u003cpath\u003e [...]]", "useline": "opa sign \u003cpath\u003e [\u003cpath\u003e [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "benchmark the unit tests", "name": "--bench", "shorthand": "", "type": "bool" }, { "default": "true", "description": "report memory allocations with benchmark results", "name": "--benchmem", "shorthand": "", "type": "bool" }, { "default": "false", "description": "load paths as bundle files or root directories", "name": "--bundle", "shorthand": "-b", "type": "bool" }, { "default": "", "description": "set capabilities version or capabilities.json file path", "name": "--capabilities", "shorthand": "", "type": "string" }, { "default": "1", "description": "number of times to repeat each test", "name": "--count", "shorthand": "", "type": "int" }, { "default": "false", "description": "report coverage (overrides debug tracing)", "name": "--coverage", "shorthand": "-c", "type": "bool" }, { "default": "false", "description": "skipped tests return status 0", "name": "--exit-zero-on-skipped", "shorthand": "-z", "type": "bool" }, { "default": "fails", "description": "enable query explanations", "name": "--explain", "shorthand": "", "type": "{fails,full,notes,debug}" }, { "default": "false", "description": "Whether to fail the test when no test was run", "name": "--fail-on-empty", "shorthand": "", "type": "bool" }, { "default": "pretty", "description": "set output format", "name": "--format", "shorthand": "-f", "type": "{pretty,json,gobench}" }, { "default": "[]", "description": "set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)", "name": "--ignore", "shorthand": "", "type": "stringSlice" }, { "default": "10", "description": "set the number of errors to allow before compilation fails early", "name": "--max-errors", "shorthand": "-m", "type": "int" }, { "default": "16", "description": "the number of tests that can run in parallel, defaulting to the number of CPUs (explicitly set with 0). Benchmarks are always run sequentially.", "name": "--parallel", "shorthand": "-p", "type": "int" }, { "default": "", "description": "run only test cases matching the regular expression", "name": "--run", "shorthand": "-r", "type": "string" }, { "default": "", "description": "set schema file path or directory path", "name": "--schema", "shorthand": "-s", "type": "string" }, { "default": "none", "description": "sort the JSON formatted test output", "name": "--sort", "shorthand": "", "type": "{none,duration}" }, { "default": "rego", "description": "set the runtime to exercise", "name": "--target", "shorthand": "-t", "type": "{rego,wasm}" }, { "default": "0", "description": "set coverage threshold and exit with non-zero status if coverage is less than threshold %", "name": "--threshold", "shorthand": "", "type": "float64" }, { "default": "0s", "description": "set test timeout (default 5s, 30s when benchmarking)", "name": "--timeout", "shorthand": "", "type": "duration" }, { "default": "false", "description": "opt-in to OPA features and behaviors prior to the OPA v1.0 release", "name": "--v0-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "opt-in to OPA features and behaviors that are enabled by default in OPA v1.0", "name": "--v1-compatible", "shorthand": "", "type": "bool" }, { "default": "false", "description": "show local variable values in test output", "name": "--var-values", "shorthand": "", "type": "bool" }, { "default": "false", "description": "set verbose reporting mode", "name": "--verbose", "shorthand": "-v", "type": "bool" }, { "default": "false", "description": "watch command line files for changes", "name": "--watch", "shorthand": "-w", "type": "bool" } ], "id": "test", "long": "Execute Rego test cases.\n\nThe 'test' command takes a file or directory path as input and executes all\ntest cases discovered in matching files. Test cases are rules whose names have the prefix \"test_\".\n\nIf the '--bundle' option is specified the paths will be treated as policy bundles\nand loaded following standard bundle conventions. The path can be a compressed archive\nfile or a directory which will be treated as a bundle. Without the '--bundle' flag OPA\nwill recursively load ALL *.rego, *.json, and *.yaml files for evaluating the test cases.\n\nTest cases under development may be prefixed \"todo_\" in order to skip their execution,\nwhile still getting marked as skipped in the test results.\n\nExample policy (example/authz.rego):\n\n\tpackage authz\n\n\tallow if {\n\t\tinput.path == [\"users\"]\n\t\tinput.method == \"POST\"\n\t}\n\n\tallow if {\n\t\tinput.path == [\"users\", input.user_id]\n\t\tinput.method == \"GET\"\n\t}\n\nExample test (example/authz_test.rego):\n\n\tpackage authz_test\n\n\timport data.authz.allow\n\n\ttest_post_allowed if {\n\t\tallow with input as {\"path\": [\"users\"], \"method\": \"POST\"}\n\t}\n\n\ttest_get_denied if {\n\t\tnot allow with input as {\"path\": [\"users\"], \"method\": \"GET\"}\n\t}\n\n\ttest_get_user_allowed if {\n\t\tallow with input as {\"path\": [\"users\", \"bob\"], \"method\": \"GET\", \"user_id\": \"bob\"}\n\t}\n\n\ttest_get_another_user_denied if {\n\t\tnot allow with input as {\"path\": [\"users\", \"bob\"], \"method\": \"GET\", \"user_id\": \"alice\"}\n\t}\n\n\ttodo_test_user_allowed_http_client_data if {\n\t\tfalse # Remember to test this later!\n\t}\n\nExample test run:\n\n\t$ opa test ./example/\n\nIf used with the '--bench' option then tests will be benchmarked.\n\nExample benchmark run:\n\n\t$ opa test --bench ./example/\n\nThe optional \"gobench\" output format conforms to the Go Benchmark Data Format.\n\nThe --watch flag can be used to monitor policy and data file-system changes. When a change is detected, opa reloads\nthe policy and data and then re-runs the tests. Watching individual files (rather than directories) is generally not\nrecommended as some updates might cause them to be dropped by OPA.\n", "parent_flags": null, "short": "Execute Rego test cases", "use": "test \u003cpath\u003e [path [...]]", "useline": "opa test \u003cpath\u003e [path [...]] [flags]" }, { "children": [], "example": "", "flags": [ { "default": "false", "description": "check for latest opa release", "name": "--check", "shorthand": "-c", "type": "bool" } ], "id": "version", "long": "Show version and build information for opa.", "parent_flags": null, "short": "Print the version of opa", "use": "version", "useline": "opa version [flags]" } ]