opa-deps(1)

Open Policy Agent(1)

NAME

opa-deps - Analyze Rego query dependencies

SYNOPSIS

opa deps [flags]

DESCRIPTION

Print dependencies of provided query.

Dependencies are categorized as either base documents, which is any data loaded from the outside world, or virtual documents, i.e values that are computed from rules.

OPTIONS

-b, --bundle="" set bundle file(s) or directory path(s). This flag can be repeated.

-d, --data="" set policy or data file(s). This flag can be repeated.

-f, --format=pretty set output format

-h, --help[=false] help for deps

--ignore=[] set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)

EXAMPLE

Given a policy like this:
	package policy
	allow if is_admin
	is_admin if "admin" in input.user.roles
To evaluate the dependencies of a simple query (e.g. data.policy.allow),
we'd run opa deps like demonstrated below:
	$ opa deps --data policy.rego data.policy.allow
	+------------------+----------------------+
	|  BASE DOCUMENTS  |  VIRTUAL DOCUMENTS   |
	+------------------+----------------------+
	| input.user.roles | data.policy.allow    |
	|                  | data.policy.is_admin |
	+------------------+----------------------+
From the output we're able to determine that the allow rule depends on
the input.user.roles base document, as well as the virtual document (rule)
data.policy.is_admin.