opa-exec(1)

Open Policy Agent(1)

NAME

opa-exec - Execute against input files

SYNOPSIS

opa exec [ [...]] [flags]

DESCRIPTION

Execute against input files.

The 'exec' command executes OPA against one or more input files. If the paths refer to directories, OPA will execute against files contained inside those directories, recursively.

The 'exec' command accepts a --config-file/-c or series of --set options as arguments. These options behave the same as way as 'opa run'. Since the 'exec' command is intended to execute OPA in one-shot, the 'exec' command will manually trigger plugins before and after policy execution:

Before: Discovery -> Bundle -> Status After: Decision Logs

By default, the 'exec' command executes the "default decision" (specified in the OPA configuration) against each input file. This can be overridden by specifying the --decision argument and pointing at a specific policy decision,

e.g., opa exec --decision /foo/bar/baz ...

OPTIONS

-b, --bundle="" set bundle file(s) or directory path(s). This flag can be repeated.

-c, --config-file="" set path of configuration file

--decision="" set decision to evaluate

--fail[=false] exits with non-zero exit code on undefined/empty result and errors

--fail-defined[=false] exits with non-zero exit code on defined/non-empty result and errors

--fail-non-empty[=false] exits with non-zero exit code on non-empty result and errors

-f, --format=json set output format

-h, --help[=false] help for exec

--log-format=json set log format

-l, --log-level=error set log level

--log-timestamp-format="" set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)

--set=[] override config values on the command line (use commas to specify multiple values)

--set-file=[] override config values with files on the command line (use commas to specify multiple values)

-I, --stdin-input[=false] read input document from stdin rather than a static file

--timeout=0s set exec timeout with a Go-style duration, such as '5m 30s'. (default unlimited)

--v0-compatible[=false] opt-in to OPA features and behaviors prior to the OPA v1.0 release

EXAMPLE



  Loading input from stdin:


    opa exec [<path> [...]] --stdin-input [flags]