Usage: opal-client [OPTIONS] [COMMAND] [ARGS]... Config top level options: - Use env-vars (same as cmd options) but uppercase and with "_" instead of "-"; all prefixed with "OPAL_" - Use command line options as detailed by '--help' - Use .env or .ini files Examples: - opal-client --help Detailed help on CLI - opal-client run --help Help on run command - opal-client run --engine-type gunicorn Run client with gunicorn Options: --split-root-data BOOLEAN Split writing data updates to root path --default-opal-server-connectivity-disabled BOOLEAN If set together with OFFLINE_MODE_ENABLED, the client will not connect to the OPAL server when a valid backup is loaded. Can be toggled at runtime via the /opal- server/connectivity endpoints. --offline-mode-enabled BOOLEAN If set, opal client will try to load policy store from backup file and operate even if server is unreachable. Ignored if INLINE_OPA_ENABLED=False --store-backup-interval INTEGER Interval in seconds to backup policy store's data [default: 60] --store-backup-path TEXT Path to backup policy store's data to [default: (/opal/backup/opa.json)] --scope-id TEXT OPAL Scope ID [default: (default)] --opal-client-stat-id TEXT Unique client statistics identifier --opa-health-check-transaction-log-path TEXT Path to OPA document that stores the OPA write transactions [default: (system/opal/transactions)] --opa-health-check-policy-enabled BOOLEAN Should we load a special healthcheck policy into OPA that checks that opa was synced correctly and is ready to answer to authorization queries --default-update-callbacks Where/How the client should report on the completion of data updates [default: callba cks=['http://localhost:7002/data/callback_re port']] --default-update-callback-config Configuration for the default update callback [default: fetcher=None headers='' is_json=True process_data=False method= data=''] --should-report-on-data-updates BOOLEAN Should the client report on updates to callbacks defined in DEFAULT_UPDATE_CALLBACKS or within the given updates --default-data-url TEXT Default URL to fetch data from [default: (http://localhost:8000/policy-config)] --default-data-sources-config-url TEXT Default URL to fetch data configuration from [default: http://localhost:7002/data/config] --data-topics LIST Data topics to subscribe to [default: policy_data] --data-updater-enabled BOOLEAN If set to False, opal client will not listen to dynamic data updates. Dynamic data fetching will be completely disabled. [default: True] --policy-subscription-dirs LIST Directories in the policy repo to subscribe to for policy code (rego) modules [default: .] --wait-on-server-load BOOLEAN If set, client would wait for 200 from server's loadlimit endpoint before starting background tasks --client-api-server-port INTEGER (if run via CLI) Port for the opal-client's internal server to bind [default: 7000] --client-api-server-host TEXT (if run via CLI) Address for the opal- client's internal server to bind [default: (127.0.0.1)] --client-api-server-worker-count INTEGER (if run via CLI) Worker count for the opal- client's internal server [default: 1] -t, --client-token TEXT The authentication token for the OPAL server [default: (THIS_IS_A_DEV_SECRET)] --server-pubsub-url TEXT The Pub/Sub URL of the OPAL server [default: ws://localhost:7002/ws] --server-ws-url TEXT The WebSocket URL of the OPAL server [default: ws://localhost:7002] -s, --server-url TEXT The URL of the OPAL server [default: (http://localhost:7002)] --keep-alive-interval INTEGER The interval (in seconds) for sending keep- alive messages --inline-cedar-log-format The log format to use for inline Cedar logs [default: (none)] --inline-cedar-config CLI options used when running the Cedar agent inline --inline-cedar-exec-path TEXT Path to the Cedar Agent executable. Defaults to searching for 'cedar-agent' binary in PATH if not specified. --inline-cedar-enabled BOOLEAN Whether or not OPAL should run the Cedar agent by itself in the same container [default: True] --inline-opa-log-format The log format to use for inline OPA logs [default: (none)] --opa-v0-compat BOOLEAN Set to true to enable OPA v0 compatibility mode (--v0-compatible flag). This merges with INLINE_OPA_CONFIG.v0_compatible - if either is enabled, the flag will be added to OPA [default: True] --inline-opa-config CLI options used when running `opa run --server` inline --inline-opa-exec-path TEXT Path to the OPA executable. Defaults to searching for 'opa' binary in PATH if not specified. --inline-opa-enabled BOOLEAN Whether or not OPAL should run OPA by itself in the same container [default: True] --exclude-policy-store-secrets BOOLEAN If set, policy store secrets will be excluded from the /policy-store/config route --policy-store-tls-ca TEXT Path to the file containing the CA certificate(s) used for TLS authentication with the policy store --policy-store-tls-client-key TEXT Path to the client key used for TLS authentication with the policy store --policy-store-tls-client-cert TEXT Path to the client certificate used for TLS authentication with the policy store --policy-updater-enabled BOOLEAN If set to False, opal client will not listen to dynamic policy updates.Policy update fetching will be completely disabled. [default: True] --policy-store-policy-paths-to-ignore LIST When loading policies manually or otherwise externally into the policy store, use this list of glob patterns to have OPAL ignore and not delete or override them, end paths (without any wildcards in the middle) with '/**' to indicate you want all nested under the path to be ignored --data-updater-conn-retry Retry options when connecting to the base data source (e.g. an external API server which returns data snapshot) [default: wait _strategy= wait_time=1.0 attempts=5 max_wait=10.0] --data-store-conn-retry DEPRECATED - The old confusing name for DATA_UPDATER_CONN_RETRY, kept for backwards compatibility (for now) --policy-updater-conn-retry Retry options when connecting to the policy source (e.g. the policy bundle server) [default: wait_strategy= wait_time=1.0 attempts=5 max_wait=10.0] --policy-store-liveness-probe-timeout-seconds INTEGER Per-request HTTP timeout (seconds) for liveness probes against the policy store. [default: 2] --policy-store-liveness-probe-interval-seconds INTEGER Interval (seconds) between background liveness probes against the policy store. [default: 10] --policy-store-liveness-probe-enabled BOOLEAN If True, OPAL client periodically probes the policy store's health endpoint and factors the result into /healthy. This makes /healthy reflect live policy-store responsiveness, not just the success of the last server -> policy-store transaction. [default: True] --policy-store-conn-retry Retry options when connecting to the policy store (i.e. the agent that handles the policy, e.g. OPA) --policy-store-auth-oauth-client-secret TEXT The client secret OPAL will use to authenticate against the OAuth server. --policy-store-auth-oauth-client-id TEXT The client_id OPAL will use to authenticate against the OAuth server. --policy-store-auth-oauth-server TEXT The authentication server OPAL client will use to authenticate against for retrieving the access_token. --policy-store-auth-token TEXT The authentication (bearer) token OPAL client will use to authenticate against the policy store (i.e: OPA agent). --policy-store-auth-type The authentication type to use for the policy store (e.g., NONE, TOKEN, etc.) [default: NONE] --policy-store-url TEXT The URL of the policy store (e.g., OPA agent). [default: (http://localhost:8181)] --policy-store-type The type of policy store to use (e.g., OPA, Cedar, etc.) [default: OPA] --http-fetcher-timeout FLOAT The timeout for the httpx or aiohttp fetcher provider, in seconds. if provided different value, 5 seconds will be used. [default: 5] --http-fetcher-provider-client TEXT The client to use for fetching data, can be either aiohttp or httpx.if provided different value, aiohttp will be used. [default: (aiohttp)] --enable-datadog-apm BOOLEAN Set if OPAL server should enable tracing with datadog APM --enable-metrics BOOLEAN Enable metrics collection --policy-repo-policy-extensions LIST List of extensions to serve as policy modules [default: .rego] --auth-jwt-issuer TEXT Issuer for JWT authentication [default: (https://opal.ac/)] --auth-jwt-audience TEXT Audience for JWT authentication [default: (https://api.opal.ac/v1/)] --auth-jwt-algorithm jwt algorithm, possible values: see: https:/ /pyjwt.readthedocs.io/en/stable/algorithms.h tml [default: RS256] --auth-public-key Public key for authentication --auth-public-key-format Format of the public key for authentication [default: (ssh)] --client-ssl-context-trusted-ca-file TEXT A path to your own CA public certificate file (usually a .crt or a .pem file). Certificates signed by this issuer will be trusted by OPAL Client. DO NOT USE THIS IN PRODUCTION! --client-self-signed-certificates-allowed BOOLEAN Whether or not OPAL Client will trust HTTPs connections protected by self signed certificates. DO NOT USE THIS IN PRODUCTION! --git-ssh-key-file TEXT Path to the SSH key file for Git [default: (/tmp/.ssh/opal_repo_ssh_key)] --fetching-enqueue-timeout INTEGER Time in seconds to wait for queuing a new task (if the queue is full) [default: 10] --fetching-callback-timeout INTEGER Time in seconds to wait on the queued fetch task [default: 10] --fetching-worker-count INTEGER Max number of worker tasks handling fetch events concurrently [default: 6] --fetch-provider-modules LIST List of modules to load fetch providers from [default: opal_common.fetcher.providers] --statistics-remove-client-channel TEXT The topic to update about OPAL clients disconnection [default: (__opal_stats_rm)] --statistics-add-client-channel TEXT The topic to update about new OPAL clients connection [default: (__opal_stats_add)] --statistics-enabled BOOLEAN Set if OPAL server will collect statistics about OPAL clients may cause a small performance hit --log-file-level TEXT The log level to show in file [default: (INFO)] --log-file-serialize TEXT Serialize log messages in file [default: True] --log-file-compression TEXT Log file compression format --log-file-retention TEXT Log file retention time [default: (10 days)] --log-file-rotation TEXT Log file rotation size [default: (250 MB)] --log-file-path TEXT path to save log file [default: (opal_{time}.log)] --log-to-file BOOLEAN Should we log to a file --log-patch-uvicorn-logs BOOLEAN Should we takeover UVICORN's logs so they appear in the main logger [default: True] --log-module-include-list LIST List of modules to include in logging [default: uvicorn.protocols.http] --log-module-exclude-list LIST List of modules to exclude from logging [default: uvicorn, opal_client.opa.logger] --log-level TEXT The log level to show [default: (INFO)] --log-show-code-line BOOLEAN Show code line in log messages [default: True] --log-pipe-to-stderr BOOLEAN Should we send logs to stderr? otherwise to stdout [default: True] --log-serialize BOOLEAN Serialize log messages --log-colorize BOOLEAN Colorize log messages [default: True] --log-diagnose BOOLEAN Include diagnosis (local variable values) in tracebacks. Off by default because loguru renders raw variable values, which can leak credentials (e.g. auth headers/tokens) into logs - only enable for local debugging. Also gates verbose git SSH protocol tracing (GIT_TRACE/GIT_CURL_VERBOSE on SSH clones), which adds noisy protocol/host disclosure to logs. --log-traceback BOOLEAN Include traceback in log messages [default: True] --log-format TEXT The format of the log messages [default: {time} | {name: <40}|{level:^6} | {message} {exception}] --log-format-include-pid BOOLEAN Include process ID in log format --allowed-origins LIST List of allowed origins for CORS [default: *] --help Show this message and exit. Commands: generate-secret obtain-token Obtain a secret JWT (JSON-Web-Token) from the... print-config To test config values, print the configuration... publish-data-update Publish a DataUpdate through an OPAL-server... run Run the client as a daemon. version Print the OPAL version.