/usr/bin/opal-client

Usage: opal-client [OPTIONS] [COMMAND] [ARGS]...

  Config top level options:
      - Use env-vars (same as cmd options) but uppercase
          and with "_" instead of "-"; all prefixed with "OPAL_"
      - Use command line options as detailed by '--help'
      - Use .env or .ini files

  Examples:
      - opal-client --help                           Detailed help on CLI
      - opal-client run --help                       Help on run command
      - opal-client run --engine-type gunicorn       Run client with gunicorn


Options:
  --split-root-data BOOLEAN       Split writing data updates to root path
  --default-opal-server-connectivity-disabled BOOLEAN
                                  If set together with OFFLINE_MODE_ENABLED,
                                  the client will not connect to the OPAL
                                  server when a valid backup is loaded. Can be
                                  toggled at runtime via the /opal-
                                  server/connectivity endpoints.
  --offline-mode-enabled BOOLEAN  If set, opal client will try to load policy
                                  store from backup file and operate even if
                                  server is unreachable. Ignored if
                                  INLINE_OPA_ENABLED=False
  --store-backup-interval INTEGER
                                  Interval in seconds to backup policy store's
                                  data  [default: 60]
  --store-backup-path TEXT        Path to backup policy store's data to
                                  [default: (/opal/backup/opa.json)]
  --scope-id TEXT                 OPAL Scope ID  [default: (default)]
  --opal-client-stat-id TEXT      Unique client statistics identifier
  --opa-health-check-transaction-log-path TEXT
                                  Path to OPA document that stores the OPA
                                  write transactions  [default:
                                  (system/opal/transactions)]
  --opa-health-check-policy-enabled BOOLEAN
                                  Should we load a special healthcheck policy
                                  into OPA that checks that opa was synced
                                  correctly and is ready to answer to
                                  authorization queries
  --default-update-callbacks <UPDATECALLBACK>
                                  Where/How the client should report on the
                                  completion of data updates  [default: callba
                                  cks=['http://localhost:7002/data/callback_re
                                  port']]
  --default-update-callback-config <HTTPFETCHERCONFIG>
                                  Configuration for the default update
                                  callback  [default: fetcher=None
                                  headers='<redacted>' is_json=True
                                  process_data=False method=<HttpMethods.POST:
                                  'post'> data='<redacted>']
  --should-report-on-data-updates BOOLEAN
                                  Should the client report on updates to
                                  callbacks defined in
                                  DEFAULT_UPDATE_CALLBACKS or within the given
                                  updates
  --default-data-url TEXT         Default URL to fetch data from  [default:
                                  (http://localhost:8000/policy-config)]
  --default-data-sources-config-url TEXT
                                  Default URL to fetch data configuration from
                                  [default: http://localhost:7002/data/config]
  --data-topics LIST              Data topics to subscribe to  [default:
                                  policy_data]
  --data-updater-enabled BOOLEAN  If set to False, opal client will not listen
                                  to dynamic data updates. Dynamic data
                                  fetching will be completely disabled.
                                  [default: True]
  --policy-subscription-dirs LIST
                                  Directories in the policy repo to subscribe
                                  to for policy code (rego) modules  [default:
                                  .]
  --wait-on-server-load BOOLEAN   If set, client would wait for 200 from
                                  server's loadlimit endpoint before starting
                                  background tasks
  --client-api-server-port INTEGER
                                  (if run via CLI)  Port for the opal-client's
                                  internal server to bind  [default: 7000]
  --client-api-server-host TEXT   (if run via CLI)  Address for the opal-
                                  client's internal server to bind  [default:
                                  (127.0.0.1)]
  --client-api-server-worker-count INTEGER
                                  (if run via CLI) Worker count for the opal-
                                  client's internal server  [default: 1]
  -t, --client-token TEXT         The authentication token for the OPAL server
                                  [default: (THIS_IS_A_DEV_SECRET)]
  --server-pubsub-url TEXT        The Pub/Sub URL of the OPAL server
                                  [default: ws://localhost:7002/ws]
  --server-ws-url TEXT            The WebSocket URL of the OPAL server
                                  [default: ws://localhost:7002]
  -s, --server-url TEXT           The URL of the OPAL server  [default:
                                  (http://localhost:7002)]
  --keep-alive-interval INTEGER   The interval (in seconds) for sending keep-
                                  alive messages
  --inline-cedar-log-format <ENGINELOGFORMAT>
                                  The log format to use for inline Cedar logs
                                  [default: (none)]
  --inline-cedar-config <CEDARSERVEROPTIONS>
                                  CLI options used when running the Cedar
                                  agent inline
  --inline-cedar-exec-path TEXT   Path to the Cedar Agent executable. Defaults
                                  to searching for 'cedar-agent' binary in
                                  PATH if not specified.
  --inline-cedar-enabled BOOLEAN  Whether or not OPAL should run the Cedar
                                  agent by itself in the same container
                                  [default: True]
  --inline-opa-log-format <ENGINELOGFORMAT>
                                  The log format to use for inline OPA logs
                                  [default: (none)]
  --opa-v0-compat BOOLEAN         Set to true to enable OPA v0 compatibility
                                  mode (--v0-compatible flag). This merges
                                  with INLINE_OPA_CONFIG.v0_compatible - if
                                  either is enabled, the flag will be added to
                                  OPA  [default: True]
  --inline-opa-config <OPASERVEROPTIONS>
                                  CLI options used when running `opa run
                                  --server` inline
  --inline-opa-exec-path TEXT     Path to the OPA executable. Defaults to
                                  searching for 'opa' binary in PATH if not
                                  specified.
  --inline-opa-enabled BOOLEAN    Whether or not OPAL should run OPA by itself
                                  in the same container  [default: True]
  --exclude-policy-store-secrets BOOLEAN
                                  If set, policy store secrets will be
                                  excluded from the /policy-store/config route
  --policy-store-tls-ca TEXT      Path to the file containing the CA
                                  certificate(s) used for TLS authentication
                                  with the policy store
  --policy-store-tls-client-key TEXT
                                  Path to the client key used for TLS
                                  authentication with the policy store
  --policy-store-tls-client-cert TEXT
                                  Path to the client certificate used for TLS
                                  authentication with the policy store
  --policy-updater-enabled BOOLEAN
                                  If set to False, opal client will not listen
                                  to dynamic policy updates.Policy update
                                  fetching will be completely disabled.
                                  [default: True]
  --policy-store-policy-paths-to-ignore LIST
                                  When loading policies manually or otherwise
                                  externally into the policy store, use this
                                  list of glob patterns to have OPAL ignore
                                  and not delete or override them, end paths
                                  (without any wildcards in the middle) with
                                  '/**' to indicate you want all nested under
                                  the path to be ignored
  --data-updater-conn-retry <CONNRETRYOPTIONS>
                                  Retry options when connecting to the base
                                  data source (e.g. an external API server
                                  which returns data snapshot)  [default: wait
                                  _strategy=<WaitStrategy.random_exponential:
                                  'random_exponential'> wait_time=1.0
                                  attempts=5 max_wait=10.0]
  --data-store-conn-retry <CONNRETRYOPTIONS>
                                  DEPRECATED - The old confusing name for
                                  DATA_UPDATER_CONN_RETRY, kept for backwards
                                  compatibility (for now)
  --policy-updater-conn-retry <CONNRETRYOPTIONS>
                                  Retry options when connecting to the policy
                                  source (e.g. the policy bundle server)
                                  [default: wait_strategy=<WaitStrategy.random
                                  _exponential: 'random_exponential'>
                                  wait_time=1.0 attempts=5 max_wait=10.0]
  --policy-store-liveness-probe-timeout-seconds INTEGER
                                  Per-request HTTP timeout (seconds) for
                                  liveness probes against the policy store.
                                  [default: 2]
  --policy-store-liveness-probe-interval-seconds INTEGER
                                  Interval (seconds) between background
                                  liveness probes against the policy store.
                                  [default: 10]
  --policy-store-liveness-probe-enabled BOOLEAN
                                  If True, OPAL client periodically probes the
                                  policy store's health endpoint and factors
                                  the result into /healthy. This makes
                                  /healthy reflect live policy-store
                                  responsiveness, not just the success of the
                                  last server -> policy-store transaction.
                                  [default: True]
  --policy-store-conn-retry <CONNRETRYOPTIONS>
                                  Retry options when connecting to the policy
                                  store (i.e. the agent that handles the
                                  policy, e.g. OPA)
  --policy-store-auth-oauth-client-secret TEXT
                                  The client secret OPAL will use to
                                  authenticate against the OAuth server.
  --policy-store-auth-oauth-client-id TEXT
                                  The client_id OPAL will use to authenticate
                                  against the OAuth server.
  --policy-store-auth-oauth-server TEXT
                                  The authentication server OPAL client will
                                  use to authenticate against for retrieving
                                  the access_token.
  --policy-store-auth-token TEXT  The authentication (bearer) token OPAL
                                  client will use to authenticate against the
                                  policy store (i.e: OPA agent).
  --policy-store-auth-type <POLICYSTOREAUTH>
                                  The authentication type to use for the
                                  policy store (e.g., NONE, TOKEN, etc.)
                                  [default: NONE]
  --policy-store-url TEXT         The URL of the policy store (e.g., OPA
                                  agent).  [default: (http://localhost:8181)]
  --policy-store-type <POLICYSTORETYPES>
                                  The type of policy store to use (e.g., OPA,
                                  Cedar, etc.)  [default: OPA]
  --http-fetcher-timeout FLOAT    The timeout for the httpx or aiohttp fetcher
                                  provider, in seconds. if provided different
                                  value, 5 seconds will be used.  [default: 5]
  --http-fetcher-provider-client TEXT
                                  The client to use for fetching data, can be
                                  either aiohttp or httpx.if provided
                                  different value, aiohttp will be used.
                                  [default: (aiohttp)]
  --enable-datadog-apm BOOLEAN    Set if OPAL server should enable tracing
                                  with datadog APM
  --enable-metrics BOOLEAN        Enable metrics collection
  --policy-repo-policy-extensions LIST
                                  List of extensions to serve as policy
                                  modules  [default: .rego]
  --auth-jwt-issuer TEXT          Issuer for JWT authentication  [default:
                                  (https://opal.ac/)]
  --auth-jwt-audience TEXT        Audience for JWT authentication  [default:
                                  (https://api.opal.ac/v1/)]
  --auth-jwt-algorithm <JWTALGORITHM>
                                  jwt algorithm, possible values: see: https:/
                                  /pyjwt.readthedocs.io/en/stable/algorithms.h
                                  tml  [default: RS256]
  --auth-public-key <UNION>       Public key for authentication
  --auth-public-key-format <ENCRYPTIONKEYFORMAT>
                                  Format of the public key for authentication
                                  [default: (ssh)]
  --client-ssl-context-trusted-ca-file TEXT
                                  A path to your own CA public certificate
                                  file (usually a .crt or a .pem file).
                                  Certificates signed by this issuer will be
                                  trusted by OPAL Client. DO NOT USE THIS IN
                                  PRODUCTION!
  --client-self-signed-certificates-allowed BOOLEAN
                                  Whether or not OPAL Client will trust HTTPs
                                  connections protected by self signed
                                  certificates. DO NOT USE THIS IN PRODUCTION!
  --git-ssh-key-file TEXT         Path to the SSH key file for Git  [default:
                                  (/tmp/.ssh/opal_repo_ssh_key)]
  --fetching-enqueue-timeout INTEGER
                                  Time in seconds to wait for queuing a new
                                  task (if the queue is full)  [default: 10]
  --fetching-callback-timeout INTEGER
                                  Time in seconds to wait on the queued fetch
                                  task  [default: 10]
  --fetching-worker-count INTEGER
                                  Max number of worker tasks handling fetch
                                  events concurrently  [default: 6]
  --fetch-provider-modules LIST   List of modules to load fetch providers from
                                  [default: opal_common.fetcher.providers]
  --statistics-remove-client-channel TEXT
                                  The topic to update about OPAL clients
                                  disconnection  [default: (__opal_stats_rm)]
  --statistics-add-client-channel TEXT
                                  The topic to update about new OPAL clients
                                  connection  [default: (__opal_stats_add)]
  --statistics-enabled BOOLEAN    Set if OPAL server will collect statistics
                                  about OPAL clients may cause a small
                                  performance hit
  --log-file-level TEXT           The log level to show in file  [default:
                                  (INFO)]
  --log-file-serialize TEXT       Serialize log messages in file  [default:
                                  True]
  --log-file-compression TEXT     Log file compression format
  --log-file-retention TEXT       Log file retention time  [default: (10
                                  days)]
  --log-file-rotation TEXT        Log file rotation size  [default: (250 MB)]
  --log-file-path TEXT            path to save log file  [default:
                                  (opal_{time}.log)]
  --log-to-file BOOLEAN           Should we log to a file
  --log-patch-uvicorn-logs BOOLEAN
                                  Should we takeover UVICORN's logs so they
                                  appear in the main logger  [default: True]
  --log-module-include-list LIST  List of modules to include in logging
                                  [default: uvicorn.protocols.http]
  --log-module-exclude-list LIST  List of modules to exclude from logging
                                  [default: uvicorn, opal_client.opa.logger]
  --log-level TEXT                The log level to show  [default: (INFO)]
  --log-show-code-line BOOLEAN    Show code line in log messages  [default:
                                  True]
  --log-pipe-to-stderr BOOLEAN    Should we send logs to stderr? otherwise to
                                  stdout  [default: True]
  --log-serialize BOOLEAN         Serialize log messages
  --log-colorize BOOLEAN          Colorize log messages  [default: True]
  --log-diagnose BOOLEAN          Include diagnosis (local variable values) in
                                  tracebacks. Off by default because loguru
                                  renders raw variable values, which can leak
                                  credentials (e.g. auth headers/tokens) into
                                  logs - only enable for local debugging. Also
                                  gates verbose git SSH protocol tracing
                                  (GIT_TRACE/GIT_CURL_VERBOSE on SSH clones),
                                  which adds noisy protocol/host disclosure to
                                  logs.
  --log-traceback BOOLEAN         Include traceback in log messages  [default:
                                  True]
  --log-format TEXT               The format of the log messages  [default:
                                  <green>{time}</green> | <blue>{name:
                                  <40}</blue>|<level>{level:^6} |
                                  {message}</level> {exception}]
  --log-format-include-pid BOOLEAN
                                  Include process ID in log format
  --allowed-origins LIST          List of allowed origins for CORS  [default:
                                  *]
  --help                          Show this message and exit.

Commands:
  generate-secret
  obtain-token         Obtain a secret JWT (JSON-Web-Token) from the...
  print-config         To test config values, print the configuration...
  publish-data-update  Publish a DataUpdate through an OPAL-server...
  run                  Run the client as a daemon.
  version              Print the OPAL version.