`maqpna policy get`

Show one policy as the gateway has loaded it

Govern-o json | yaml

Synopsis#

maqpna policy get [NS/]NAME [--gateway URL]

Description#

From the help of maqpna policy:

Policy files: ToolPolicy custom resources (YAML or JSON, several per file, or a List) and the operator-rendered policies.json bundle are both accepted. ToolPolicies are rendered with the operator's own renderer (pkg/policyload), so a test evaluates exactly what the gateway would load. A ToolPolicy that the operator would refuse to publish (bad regex, timezone, Cedar, ...) is an error.

Suite mode: policy test DIR runs every maqpna-test.yaml under DIR (FILE runs that suite). A suite is:

  apiVersion: maqpna.com/v1alpha1
  kind: PolicyTest
  name: coder                      # optional
  policies: [../policies/]         # files or dirs, relative to the suite
  defaults: {namespace: team-a, agent: coder, user: alice@acme.eu}
  cases:                           # one tool call each
    - name: prod writes blocked
      server: kubernetes
      tool: delete
      args: {namespace: prod-eu}
      expect: deny
      expectRule: k8s-no-prod-mutations
  tasks: []                        # optional multi-step tasks (maqpna eval format)

Exit status 3 when a case fails (or, with --require-tests, a policy file is not covered by any suite).

Flags#

Flag	Type	Description	Default
`--gateway`	string	gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway)	none
`--oidc-token-file`	string	file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over `--token`	none
`--token`	string	static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass)	none

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

Talks to the gateway: --gateway, else MAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context).
Authenticates to the admin API with the token stored by maqpna login, --oidc-token-file, or a static --token (MAQPNA_ADMIN_TOKEN).
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

Terminal demo#

maqpna policy get.cast

maqpna policy get