mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-24 01:04:49 -06:00
ce9db831ed
The eval subcommand currently supports a --fail flag that causes the subcommand to exit with a non-zero status when the query result is undefined. While this is useful in some cases, runners often want to see an error message explaining _why_ the exit status is non-zero. Since the query result is undefined, policy authors can't surface information in the result set With these changes, the eval subcommand includes a new --fail-defined flag has the opposite behaviour: exit with non-zero status if the query result is defined/non-empty. This works well for deny lists that are commonly found in admission use cases. Signed-off-by: Torin Sandall <torinsandall@gmail.com>