COMPLYCTL-PROVIDER-OPA(1)

💅 complyctl-provider-opa — the manual page (General Commands Manual, bestie)

okay so welcome to the complyctl-provider-opa man page, girlies 🎀 this is a General Commands Manual entry and honestly it's giving "quietly doing the most important work in the background" energy. let's get into it 💖

---

✨ NAME ✨

complyctl-provider-opa — the OPA/Conftest scanning provider for complyctl 🦋

---

✨ SYNOPSIS ✨

complyctl-provider-opa

yep that's it. no flags. no args. nothing. she runs herself 💅

---

✨ DESCRIPTION ✨

so complyctl-provider-opa is a gRPC plugin for complyctl(1) that brings the compliance-scanning capabilities using the Open Policy Agent (OPA) engine, by way of Conftest 🔥

heads up bestie: you do NOT run this yourself. like, ever. complyctl discovers it and launches it automatically once the provider is installed. it's a backstage main character, not a front-of-house one 👑

what happens: the provider gets assessment configurations handed to it from complyctl, and then it evaluates configuration files and infrastructure-as-code against Rego policies using the conftest CLI tool. it supports both remote git repositories and local filesystem paths as scan targets, and it loads policy bundles from OCI registries or from cached complypack content ✨

the chit-chat with complyctl goes through the hashicorp/go-plugin gRPC interface, and it implements three RPCs, and yes you're gonna memorize them:

• Describe
• Generate
• Scan

three of them. iconic. periodt 🌸

---

✨ CONFIGURATION ✨

configuration comes in through variables defined in assessment plan targets. these variables get passed to the provider via complyctl and are not set manually by you, so don't come for me, it's not your job 🙈

• url (optional, mutually exclusive with input_path) — HTTPS URL of a git repository to clone and scan. you must provide one of url or input_path per target. example: https://github.com/org/repo
• input_path (optional, mutually exclusive with url) — local filesystem path to scan. it must exist and it must not contain path traversal sequences (../). again, one of url or input_path must be provided per target.
• branches (optional) — comma-separated list of branches to scan for remote repositories. must match the pattern [a-zA-Z0-9._/-]+. path traversal sequences are rejected. default: main
• access_token (optional) — authentication token for cloning private git repositories. it's used as the password in git credential helper configuration. it gets rejected if it contains newlines or null bytes 💀
• scan_path (optional) — subdirectory within the cloned repository to scan. path traversal sequences (../) are rejected. default: root of the cloned repository.
• platform (optional) — platform hint for self-hosted git instances (e.g., github, gitlab). it affects the credential username — oauth2 for GitLab, x-access-token otherwise. default: auto-detected from the URL hostname 🔍
• opa_bundle_ref (required when no complypack is available) — OCI reference for a Conftest policy bundle. used to pull policies via conftest pull when no complypack content path is set by complyctl. example: oci://ghcr.io/org/policies:v1

⚠️ important bestie: the OCI policy bundle must include a complytime-mapping.json file that maps requirement IDs to Rego namespaces. if that file is missing, the provider returns an error. no mapping, no vibes, no scan 😭

---

✨ ENVIRONMENT ✨

• COMPLYTIME_MACHINE_ID_FILE — path to the machine-id file used for host identification in evidence remarks. the file content gets included in each Evidence.Source.Remarks field alongside the hostname, so auditors can figure out which host the scan was executed on. default: /etc/machine-id 🫶

---

✨ EXTERNAL TOOLS ✨

needs these bad boys at runtime, no skips:

• conftest — the Open Policy Agent test runner for structured data. not currently packaged in Fedora, so you have to install it separately, sorry babe. see: https://www.conftest.dev
• git — required for cloning remote repositories when url is specified. provided by the git Fedora package ✨

---

✨ FILES ✨

• .complytime/opa/ — the provider workspace directory. and listen, all paths below are relative to the current working directory, not the workspace, okay? iykyk 👑
• .complytime/opa/results/<target>-<branch>.json — per-target result JSON summarizing conftest findings for a single target and branch combo. for local targets, the branch component is omitted.
• .complytime/opa/generated/<content-key>/scan-config.json — scan configuration written by the Generate RPC. records matched requirement IDs, the Rego-to-Gemara reverse mapping, and the resolved policy directory path.
• .complytime/opa/generated/generate-index.json — maps each generated target to its content-keyed scan configuration 🗂️
• .complytime/opa/generated/complytime-mapping.json — the mapping file shipped in the OCI policy bundle or complypack. maps Gemara requirement IDs to Rego policy namespaces. required for requirement-scoped evaluation 💅
• .complytime/opa/repos/ — directory for cloned git repositories when url targets are used. each repository gets cloned into a subdirectory named by the sanitized URL and branch.
• .complytime/opa/policy/ — directory for downloaded OPA policy bundles (from OCI registries or complypack content) 📦

---

✨ EVIDENCE ✨

the provider records an Evidence entry on each AssessmentLog returned by the Scan RPC. here's the tea ☕

Type

ConftestResult — the conftest evaluation output for the target input path.

Production

the provider invokes conftest test with namespace-scoped policies against the input path (either a cloned repository directory or a local filesystem path). the conftest JSON output is parsed into per-target result files ✨

EvaluationLog representation

each assessment log carries an Evidence entry with:

• Source.Coordinate: the input path evaluated by conftest (e.g., .complytime/opa/repos/<repo>/<branch> or a local filesystem path)
• Source.ReferenceID: conftest-input-<target>[-<branch>]

for regular-file inputs, Source.Digest contains the SHA-256 hash (sha256:<hex>) of the file content at scan time. for directory inputs (cloned repositories), no digest is recorded. that's just how it is bestie 🦋

---

✨ EXIT CODES ✨

this provider is a gRPC subprocess managed by complyctl. exit codes follow the hashicorp/go-plugin protocol and are not user-facing. so like, don't stress about them, they're not for you 💀

---

✨ SEE ALSO ✨

complyctl(1), complyctl-provider-openscap(1), complyctl-provider-ampel(1), conftest(1)

project: https://github.com/complytime/complytime-providers 🌈

---

✨ COPYRIGHT ✨

Apache-2.0

---

✨ AUTHORS ✨

Marcus Burghardt maburgha@redhat.com 👑

---

and that's the whole page bestie 🫶 this was the ComplyTime Manual, dated September 2026, covering COMPLYCTL-PROVIDER-OPA(1). go forth and let the OPA provider cook in the background while you take all the credit 💅✨🎀