GitOps commands in the Permit CLI
Connect a GitHub repository to a Permit.io environment and clone the policy code that Permit writes to the repository, with the permit gitops commands. This reference is for developers who manage their policy as code in Git, or extend the generated policy with custom Rego.
Before you use these commands, install the Permit CLI and sign in with permit login. See Install and use the Permit CLI. For how GitOps works in Permit, see GitOps overview.
Sync policies to a Git repository
permit gitops create github
permit gitops create github starts a wizard that connects a GitHub repository to your Permit environment. The wizard runs these steps:
- Asks you to select a project.
- Asks for a repository key, which names the repository configuration in Permit.
- Generates an SSH key pair and copies the public key to your clipboard.
- Asks you to add the public key as a deploy key of the repository at
https://github.com/<organization>/<repository>/settings/keys/new, then asks for the repository's SSH URL. - Asks for the branch name.
- Saves the configuration in Permit.
| Flag | Alias | Default | Description |
|---|---|---|---|
--inactive | -i | Not set | Saves the configuration without activating the repository after Permit validates the repository. |
--api-key <string> | -k | Stored credentials | An API key of the project or organization. |
Connect a repository and leave it inactive:
$ permit gitops create github --inactive
Without --inactive, the CLI prints that GitOps is configured and activates once Permit validates the repository. With --inactive, the CLI prints that GitOps is configured, and you activate the repository later. For the repository setup and deploy key steps in GitHub, see GitOps with GitHub.
permit gitops env clone
permit gitops env clone runs git clone on the policy repository of the active GitOps configuration. By default, the CLI lists the environments of the project, and clones the branch of the environment you select. With --project, the CLI clones the whole repository with every branch.
| Flag | Default | Description |
|---|---|---|
--project | Not set | Clones the whole repository instead of one environment branch. |
--dry-run | false | Prints the git clone command without running it. |
--api-key <string> | Stored credentials | A project API key. |
For one environment, the CLI clones only the permit/generated/<environment-id> branch. To see the git clone command before the CLI runs it, pass --dry-run. When the clone finishes, the CLI prints a success message, and the repository is in a new directory under your current directory.
Extend the generated policy with custom Rego
After you clone the policy repository, you can add custom Open Policy Agent (OPA) Rego rules to the generated policy. For the files to change and a worked example, see Write a custom policy with GitOps.
To print the policies that a running OPA server has loaded, use permit opa policy.