Skip to content

`maqpna infra plan check`

Check a plan's diff without secrets, its blast-radius tier and the policy decision

Govern-o json | yaml

Synopsis#

maqpna infra plan check PLAN.json [--policy FILE]... [--namespace NS] [--agent NAME] [--tiers FILE] [--values] [--fail-on deny|approval|never] [-o json]

Flags#

Flag	Type	Description	Default
`--agent`	string	agent name (selects the policies)	`agent`
`--fail-on`	string	exit 3 on: deny, approval (deny or require_approval) or never	`deny`
`--namespace`	string	namespace of the agent session (selects the policies)	`default`
`--policy`	string	ToolPolicy or policy bundle file or directory to evaluate infra__apply against (repeatable)	none
`--require-approval-at-tier`	int	the gateway's infra.requireApprovalAtTier (5 = never)	`3`
`--tiers`	string	JSON tier configuration (the gateway's infra.tiers block)	none
`--values`	switch	show before/after values of changed attributes (never sensitive ones)	none

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

# Check a saved plan offline (terraform show -json tfplan > plan.json): diff, tier, policy
$ maqpna infra plan check plan.json --values
$ maqpna infra plan check plan.json --policy policies/ --namespace team-a --agent sre-bot --fail-on approval

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)