-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
docs: add clarity and further policy_check examples #1925
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -49,9 +49,36 @@ policies: | |
source: local | ||
``` | ||
|
||
`name` - A name of your policy set. | ||
`path` - Path to a policies directory. | ||
`source` - Tells atlantis where to fetch the policies from. Currently you can only host policies locally by using `local`. | ||
- `name` - A name of your policy set. | ||
- `path` - Path to a policies directory. *Note: replace `<CODE_DIRECTORY>` with absolute dir path to conftest policy/policies.* | ||
- `source` - Tells atlantis where to fetch the policies from. Currently you can only host policies locally by using `local`. | ||
|
||
By default conftest is configured to only run the `main` package. If you wish to run specific/multiple policies consider passing `--namespace` or `--all-namespaces` to conftest with [`extra_args`](https://www.runatlantis.io/docs/custom-workflows.html#adding-extra-arguments-to-terraform-commands) via a custom workflow as shown in the below example. | ||
|
||
Example Server Side Repo configuration using `--all-namespaces` and a local src dir. | ||
|
||
``` | ||
repos: | ||
- id: github.com/myorg/example-repo | ||
policies | ||
owners: | ||
users: | ||
- example-dev | ||
policy_sets: | ||
- name: example-conf-tests | ||
path: /home/atlantis/conftest_policies # Consider seperate vcs & mount into container | ||
source: local | ||
workflows: | ||
custom: | ||
plan: | ||
steps: | ||
- init | ||
- plan | ||
policy_check | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should it not be a There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. good spot |
||
steps: | ||
- policy_check | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Lacks a |
||
extra_args: ["-p /home/atlantis/conftest_policies/", "--all-namespaces"] | ||
``` | ||
|
||
### Step 3: Write the policy | ||
|
||
|
@@ -91,8 +118,4 @@ deny[msg] { | |
|
||
``` | ||
|
||
::: tip Notes | ||
By default conftest is configured to only run the `main` package. If you want to change this behavior [`extra_args`](https://www.runatlantis.io/docs/custom-workflows.html#adding-extra-arguments-to-terraform-commands) can be used to pass in flags to conftest such as `--namespace` or `--all-namespaces` | ||
::: | ||
|
||
That's it! Now your Atlantis instance is configured to run policies on your Terraform plans 🎉 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This one is indented one too much as it's not a part of the owners object?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Correct. I'll put a fix pr together for both.