Skip to content

Commit 0111a88

Browse files
AndreZivianiijames-gc
AndreZiviani
authored and
ijames-gc
committed
feat: Disable policy check on some repositories (runatlantis#3503)
* feat: Allow enabling policy check per repository * chore: Tests * chore: Docs * chore: Improve tests * chore: E2E tests
1 parent 88c7a56 commit 0111a88

File tree

61 files changed

+1254
-114
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+1254
-114
lines changed

‎cmd/server.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1086,8 +1086,8 @@ func (s *ServerCmd) deprecationWarnings(userConfig *server.UserConfig) error {
10861086
}
10871087
if userConfig.AllowRepoConfig {
10881088
deprecatedFlags = append(deprecatedFlags, AllowRepoConfigFlag)
1089-
yamlCfg += "\n allowed_overrides: [plan_requirements, apply_requirements, import_requirements, workflow]\n allow_custom_workflows: true"
1090-
jsonCfg += `, "allowed_overrides":["plan_requirements","apply_requirements","import_requirements","workflow"], "allow_custom_workflows":true`
1089+
yamlCfg += "\n allowed_overrides: [plan_requirements, apply_requirements, import_requirements, workflow, policy_check]\n allow_custom_workflows: true"
1090+
jsonCfg += `, "allowed_overrides":["plan_requirements","apply_requirements","import_requirements","workflow", "policy_check"], "allow_custom_workflows":true`
10911091
}
10921092
jsonCfg += "}]}"
10931093

‎runatlantis.io/docs/policy-checking.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ This section will provide a guide on how to get set up with a simple policy that
3838

3939
Enable the workflow using the following server configuration flag `--enable-policy-checks`
4040

41+
::: warning
42+
All repositories will have policy checking enabled.
43+
:::
44+
4145
### Step 2: Define the policy configuration
4246

4347
Policy Configuration is defined in the [server-side repo configuration](https://www.runatlantis.io/docs/server-side-repo-config.html#reference).
@@ -191,3 +195,33 @@ When the policy check workflow runs, a file is created in the working directory
191195
]
192196
193197
```
198+
199+
## Running policy check only on some repositories
200+
201+
When policy checking is enabled it will be enforced on all repositories, in order to disable policy checking on some repositories first [enable policy checks](https://www.runatlantis.io/docs/policy-checking.html#getting-started) and then disable it explicitly on each repository with the `policy_check` flag.
202+
203+
For server side config:
204+
```yml
205+
# repos.yaml
206+
repos:
207+
- id: /.*/
208+
plan_requirements: [approved]
209+
apply_requirements: [approved]
210+
import_requirements: [approved]
211+
- id: /special-repo/
212+
plan_requirements: [approved]
213+
apply_requirements: [approved]
214+
import_requirements: [approved]
215+
policy_check: false
216+
```
217+
218+
For repo level `atlantis.yaml` config:
219+
```yml
220+
version: 3
221+
projects:
222+
- dir: project1
223+
workspace: staging
224+
- dir: project1
225+
workspace: production
226+
policy_check: false
227+
```

‎runatlantis.io/docs/server-side-repo-config.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ repos:
8181
post_workflow_hooks:
8282
- run: my-post-workflow-hook-command arg1
8383

84+
# policy_check defines if policy checking should be enable on this repository.
85+
policy_check: false
86+
8487
# id can also be an exact match.
8588
- id: github.com/myorg/specific-repo
8689

@@ -483,7 +486,8 @@ If you set a workflow with the key `default`, it will override this.
483486
| allowed_workflows | []string | none | no | A list of workflows that `atlantis.yaml` files can select from. |
484487
| allow_custom_workflows | bool | false | no | Whether or not to allow [Custom Workflows](custom-workflows.html). |
485488
| delete_source_branch_on_merge | bool | false | no | Whether or not to delete the source branch on merge. |
486-
| repo_locking | bool | false | no | Whether or not to get a lock |
489+
| repo_locking | bool | false | no | Whether or not to get a lock. |
490+
| policy_check | bool | false | no | Whether or not to run policy checks on this repository. |
487491

488492

489493
:::tip Notes

‎server/controllers/events/events_controller_e2e_test.go‎

Lines changed: 129 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -828,10 +828,14 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
828828
ModifiedFiles []string
829829
// Comments are what our mock user writes to the pull request.
830830
Comments []string
831+
// PolicyCheck is true if we expect Atlantis to run policy checking
832+
PolicyCheck bool
831833
// ExpAutomerge is true if we expect Atlantis to automerge.
832834
ExpAutomerge bool
833835
// ExpAutoplan is true if we expect Atlantis to autoplan.
834836
ExpAutoplan bool
837+
// ExpPolicyChecks is true if we expect Atlantis to execute policy checks
838+
ExpPolicyChecks bool
835839
// ExpQuietPolicyChecks is true if we expect Atlantis to exclude policy check output
836840
// when there's no error
837841
ExpQuietPolicyChecks bool
@@ -846,10 +850,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
846850
ExpReplies [][]string
847851
}{
848852
{
849-
Description: "1 failing policy and 1 passing policy ",
850-
RepoDir: "policy-checks-multi-projects",
851-
ModifiedFiles: []string{"dir1/main.tf,", "dir2/main.tf"},
852-
ExpAutoplan: true,
853+
Description: "1 failing policy and 1 passing policy ",
854+
RepoDir: "policy-checks-multi-projects",
855+
ModifiedFiles: []string{"dir1/main.tf,", "dir2/main.tf"},
856+
PolicyCheck: true,
857+
ExpAutoplan: true,
858+
ExpPolicyChecks: true,
853859
Comments: []string{
854860
"atlantis apply",
855861
},
@@ -861,10 +867,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
861867
},
862868
},
863869
{
864-
Description: "failing policy without policies passing using extra args",
865-
RepoDir: "policy-checks-extra-args",
866-
ModifiedFiles: []string{"main.tf"},
867-
ExpAutoplan: true,
870+
Description: "failing policy without policies passing using extra args",
871+
RepoDir: "policy-checks-extra-args",
872+
ModifiedFiles: []string{"main.tf"},
873+
PolicyCheck: true,
874+
ExpAutoplan: true,
875+
ExpPolicyChecks: true,
868876
Comments: []string{
869877
"atlantis apply",
870878
},
@@ -876,10 +884,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
876884
},
877885
},
878886
{
879-
Description: "failing policy without policies passing",
880-
RepoDir: "policy-checks",
881-
ModifiedFiles: []string{"main.tf"},
882-
ExpAutoplan: true,
887+
Description: "failing policy without policies passing",
888+
RepoDir: "policy-checks",
889+
ModifiedFiles: []string{"main.tf"},
890+
PolicyCheck: true,
891+
ExpAutoplan: true,
892+
ExpPolicyChecks: true,
883893
Comments: []string{
884894
"atlantis apply",
885895
},
@@ -906,10 +916,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
906916
},
907917
},
908918
{
909-
Description: "failing policy additional apply requirements specified",
910-
RepoDir: "policy-checks-apply-reqs",
911-
ModifiedFiles: []string{"main.tf"},
912-
ExpAutoplan: true,
919+
Description: "failing policy additional apply requirements specified",
920+
RepoDir: "policy-checks-apply-reqs",
921+
ModifiedFiles: []string{"main.tf"},
922+
PolicyCheck: true,
923+
ExpAutoplan: true,
924+
ExpPolicyChecks: true,
913925
Comments: []string{
914926
"atlantis apply",
915927
},
@@ -921,10 +933,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
921933
},
922934
},
923935
{
924-
Description: "failing policy approved by non owner",
925-
RepoDir: "policy-checks-diff-owner",
926-
ModifiedFiles: []string{"main.tf"},
927-
ExpAutoplan: true,
936+
Description: "failing policy approved by non owner",
937+
RepoDir: "policy-checks-diff-owner",
938+
ModifiedFiles: []string{"main.tf"},
939+
PolicyCheck: true,
940+
ExpAutoplan: true,
941+
ExpPolicyChecks: true,
928942
Comments: []string{
929943
"atlantis approve_policies",
930944
"atlantis apply",
@@ -941,7 +955,9 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
941955
Description: "successful policy checks with quiet flag enabled",
942956
RepoDir: "policy-checks-success-silent",
943957
ModifiedFiles: []string{"main.tf"},
958+
PolicyCheck: true,
944959
ExpAutoplan: true,
960+
ExpPolicyChecks: true,
945961
ExpQuietPolicyChecks: true,
946962
Comments: []string{
947963
"atlantis apply",
@@ -956,7 +972,9 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
956972
Description: "failing policy checks with quiet flag enabled",
957973
RepoDir: "policy-checks",
958974
ModifiedFiles: []string{"main.tf"},
975+
PolicyCheck: true,
959976
ExpAutoplan: true,
977+
ExpPolicyChecks: true,
960978
ExpQuietPolicyChecks: true,
961979
ExpQuietPolicyCheckFailure: true,
962980
Comments: []string{
@@ -970,10 +988,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
970988
},
971989
},
972990
{
973-
Description: "failing policy with approval and policy approval clear",
974-
RepoDir: "policy-checks-clear-approval",
975-
ModifiedFiles: []string{"main.tf"},
976-
ExpAutoplan: true,
991+
Description: "failing policy with approval and policy approval clear",
992+
RepoDir: "policy-checks-clear-approval",
993+
ModifiedFiles: []string{"main.tf"},
994+
PolicyCheck: true,
995+
ExpAutoplan: true,
996+
ExpPolicyChecks: true,
977997
Comments: []string{
978998
"atlantis approve_policies",
979999
"atlantis approve_policies --clear-policy-approval",
@@ -988,6 +1008,86 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
9881008
{"exp-output-merge.txt"},
9891009
},
9901010
},
1011+
{
1012+
Description: "policy checking disabled on specific repo",
1013+
RepoDir: "policy-checks-disabled-repo",
1014+
ModifiedFiles: []string{"main.tf"},
1015+
PolicyCheck: true,
1016+
ExpAutoplan: true,
1017+
ExpPolicyChecks: false,
1018+
Comments: []string{
1019+
"atlantis apply",
1020+
},
1021+
ExpReplies: [][]string{
1022+
{"exp-output-autoplan.txt"},
1023+
{"exp-output-apply.txt"},
1024+
{"exp-output-merge.txt"},
1025+
},
1026+
},
1027+
{
1028+
Description: "policy checking disabled on specific repo server side",
1029+
RepoDir: "policy-checks-disabled-repo-server-side",
1030+
ModifiedFiles: []string{"main.tf"},
1031+
PolicyCheck: true,
1032+
ExpAutoplan: true,
1033+
ExpPolicyChecks: false,
1034+
Comments: []string{
1035+
"atlantis apply",
1036+
},
1037+
ExpReplies: [][]string{
1038+
{"exp-output-autoplan.txt"},
1039+
{"exp-output-apply.txt"},
1040+
{"exp-output-merge.txt"},
1041+
},
1042+
},
1043+
{
1044+
Description: "policy checking enabled on specific repo but disabled globally",
1045+
RepoDir: "policy-checks-enabled-repo",
1046+
ModifiedFiles: []string{"main.tf"},
1047+
PolicyCheck: false,
1048+
ExpAutoplan: true,
1049+
ExpPolicyChecks: false,
1050+
Comments: []string{
1051+
"atlantis apply",
1052+
},
1053+
ExpReplies: [][]string{
1054+
{"exp-output-autoplan.txt"},
1055+
{"exp-output-apply.txt"},
1056+
{"exp-output-merge.txt"},
1057+
},
1058+
},
1059+
{
1060+
Description: "policy checking enabled on specific repo server side but disabled globally",
1061+
RepoDir: "policy-checks-enabled-repo-server-side",
1062+
ModifiedFiles: []string{"main.tf"},
1063+
PolicyCheck: false,
1064+
ExpAutoplan: true,
1065+
ExpPolicyChecks: false,
1066+
Comments: []string{
1067+
"atlantis apply",
1068+
},
1069+
ExpReplies: [][]string{
1070+
{"exp-output-autoplan.txt"},
1071+
{"exp-output-apply.txt"},
1072+
{"exp-output-merge.txt"},
1073+
},
1074+
},
1075+
{
1076+
Description: "policy checking disabled on previous regex match but not on repo",
1077+
RepoDir: "policy-checks-disabled-previous-match",
1078+
ModifiedFiles: []string{"main.tf"},
1079+
PolicyCheck: true,
1080+
ExpAutoplan: true,
1081+
ExpPolicyChecks: false,
1082+
Comments: []string{
1083+
"atlantis apply",
1084+
},
1085+
ExpReplies: [][]string{
1086+
{"exp-output-autoplan.txt"},
1087+
{"exp-output-apply.txt"},
1088+
{"exp-output-merge.txt"},
1089+
},
1090+
},
9911091
}
9921092

9931093
for _, c := range cases {
@@ -996,7 +1096,7 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
9961096

9971097
// reset userConfig
9981098
userConfig = server.UserConfig{}
999-
userConfig.EnablePolicyChecksFlag = true
1099+
userConfig.EnablePolicyChecksFlag = c.PolicyCheck
10001100
userConfig.QuietPolicyChecks = c.ExpQuietPolicyChecks
10011101

10021102
ctrl, vcsClient, githubGetter, atlantisWorkspace := setupE2E(t, c.RepoDir, setupOption{})
@@ -1061,6 +1161,10 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
10611161
}
10621162

10631163
_, _, actReplies, _ := vcsClient.VerifyWasCalled(Times(expNumReplies)).CreateComment(Any[models.Repo](), Any[int](), Any[string](), Any[string]()).GetAllCapturedArguments()
1164+
if !c.ExpPolicyChecks {
1165+
expNumReplies--
1166+
}
1167+
10641168
Assert(t, len(c.ExpReplies) == len(actReplies), "missing expected replies, got %d but expected %d", len(actReplies), len(c.ExpReplies))
10651169
for i, expReply := range c.ExpReplies {
10661170
assertCommentEquals(t, expReply, actReplies[i], c.RepoDir, c.ExpParallel)

‎server/controllers/events/testdata/test-repos/policy-checks-disabled-previous-match/atlantis.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
version: 3
2+
projects:
3+
- dir: .
4+
workspace: default

‎server/controllers/events/testdata/test-repos/policy-checks-disabled-previous-match/exp-output-apply-failed.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Ran Apply for dir: `.` workspace: `default`
2+
3+
**Apply Failed**: All policies must pass for project before running apply.

‎server/controllers/events/testdata/test-repos/policy-checks-disabled-previous-match/exp-output-apply.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Ran Apply for dir: `.` workspace: `default`
2+
3+
```diff
4+
null_resource.simple:
5+
null_resource.simple:
6+
7+
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
8+
9+
Outputs:
10+
11+
workspace = "default"
12+
```

‎server/controllers/events/testdata/test-repos/policy-checks-disabled-previous-match/exp-output-approve-policies.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Approved Policies for 1 projects:
2+
3+
1. dir: `.` workspace: `default`
4+
5+

‎server/controllers/events/testdata/test-repos/policy-checks-disabled-previous-match/exp-output-auto-policy-check.txt‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
Ran Policy Check for dir: `.` workspace: `default`
2+
3+
**Policy Check Failed**: Some policy sets did not pass.
4+
#### Policy Set: `test_policy`
5+
```diff
6+
FAIL - <redacted plan file> - main - WARNING: Null Resource creation is prohibited.
7+
8+
1 test, 0 passed, 0 warnings, 1 failure, 0 exceptions
9+
10+
```
11+
12+
13+
#### Policy Approval Status:
14+
```
15+
policy set: test_policy: requires: 1 approval(s), have: 0.
16+
```
17+
* :heavy_check_mark: To **approve** this project, comment:
18+
* `atlantis approve_policies -d .`
19+
* :put_litter_in_its_place: To **delete** this plan click [here](lock-url)
20+
* :repeat: To re-run policies **plan** this project again by commenting:
21+
* `atlantis plan -d .`
22+
23+
---
24+
* :heavy_check_mark: To **approve** all unapplied plans from this pull request, comment:
25+
* `atlantis approve_policies`
26+
* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:
27+
* `atlantis unlock`
28+
* :repeat: To re-run policies **plan** this project again by commenting:
29+
* `atlantis plan`

0 commit comments

Comments
 (0)