Skip to content

Commit

Permalink
Add clarity + further policy_check examples to docs
Browse files Browse the repository at this point in the history
  • Loading branch information
david-heward-unmind committed Nov 30, 2021
1 parent f4314e2 commit fd0b748
Showing 1 changed file with 30 additions and 7 deletions.
37 changes: 30 additions & 7 deletions runatlantis.io/docs/policy-checking.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,36 @@ policies:
source: local
```

`name` - A name of your policy set.
`path` - Path to a policies directory.
`source` - Tells atlantis where to fetch the policies from. Currently you can only host policies locally by using `local`.
- `name` - A name of your policy set.
- `path` - Path to a policies directory. *Note: replace `<CODE_DIRECTORY>` with absolute dir path to conftest policy/policies.*
- `source` - Tells atlantis where to fetch the policies from. Currently you can only host policies locally by using `local`.

By default conftest is configured to only run the `main` package. If you wish to run specific/multiple policies consider passing `--namespace` or `--all-namespaces` to conftest [`extra_args`](https://www.runatlantis.io/docs/custom-workflows.html#adding-extra-arguments-to-terraform-commands).

Example Server Side Repo configuration using `--all-namespaces` and a local src dir.

```
repos:
- id: github.com/myorg/example-repo
policies
owners:
users:
- example-dev
policy_sets:
- name: example-conf-tests
path: /home/atlantis/conftest_policies # Consider seperate vcs & mount into container
source: local
workflows:
custom:
plan:
steps:
- init
- plan
policy_check
steps:
- policy_check
extra_args: ["-p /home/atlantis/conftest_policies/", "--all-namespaces"]
```

### Step 3: Write the policy

Expand Down Expand Up @@ -91,8 +118,4 @@ deny[msg] {
```

::: tip Notes
By default conftest is configured to only run the `main` package. If you want to change this behavior [`extra_args`](https://www.runatlantis.io/docs/custom-workflows.html#adding-extra-arguments-to-terraform-commands) can be used to pass in flags to conftest such as `--namespace` or `--all-namespaces`
:::

That's it! Now your Atlantis instance is configured to run policies on your Terraform plans 🎉

0 comments on commit fd0b748

Please sign in to comment.