You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/docs/platform-hub/policies/index.md
+33-14Lines changed: 33 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,21 +57,35 @@ To get started, navigate to the Platform Hub inside of your Octopus instance and
57
57

58
58
:::
59
59
60
-
### 2. Give your policy a name
60
+
### 2. Select a starter policy
61
61
62
-
You will be presented with the Create Policy modal. You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Create` button.
62
+
You will be presented with the Create Policy modal. The first step is to select a starter policy to base your new policy on. To continue click the `Next` button.
63
+
64
+
:::figure
65
+

66
+
:::
67
+
68
+
:::div{.hint}
69
+
70
+
If you want to start with the most basic policy, choose Create Blank Policy.
71
+
72
+
:::
73
+
74
+
### 3. Give your policy a name
75
+
76
+
You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Done` button.
63
77
64
78
:::figure
65
79

66
80
:::
67
81
68
82
:::div{.hint}
69
83
70
-
-The slug can not be changed once a policy is created.
84
+
The slug can not be changed once a policy is created.
71
85
72
86
:::
73
87
74
-
### 3. Update your policy details
88
+
### 4. Update your policy details
75
89
76
90
This will create the Policy file in your Platform Hub repository and then take you to the edit Policy page, where you can update the following details for your policy.
77
91
@@ -91,15 +105,13 @@ This will create the Policy file in your Platform Hub repository and then take y
91
105
-```violation_reason``` can be overridden by the value of the ```reason``` property defined in the output result of the conditions Rego code.
92
106
-```violation_action``` can be overridden by the value of the ```action``` property defined in the output result of the conditions Rego code.
93
107
94
-
Full details of output schema is available on the [schema page](/docs/platform-hub/policies/schema).
95
-
96
108
See
97
109
98
110
:::
99
111
100
-
### 4. Define the policy scope
112
+
### 5. Define the policy scope
101
113
102
-
You’ll now need to define the policy's scope, as Rego in the OCL file. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.
114
+
You’ll now need to define the policy's scope, as Rego. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.
Our example applies only to deployments and runbook runs to the production environment for the ACME project, in the default space. **All Rego code has to have a package defined, which is the policy slug.**
126
138
139
+
:::div{.warning}
140
+
141
+
- You cannot rename **evaluate**, it must be called **evaluate**.
142
+
- The package name must be the same as your policy file name.
143
+
144
+
:::
145
+
127
146
```ruby
128
147
package manual_intervention_required
129
148
@@ -135,7 +154,7 @@ evaluate := true if {
135
154
}
136
155
```
137
156
138
-
### 5. Define the policy conditions
157
+
### 6. Define the policy conditions
139
158
140
159
After defining your scope, you must specify the policy rules. These rules are written in Rego. Octopus will check the results of your Rego code to determine if a deployment complies with the policy. The result should contain a composite value with the properties **allowed** and an optional **reason** and **action**. In this example, we will set the default rule result to be non-compliant. Any deployment that does not meet the policy rules will be prevented from executing. This conditions section of the policy defines the package name, which must match the slug for your policy. By default, the policy evaluates to false. The condition will evaluate to true if the deployment contains the required steps.
141
160
@@ -158,7 +177,7 @@ Full details on the data available for policy scoping and conditions can be foun
158
177
159
178
<br>
160
179
161
-
### 6. Check for a deployment step
180
+
### 7. Check for a deployment step
162
181
163
182
After you’ve set the default state, you’ll need to define the policy rules that will update the **result** state to be true so the deployment can execute. In this example, the deployment must contain at least one manual intervention step. We can do this by checking the step.ActionType is “Octopus.Manual”
164
183
@@ -179,15 +198,15 @@ result := {"allowed": true} if {
179
198
180
199
After your policy details have been finalized you will need to commit, publish and activate your policy for it to be available for evaluation.
181
200
182
-
### 7. Saving a Policy
201
+
### 8. Saving a Policy
183
202
184
203
Once you've finished making changes to your policy you can commit them to save the changes to your Git repository. You can either **Commit** with a description or quick commit without one.
185
204
186
205
:::figure
187
206

188
207
:::
189
208
190
-
### 8. Publishing a Policy
209
+
### 9. Publishing a Policy
191
210
192
211
Once you've made your changes, you will have to publish the policy to reflect the changes you've made. You will have three options to choose from when publishing changes:
193
212
@@ -203,7 +222,7 @@ The first time you publish a policy you can only publish a major version
203
222

204
223
:::
205
224
206
-
### 9. Activating a policy
225
+
### 10. Activating a policy
207
226
208
227
You must activate the policy before it can be evaluated. Policies can be deactivated after they are activated to stop a policy from being evaluated.
209
228
@@ -215,7 +234,7 @@ Activation settings can be updated anytime, from the Versions tab on the edit po
215
234

216
235
:::
217
236
218
-
### 10. Finalize and test your policy
237
+
### 11. Finalize and test your policy
219
238
220
239
You’ve now defined a basic policy to ensure a manual intervention step is present when deploying to any environment. You can test this policy by customizing the values in the scope block, and then deploying to an environment. If you choose not to include the manual intervention step in your process, you will see errors in the task log and project dashboards when you try to run the deployment. All policy evaluations will appear in the Audit log (**Configuration** → **Audit**) with the “Compliance Policy Evaluated” event group filter applied. Audit logs and Server Tasks will only appear for deployments within the policy's scope.
0 commit comments