Skip to content

Commit fd699cb

Browse files
authored
Add new getting started step for starter policies (#3063)
1 parent 26a2b05 commit fd699cb

8 files changed

Lines changed: 34 additions & 14 deletions

File tree

26.4 KB
Loading
68.9 KB
Loading
11.5 KB
Loading
142 KB
Loading
-15 KB
Loading
162 KB
Loading
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"width":2243,"height":1525,"updated":"2026-03-12T05:35:40.110Z"}

src/pages/docs/platform-hub/policies/index.md

Lines changed: 33 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -57,21 +57,35 @@ To get started, navigate to the Platform Hub inside of your Octopus instance and
5757
![A empty policies list in the Platform Hub](/docs/img/platform-hub/policies/policies-getting-started.png)
5858
:::
5959

60-
### 2. Give your policy a name
60+
### 2. Select a starter policy
6161

62-
You will be presented with the Create Policy modal. You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Create` button.
62+
You will be presented with the Create Policy modal. The first step is to select a starter policy to base your new policy on. To continue click the `Next` button.
63+
64+
:::figure
65+
![A modal to select a starter policy](/docs/img/platform-hub/policies/policies-create-starter-modal.png)
66+
:::
67+
68+
:::div{.hint}
69+
70+
If you want to start with the most basic policy, choose Create Blank Policy.
71+
72+
:::
73+
74+
### 3. Give your policy a name
75+
76+
You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Done` button.
6377

6478
:::figure
6579
![A modal to create a new policy](/docs/img/platform-hub/policies/policies-create-modal.png)
6680
:::
6781

6882
:::div{.hint}
6983

70-
- The slug can not be changed once a policy is created.
84+
The slug can not be changed once a policy is created.
7185

7286
:::
7387

74-
### 3. Update your policy details
88+
### 4. Update your policy details
7589

7690
This will create the Policy file in your Platform Hub repository and then take you to the edit Policy page, where you can update the following details for your policy.
7791

@@ -91,15 +105,13 @@ This will create the Policy file in your Platform Hub repository and then take y
91105
- ```violation_reason``` can be overridden by the value of the ```reason``` property defined in the output result of the conditions Rego code.
92106
- ```violation_action``` can be overridden by the value of the ```action``` property defined in the output result of the conditions Rego code.
93107

94-
Full details of output schema is available on the [schema page](/docs/platform-hub/policies/schema).
95-
96108
See
97109

98110
:::
99111

100-
### 4. Define the policy scope
112+
### 5. Define the policy scope
101113

102-
You’ll now need to define the policy's scope, as Rego in the OCL file. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.
114+
You’ll now need to define the policy's scope, as Rego. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.
103115

104116
<br>
105117

@@ -124,6 +136,13 @@ input.Environment.Name = "Development"
124136

125137
Our example applies only to deployments and runbook runs to the production environment for the ACME project, in the default space. **All Rego code has to have a package defined, which is the policy slug.**
126138

139+
:::div{.warning}
140+
141+
- You cannot rename **evaluate**, it must be called **evaluate**.
142+
- The package name must be the same as your policy file name.
143+
144+
:::
145+
127146
```ruby
128147
package manual_intervention_required
129148

@@ -135,7 +154,7 @@ evaluate := true if {
135154
}
136155
```
137156

138-
### 5. Define the policy conditions
157+
### 6. Define the policy conditions
139158

140159
After defining your scope, you must specify the policy rules. These rules are written in Rego. Octopus will check the results of your Rego code to determine if a deployment complies with the policy. The result should contain a composite value with the properties **allowed** and an optional **reason** and **action**. In this example, we will set the default rule result to be non-compliant. Any deployment that does not meet the policy rules will be prevented from executing. This conditions section of the policy defines the package name, which must match the slug for your policy. By default, the policy evaluates to false. The condition will evaluate to true if the deployment contains the required steps.
141160

@@ -158,7 +177,7 @@ Full details on the data available for policy scoping and conditions can be foun
158177

159178
<br>
160179

161-
### 6. Check for a deployment step
180+
### 7. Check for a deployment step
162181

163182
After you’ve set the default state, you’ll need to define the policy rules that will update the **result** state to be true so the deployment can execute. In this example, the deployment must contain at least one manual intervention step. We can do this by checking the step.ActionType is “Octopus.Manual”
164183

@@ -179,15 +198,15 @@ result := {"allowed": true} if {
179198

180199
After your policy details have been finalized you will need to commit, publish and activate your policy for it to be available for evaluation.
181200

182-
### 7. Saving a Policy
201+
### 8. Saving a Policy
183202

184203
Once you've finished making changes to your policy you can commit them to save the changes to your Git repository. You can either **Commit** with a description or quick commit without one.
185204

186205
:::figure
187206
![The commit experience for a policy](/docs/img/platform-hub/policies/policies-commit-experience.png)
188207
:::
189208

190-
### 8. Publishing a Policy
209+
### 9. Publishing a Policy
191210

192211
Once you've made your changes, you will have to publish the policy to reflect the changes you've made. You will have three options to choose from when publishing changes:
193212

@@ -203,7 +222,7 @@ The first time you publish a policy you can only publish a major version
203222
![Publish experience for a policy](/docs/img/platform-hub/policies/policies-publishing.png)
204223
:::
205224

206-
### 9. Activating a policy
225+
### 10. Activating a policy
207226

208227
You must activate the policy before it can be evaluated. Policies can be deactivated after they are activated to stop a policy from being evaluated.
209228

@@ -215,7 +234,7 @@ Activation settings can be updated anytime, from the Versions tab on the edit po
215234
![Activation status for a policy](/docs/img/platform-hub/policies/policies-activation.png)
216235
:::
217236

218-
### 10. Finalize and test your policy
237+
### 11. Finalize and test your policy
219238

220239
You’ve now defined a basic policy to ensure a manual intervention step is present when deploying to any environment. You can test this policy by customizing the values in the scope block, and then deploying to an environment. If you choose not to include the manual intervention step in your process, you will see errors in the task log and project dashboards when you try to run the deployment. All policy evaluations will appear in the Audit log (**Configuration****Audit**) with the “Compliance Policy Evaluated” event group filter applied. Audit logs and Server Tasks will only appear for deployments within the policy's scope.
221240

0 commit comments

Comments
 (0)