Skip to content

Commit 1777d84

Browse files
rberlindrberlind
committed
use version import in use-latest-module-versions.sentinel
1 parent 2356bd2 commit 1777d84

9 files changed

+438
-33
lines changed

‎governance/third-generation/cloud-agnostic/http-examples/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ You can test the first policy from this directory (after forking or cloning the
1818
sentinel test -run=check -verbose
1919
```
2020

21-
The second policy uses the HTTP import to call the Terraform Registry [List Modules API](https://www.terraform.io/docs/registry/api.html#list-modules) against a Terraform Cloud or Terraform Enterprise server in order to determine the most recent version of each module in the [Private Module Registry](https://www.terraform.io/docs/cloud/registry/index.html) (PMR) of an organization on that server or in the [public Terraform registry](https://registry.terraform.io). This policy also uses parameters as described below.
21+
The second policy uses the HTTP import to call the Terraform Registry [List Modules API](https://www.terraform.io/docs/registry/api.html#list-modules) against a Terraform Cloud or Terraform Enterprise server in order to determine the most recent version of each module in the [Private Module Registry](https://www.terraform.io/docs/cloud/registry/index.html) (PMR) of an organization on that server or in the [public Terraform registry](https://registry.terraform.io). It then checks that the version constraints used in module calls allow the most recent version. This policy also uses parameters as described below.
2222

2323
The third policy uses the HTTP import to call a [NASA API](https://api.nasa.gov/) that retrieves a list of Near Earth Objects and warns if any of them are too close for comfort. This is based on an example from this HashiCorp [blog](https://www.hashicorp.com/blog/announcing-business-aware-policies-for-terraform-cloud-and-enterprise/) that announced the HTTP import and "Business-aware Policies". This policy also uses parameters as described below.
2424

@@ -51,7 +51,7 @@ sentinel apply -trace -config=use-latest-module-versions.hcl use-latest-module-v
5151
```
5252
You do not need a token when talking to the public registry, so the use-latest-module-versions.hcl file sets `token` to an empty string.
5353

54-
The policy should fail since the mock does not use the most recent versions of the two modules. If you would like to see the policy pass, change the versions of the modules in mocks/mock-tfconfig-fail.sentinel to the most recent versions listed under https://registry.terraform.io/modules/Azure/network/azurerm and https://registry.terraform.io/modules/Azure/compute/azurerm. Currently, those are "3.2.1" and "3.10.0" respectively.
54+
The policy should fail since the mock does not use or allow the most recent versions of the two modules. If you would like to see the policy pass, change the versions of the modules in mocks/mock-tfconfig-fail.sentinel to the most recent versions listed under https://registry.terraform.io/modules/Azure/network/azurerm and https://registry.terraform.io/modules/Azure/compute/azurerm. Currently, those are "3.3.0" and "3.11.0" respectively.
5555

5656
Note that the `sentinel test` and `sentinel apply` commands for testing/applying the use-latest-module-versions.sentinel policy **really** are making HTTP calls to the API endpoints to retrieve the list of matching modules in the registries. However, the mocks simulate which modules would actually be used by Terraform code.
5757

‎governance/third-generation/cloud-agnostic/http-examples/mocks/mock-tfconfig-fail.sentinel

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ module_calls = {
7373
"module_address": "",
7474
"name": "windowsserver",
7575
"source": "Azure/compute/azurerm",
76-
"version_constraint": "1.1.7",
76+
"version_constraint": ">= 2.0.0, < 3.0.0",
7777
},
7878
}
7979

‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/fail-invalid-version-constraint.hcl

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
param "organization" {
2+
value = "Cloud-Operations"
3+
}
4+
5+
param "token" {
6+
value = ""
7+
}
8+
9+
module "tfconfig-functions" {
10+
source = "../../../../common-functions/tfconfig-functions/tfconfig-functions.sentinel"
11+
}
12+
13+
mock "tfconfig/v2" {
14+
module {
15+
source = "mock-tfconfig-fail-invalid-version-constraint.sentinel"
16+
}
17+
}
18+
19+
test {
20+
rules = {
21+
main = false
22+
}
23+
}

‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/fail.hcl renamed to ‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/fail-invalid-version-number.hcl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ module "tfconfig-functions" {
1212

1313
mock "tfconfig/v2" {
1414
module {
15-
source = "mock-tfconfig-fail.sentinel"
15+
source = "mock-tfconfig-fail-invalid-version-number.sentinel"
1616
}
1717
}
1818

‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/mock-tfconfig-fail-invalid-version-constraint.sentinel

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
import "strings"
2+
3+
module_calls = {
4+
"module.windowsserver:os": {
5+
"config": {
6+
"vm_os_simple": {
7+
"references": [
8+
"var.vm_os_simple",
9+
],
10+
},
11+
},
12+
"count": {},
13+
"for_each": {},
14+
"module_address": "module.windowsserver",
15+
"name": "os",
16+
"source": "./os",
17+
"version_constraint": "",
18+
},
19+
"network": {
20+
"config": {
21+
"allow_ssh_traffic": {
22+
"constant_value": true,
23+
},
24+
"location": {
25+
"references": [
26+
"var.location",
27+
],
28+
},
29+
"resource_group_name": {
30+
"references": [
31+
"var.windows_dns_prefix",
32+
],
33+
},
34+
},
35+
"count": {},
36+
"for_each": {},
37+
"module_address": "",
38+
"name": "network",
39+
"source": "app.terraform.io/Cloud-Operations/network/azurerm",
40+
"version_constraint": ">= 2.0.0, < 3.0.0",
41+
},
42+
"windowsserver": {
43+
"config": {
44+
"admin_password": {
45+
"references": [
46+
"var.admin_password",
47+
],
48+
},
49+
"location": {
50+
"references": [
51+
"var.location",
52+
],
53+
},
54+
"public_ip_dns": {
55+
"references": [
56+
"var.windows_dns_prefix",
57+
],
58+
},
59+
"resource_group_name": {
60+
"references": [
61+
"var.windows_dns_prefix",
62+
],
63+
},
64+
"storage_account_type": {
65+
"references": [
66+
"var.storage_account_type",
67+
],
68+
},
69+
"vm_hostname": {
70+
"constant_value": "demohost",
71+
},
72+
"vm_os_simple": {
73+
"constant_value": "WindowsServer",
74+
},
75+
"vm_size": {
76+
"references": [
77+
"var.vm_size",
78+
],
79+
},
80+
"vnet_subnet_id": {
81+
"references": [
82+
"module.network.vnet_subnets",
83+
],
84+
},
85+
},
86+
"count": {},
87+
"for_each": {},
88+
"module_address": "",
89+
"name": "windowsserver",
90+
"source": "app.terraform.io/Cloud-Operations/compute/azurerm",
91+
"version_constraint": ">= 1.0.0, <= 1.1.5",
92+
},
93+
"module.network:network2": {
94+
"config": {
95+
"allow_ssh_traffic": {
96+
"constant_value": true,
97+
},
98+
"location": {
99+
"references": [
100+
"var.location",
101+
],
102+
},
103+
"resource_group_name": {
104+
"references": [
105+
"var.windows_dns_prefix",
106+
],
107+
},
108+
},
109+
"count": {},
110+
"for_each": {},
111+
"module_address": "module.network",
112+
"name": "network2",
113+
"source": "app.terraform.io/Cloud-Operations/network/azurerm",
114+
"version_constraint": "<= 3.0.0",
115+
},
116+
"module.network:windowsserver2": {
117+
"config": {
118+
"admin_password": {
119+
"references": [
120+
"var.admin_password",
121+
],
122+
},
123+
"location": {
124+
"references": [
125+
"var.location",
126+
],
127+
},
128+
"public_ip_dns": {
129+
"references": [
130+
"var.windows_dns_prefix",
131+
],
132+
},
133+
"resource_group_name": {
134+
"references": [
135+
"var.windows_dns_prefix",
136+
],
137+
},
138+
"storage_account_type": {
139+
"references": [
140+
"var.storage_account_type",
141+
],
142+
},
143+
"vm_hostname": {
144+
"constant_value": "demohost",
145+
},
146+
"vm_os_simple": {
147+
"constant_value": "WindowsServer",
148+
},
149+
"vm_size": {
150+
"references": [
151+
"var.vm_size",
152+
],
153+
},
154+
"vnet_subnet_id": {
155+
"references": [
156+
"module.network.vnet_subnets",
157+
],
158+
},
159+
},
160+
"count": {},
161+
"for_each": {},
162+
"module_address": "module.network",
163+
"name": "windowsserver2",
164+
"source": "app.terraform.io/Cloud-Operations/compute/azurerm",
165+
"version_constraint": "<= 1.1.5",
166+
},
167+
}
168+
169+
strip_index = func(addr) {
170+
s = strings.split(addr, ".")
171+
for s as i, v {
172+
s[i] = strings.split(v, "[")[0]
173+
}
174+
175+
return strings.join(s, ".")
176+
}

‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/mock-tfconfig-fail.sentinel renamed to ‎governance/third-generation/cloud-agnostic/http-examples/test/use-latest-module-versions/mock-tfconfig-fail-invalid-version-number.sentinel

File renamed without changes.

0 commit comments

Comments
 (0)