samy-dougui / ptf Goto Github PK

The goal would be to able to create local variables (module scoped) as locals in terraform.

Syntax should be like in Terraform:

How to define a local variable

locals {
    foo = bar
}

How to use a local variable

my_rule_attribute = local.foo

Creation of the hcl context

The load of the local variables should be done during the creation of the hcl context as it would be used inside the rule block.

Naming

A "module" (group of policy) of policy should be called a policies

Requirements

• policies should have a source path
• variables should be passed in the block

Design example

policies "azure_container_storage"{
    source = "path/to/policies"
    foo=bar
}

We should also be able to allow wildcard (for example with for_each and count, it creates an address with a list inside).
For example:

address = address_example.[*]

We should be able to filter on the change operation that Terraform wants to do.

It's referring to this attribute of the resource change:

"change": {
        "actions": [
          "no-op"
        ],
}

Should be done after the issue #9 is done.

On every push, to any branch, the CI with the unit tests should be triggered.

When a push is made to main, the end-to-end tests should be done

Current situation

In the condition block, the attribute field allows to select nested attribute,
For example, "metadata.hdi_version" means PTF will be looking for something like

"metadata" : {
    "hdi_version": "value"
}

Desired situation

Sometimes, we have something like:

"blob_properties": [
            {
              "change_feed_enabled": "value",
              "container_delete_retention_policy": [],
              "cors_rule": [],
              "default_service_version": "",
              "delete_retention_policy": [],
              "last_access_time_enabled": "value",
              "versioning_enabled": "value"
            }
],

We should be able to control that by providing the attribute:

blob_properties[int | "*"].cors_rule

A summary after the execution should say:

• the number of policies that passed
• the number of policies that have a warning output
• the number of policies that have a fail output
• the number of policies that are disabled

The documentation should include:

• What is ptf
• How to install it
• How to use it with examples
• How to contribute
• Roadmap

A subcommand should be created to help the user validate the policy files.

The UX should be something like:

ptf validate-config --chdir path 

This command should always ran before the apply to make sure the configuration is valid

The CD pipeline should be triggered when a tag has been pushed to main.
It should create a binary executable on macOS, windows and linux (at least ubuntu and debian).

Every policy can and should be applied in parallel, to diminish the time.