runatlantis / atlantis

Terraform Pull Request Automation
https://www.runatlantis.io
Other
7.75k stars 1.05k forks source link

policy_check: false not working with v0.28.5 #4766

Open spothound opened 2 months ago

spothound commented 2 months ago

Community Note


Overview of the Issue

We've found that there as been added a new feature to atlantis related to contest policies that allows to enable policies only in some repositories or specific directories (by disabling those directories that we don't want to run policies on).

image

See https://github.com/runatlantis/atlantis/pull/3503

we've updated to version v0.28.5 and tried this feature to disable policy checks in all projects (directories) except one (for testing and debugging) but it seems like Atlantis is running policy checks in all directories/projects anyway.

Not sure how to debug and fix it.

Reproduction Steps

We ar running v0.28.5 We have something like this in our atlantis.yaml config in certain repository:

projects:
- name: sandbox
  dir: terraform/sandbox
  workflow: sandbox
  apply_requirements: []
  policy_check: true

- name: staging
  dir: terraform/staging
  workflow: staging
  policy_check: false

The policy checks are being executed in sandbox but also in staging and other projects with policy_check set to false :(

Logs

Nothing interesting in logs

{"level":"info","ts":"2024-07-19T09:30:25.830Z","caller":"server/server.go:184","msg":"Policy Checks are enabled","json":{}}
{"level":"info","ts":"2024-07-19T09:30:26.428Z","caller":"policy/conftest_client.go:153","msg":"failed to get default conftest version. Will attempt request scoped lazy loads DEFAULT_CONFTEST_VERSION not set","json":{}}
...
{"level":"info","ts":"2024-07-19T09:30:26.428Z","caller":"server/server.go:1017","msg":"Atlantis started - listening on port 4141","json":{}}
....

Environment details

Ideas on how to debug or where the failure could be?

Thanks in advance!

AndriiBarabash commented 1 month ago

Probably related to https://github.com/runatlantis/atlantis/issues/4449

TLDR: add allowed_overrides: [policy_check] to your server-side repo config under the desired repo