> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-continuous-delivery/cd-building-blocks/advanced/cd-governance/harness-governance-quickstart.md).
# Harness Policy As Code quickstart
Learn how to use OPA policies in Harness to enforce governance across your DevOps processes.
Harness Policy As Code provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies. You can use Harness Policy As Code to ensure that Harness entities like Pipelines meet specific compliance requirements when specific events happen (On Save, On Run, etc).
This quickstart shows you how to use Harness OPA integration to enforce Pipeline governance.
This quickstart shows you how to use OPA's Rego policy language to create policies, test them against Pipelines, enforce them when saving and running Pipelines, and review all of the policy evaluations for a Pipeline.
The following steps walk through the process.
## What you will learn from this topic
* How to write and test Rego policies in Harness Policy As Code
* How to create a Policy Set and attach it to pipeline save and run events
* How to observe a pipeline pass and fail a policy evaluation
* How to review policy evaluation history for a pipeline
### Before you begin
* **What you do not need:** this quickstart is only intended to show you how Pipeline governance works, so it uses a simple Pipeline that only contains an Approval stage. You do not need a Kubernetes cluster or other host as a CD deployment target or CI build farm. You do not need a running Harness Delegate.
* Review [Harness Key Concepts](https://developer.harness.io/docs/platform/overview) to establish a general understanding of Harness.
* The [Harness Policy As Code overview](https://developer.harness.io/docs/platform/governance/policy-as-code/harness-governance-overview) provides a concise overview of Harness Policy As Code.
* **New to OPA Policy Authoring?** OPA policies are written in OPA's Rego policy language. This quickstart provides the policy you need, but it is also helpful to have some familiarity with Rego before writing and reading policies.
* **Recommended:** Free online course on Rego from Styra founder and OPA co-creator Tim Hendricks: [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).
* See [Policy Language](https://www.openpolicyagent.org/docs/latest/policy-language/) from OPA. The [Rego Cheatsheet](https://dboles-opa-docs.netlify.app/docs/v0.10.7/rego-cheatsheet/) is also helpful to have on hand.
{% hint style="warning" %}
When you create Policy Sets they are applied to all matching entities (for example, Pipelines). Be careful that you do not create a Policy Set that might impact existing Pipelines unintentionally.
This quickstart creates a new Harness Project and only applies Policy Sets to its Pipelines. Pipelines outside of this Project are not affected.
{% endhint %}
**How does Harness use OPA?**
The Harness OPA server is an OPA server managed by Harness.
In Harness, you add Rego policies to a Policy Set and select the Harness entities for evaluation (e.g. Pipelines). At that point, the policies are configured on the Harness OPA Server via a Kubernetes ConfigMap.
When certain events happen (e.g. saving or running a Pipeline), Harness reaches out to the Harness OPA server to evaluate the action using the Policy Set.
For more details, see [Harness Policy As Code overview](https://developer.harness.io/docs/platform/governance/policy-as-code/harness-governance-overview).
### Create a Project
In your Harness account, click **Home**.
Click **Projects**, and then click **New Project**.
Name the Project **Quickstart**, and click **Save and Continue**.
In **Invite Collaborators**, click **Save and Continue**. You are automatically added as a Project Admin.
Your new Project is created.
Next, add a Pipeline to evaluate later using OPA policies.
### Create a Pipeline
This quickstart uses a very simple Pipeline that only contains an [Approval stage](https://developer.harness.io/docs/platform/approvals/adding-harness-approval-stages).
Open the new Harness Project you created and click **Deployments**.
Click **Pipelines**, and then click **Create a Pipeline**.
Name the Pipeline **Policy Example** and click **Start**.
In Pipeline Studio, click **YAML** to switch to the YAML editor.
Click **Edit YAML**.
Replace the existing YAML with the following YAML:
```
pipeline:
name: Policy Example
identifier: Policy_Example
projectIdentifier: Quickstart
orgIdentifier: default
tags: {}
stages:
- stage:
name: Test
identifier: Test
description: ""
type: Approval
spec:
execution:
steps:
- step:
type: ShellScript
name: Echo
identifier: Echo
spec:
shell: Bash
onDelegate: true
source:
type: Inline
spec:
script: echo "hello"
environmentVariables: []
outputVariables: []
executionTarget: {}
timeout: 10m
tags: {}
```
{% hint style="info" %}
This example uses the **Quickstart** `projectIdentifier` and the **default** `orgIdentifier`. If you are in a different org, you can replace **default** with the current org Id. You can get Ids from the URL in your browser: `.../orgs//projects//...`.
{% endhint %}
Click **Save**. The Pipeline is now saved.
Click **Visual** to see a simple Pipeline with a manual [Approval stage](https://developer.harness.io/docs/platform/approvals/adding-harness-approval-stages) and one [Shell Script](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/utilities/shell-script-step.md) step that echoes `hello`.
Next, create a policy that requires any Pipeline with an Approval stage to also contain an Approval step in that stage.
### Step 2: Create and test a policy
In this step, review a Rego policy, add the policy in Harness, and then test the Pipeline using the policy.
**Review: Rego Policies**
Harness uses the [Rego policy language](https://www.openpolicyagent.org/docs/latest/policy-language/) for defining rules that are evaluated by the OPA engine. You use Rego to answer queries such as "does the Pipeline have an Approval step?" and so on.
Your Harness Pipelines and entities might be created using the Harness UI or YAML, but Rego policies validate the JSON of your Pipelines or other entities.
The following is a simple example:
```
package pipeline
# Deny pipelines that do not have an approval step
# NOTE: Try removing the HarnessApproval step from your input to see the policy fail
deny[msg] {
# Find all stages that are Deployments ...
input.pipeline.stages[i].stage.type == "Approval"
# ... that are not in the set of stages with HarnessApproval steps
not stages_with_approval[i]
# Show a human-friendly error message
msg := sprintf("deployment stage '%s' does not have a HarnessApproval step", [input.pipeline.stages[i].stage.name])
}
# Find the set of stages that contain a HarnessApproval step
stages_with_approval[i] {
input.pipeline.stages[i].stage.spec.execution.steps[_].step.type == "HarnessApproval"
}
```
This policy checks whether a Pipeline has an Approval stage containing Approval steps. If the Pipeline does not, then the policy `deny` is enforced.
The Pipeline fails the policy if:
* `deny` is true.
* `deny` is a non-empty string.
* `deny` is a non-empty array of strings.
The Pipeline passes the policy if:
* `deny` is undefined.
* `deny` is false.
* `deny` is an empty string.
* `deny` is an empty array of strings.
You also must consider severity, but that is discussed later.
**Create the Policy**
In the Harness Project, in **Project Setup**, click **Policies**.
Click **Policies**, and then click **New Policy**.
Name the new policy **Quickstart**, and click **Apply**. The policy editor appears.
In **Library**, in **Sample Policies**, click **Pipeline - Approval**.
The policy appears:
```
package pipeline
# Deny pipelines that do not have an approval step
# NOTE: Try removing the HarnessApproval step from your input to see the policy fail
deny[msg] {
# Find all stages that are Deployments ...
input.pipeline.stages[i].stage.type == "Deployment"
# ... that are not in the set of stages with HarnessApproval steps
not stages_with_approval[i]
# Show a human-friendly error message
msg := sprintf("deployment stage '%s' does not have a HarnessApproval step", [input.pipeline.stages[i].stage.name])
}
# Find the set of stages that contain a HarnessApproval step
stages_with_approval[i] {
input.pipeline.stages[i].stage.spec.execution.steps[_].step.type == "HarnessApproval"
}
```
Click **Use this Sample**.
The policy is selected and sample input is provided.
Edit this policy to test the Pipeline created earlier.
The Pipeline uses an Approval stage, not a Deployment stage, so the policy must be changed.
On line 7 and 13, replace `Deployment` with `Approval`.
```
...
input.pipeline.stages[i].stage.type == "Approval"
...
msg := sprintf("Approval stage '%s' does not have a HarnessApproval step", [input.pipeline.stages[i].stage.name])
```
Now, test the policy using the Pipeline.
**Test the policy against your Pipeline**
In **Input**, delete the sample and paste the YAML for the Pipeline created earlier. You can copy it from earlier in this topic.
Because **Input** only uses JSON and the pasted content is YAML, an error appears, such as `Unexpected token p in JSON at line 1`.
Click the format button (\) to convert the YAML to JSON.
Harness Pipelines can be created in YAML, but Rego evaluates JSON. In the JSON, you can see the Fully Qualified Names (FQNs) of the labels your Rego references.
The input payload contains user `metadata` for the user that initiated the event. Metadata includes roles, groups, etc, and is added to every evaluation automatically. This can be used for policies where you want to evaluate users. Click **Test**.
In **Output**, you can see that the Pipeline failed the policy because it is missing an Approval step.
The Pipeline is fixed later in this quickstart. The important thing is confirming that the policy works.
Click **Save**.
The policy is now tested, but it still needs to be enforced. To enforce a policy, add it to a Policy Set.
### Step 3: Create a Policy Set
OPA evaluates rules using Policy Sets. Policy Sets are groups of related policies. A single policy can be a member of many Policy Sets.
This quickstart creates a Policy Set using the single policy created earlier.
Click **Policy Sets**.
In **Policy Sets**, click **New Policy Set**.
Name the new Policy Set **Quickstart**.
Now, select the Harness entity for the Policy Set, and the event that triggers evaluation.
In **Entity Type that this policy set applies to**, select **Pipeline**.
In **On what event should the policy set be evaluated**, select **On Run**.
Click **Continue**.
Now, select the policies for this Policy Set.
In **Policy to Evaluate**, click **Add Policy**.
In **Select** **Policy**, click **Project Quickstart**, and select the **Quickstart** policy you created.
Be sure to select **Error and exit**.
Click **Apply**.
Click **Finish**. The new Policy Set is listed.
This Policy Set will be evaluated on every Pipeline.
{% hint style="warning" %}
When you create Policy Sets they are applied to all matching entities (for example, Pipelines). Be careful that you do not create a Policy Set that might impact existing Pipelines unintentionally.
{% endhint %}
### Step 4: Evaluate a Pipeline on run
Now that the Policy Set exists, see it in action.
Click **Pipelines** to navigate back to the Pipeline you created earlier. Remember, it does not have an Approval step and it will fail the Policy Set evaluation.
Click **Run**, and then **Run Pipeline**.
The Policy Set is evaluated and the Pipeline execution fails.
In the Pipeline execution, click **Policy Evaluations**.
You can see the Policy Set that failed the Pipeline, and the reason for the failure. Clicking the Policy Set name will take you to the Policy Set.
Fix the Pipeline and try again.
### Step 5: Fix a failed Pipeline and rerun
Open the Pipeline in Pipeline Studio. Click the Pipeline name in the breadcrumbs and click **Pipeline Studio**.
Switch to the YAML editor and click **Edit YAML**.
Add a new line before the `- step:` for the **Shell Script** step.
On the new line, paste the YAML for a [Manual Approval](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/approvals/using-harness-approval-steps-in-cd-stages.md) step:
```
- step:
type: HarnessApproval
name: Approval
identifier: Approval
spec:
approvalMessage: Please review the following information and approve the pipeline progression
includePipelineExecutionHistory: true
approvers:
userGroups:
- account.admin
minimumCount: 1
disallowPipelineExecutor: false
approverInputs: []
timeout: 1d
```
Note the `userGroups` setting. This is the Harness User Group that is allowed to approve this step. You can edit this in the Visual editor if you want to add your User Group(s), but it is not necessary for this quickstart. Click **Save**.
Click **Run**, and then **Run Pipeline**.
The Pipeline runs. It passed the Policy Set successfully.
The new Approval step appears during execution.
Click **Approve** to finish running the Pipeline.
### Step 6: Review policy evaluations
You can review policy evaluations in a few places.
**Review in Pipeline Execution**
On the Pipeline deployment summary (**Execution History**), click **Policy Evaluations**.
You can see Policy Set evaluations listed.
**Review in Governance Overview**
Click **Project Setup**, and then click **Policies**.
Click **Evaluations**.
You can see the evaluation you just performed.
### Summary
In this tutorial, you:
1. Created and tested a Rego policy in Harness.
2. Created a Policy Set from your new policy.
3. Ran a Pipeline that failed a policy evaluation.
4. Ran a Pipeline that passed a policy evaluation.
5. Reviewed policy evaluations for a Pipeline.
## Next steps
* [Harness Policy As Code overview](/continuous-delivery/use-continuous-delivery/cd-building-blocks/advanced/cd-governance/harness-governance-overview.md)
* [OPA policies for CD entities](/continuous-delivery/use-continuous-delivery/cd-building-blocks/advanced/cd-governance/opa-policies-for-cd-entities.md)
* [Add a governance policy step to a pipeline](/continuous-delivery/use-continuous-delivery/cd-building-blocks/advanced/cd-governance/add-a-governance-policy-step-to-a-pipeline.md)
{% @harness-feedback/feedback %}