Skip to main content

Governance

Last updated on

Harness Governance enforces Open Policy Agent (OPA) policies across your account. You author policies in Rego, group them into policy sets, and Harness evaluates those sets when a pipeline runs or a resource changes. The CLI lets you manage policies and policy sets as code and review the evaluations that Harness recorded.

This page covers all Governance resources and actions available in the CLI.

What you will learn in this topic​

By the end of this page, you will know how to:

  • List, create, update, and delete OPA policies.
  • Inspect the Rego source of a policy.
  • Group policies into policy sets and control when those sets are evaluated.
  • Review recorded policy evaluations.

Before you begin​

  • Harness CLI installed and authenticated: For setup steps, see Install and upgrade and Authenticate.
  • Scope configured: Governance resources resolve against the scope in your profile. Pass --account, --org, or --project to override it for a single command.
  • Rego knowledge: Policies are written in Rego. For more information about the policy model, see Harness Governance.

Policies​

A policy is a single Rego module that inspects a resource or pipeline payload and returns violations. A policy on its own does nothing until it belongs to a policy set.

List policies​

harness list policy
harness list policy --all --format json
harness list policy --columns "name,id,updated"

Get policy details​

The response includes the Rego source of the policy.

harness get policy <policy_id>
harness get policy <policy_id> --format json

Create a policy​

Supply the name and the Rego source inline, or pass the whole definition in a YAML file.

harness create policy <policy_id> \
  --set name="<policy_name>" \
  --set rego='package main

deny[msg] {
  msg := "<violation_message>"
}'

harness create policy <policy_id> -f <policy_file>.yaml

Update a policy​

Update the name, the Rego source, or both.

harness update policy <policy_id> --set name="<policy_name>"
harness update policy <policy_id> -f <policy_file>.yaml

Delete a policy​

harness delete policy <policy_id>

Policy sets​

A policy set groups policies and binds them to an entity type and an action, which is what makes them run. A set that is not enabled is stored but never evaluated.

List and get policy sets​

harness list policy_set
harness list policy_set --all --format json
harness get policy_set <policy_set_id>

Create a policy set​

The type field names the entity the set applies to, and action names the event that triggers evaluation.

harness create policy_set <policy_set_id> \
  --set name="<policy_set_name>" \
  --set type=pipeline \
  --set action=onrun \
  --set enabled=true

Update a policy set​

Update the name, the enabled state, or the member policies.

harness update policy_set <policy_set_id> --set name="<policy_set_name>"
harness update policy_set <policy_set_id> --set enabled=false

Delete a policy set​

harness delete policy_set <policy_set_id>

Policy evaluations​

Every time Harness evaluates a policy set against a resource it records the result. Use evaluations to audit which policies passed or failed and why.

harness list policy_evaluation
harness list policy_evaluation --all --format json
harness list policy_evaluation --limit 20
  • Audit: Review the audit trail for policy changes.
  • Continuous Delivery: Manage the pipelines that policy sets evaluate.
  • Platform: Manage account resources, connectors, and secrets.
Last updated on