Skip to content

Set approval_policy_rule_id for approval rules and license policies

What does this MR do and why?

This MR sets approval_policy_rule_id for approval rules and license policies tables. This is the first step in replacing scan_result_policy_read_id with the new read model.

Currently, we do not store the real policy index from YAML in approval_project_rules & other tables. We take the active policies, check policy scope and store the index from 0. Whereas in security_policies we store both disabled and unscoped policies too, so we need to query security_policies using the real index. This is done in applicable_scan_result_policies_with_real_index

For example, if the policy YAML contains:

approval_policy:
- name: Policy 1
  enabled: true
  ...
- name: Policy 2
  enabled: false
  ...
- name: Policy 3
  enabled: true
  ...
- name: Policy 4
  enabled: true
- name: Policy 5
  enabled: true
  ...

If Policy 3 scope is applicable to a project, then the policy index in approval_project_rules would be: Policy 1 => 0, Policy 4 => 1, Policy 5 => 2. But in security_policies it will be Policy 1 => 0, Policy 2 => 1, Policy 3 => 2, Policy 4 => 3, Policy 5 => 4.

MR acceptance checklist

How to set up and validate locally

  • Enable security_policies_sync and security_policies_sync_group feature flags
  • Create a project and create MR approval policy for the project from Secure -> Policies
  • After the policy is merged, verify that the approval_policy_rule_id are set in approval_project_rules rows
Edited by Sashi Kumar Kumaresan

Merge request reports

Loading