🌠
Main concepts
🛰
Platforms
Task policy
This feature is deprecated. Using an Approval policy allows you to achieve the same goals in a more flexible and powerful way.
Purpose
Spacelift tasks are a handy feature that allows an arbitrary command to be executed within the context of your fully initialized stack. This feature is designed to make running one-off administrative tasks (eg. resource tainting) safer and more convenient. It can also be an attack vector allowing evil people to do bad things, or simply a footgun allowing well-meaning people to err in a spectacular way.
Enter task policies. The sole purpose of task policies is to prevent certain commands from being executed, to prevent certain groups or individuals from executing any commands, or to prevent certain commands from being executed by certain groups or individuals.
Preventing admins from running tasks using policies can only play an advisory role and should not be considered a safety measure. A bad actor with admin privileges can detach a policy from the stack and run whatever they want. Choose your admins wisely.
Task policies are simple in that they only use a single rule - deny - with a string message. A single match for that rule will prevent a run from being created, with an appropriate API error. Let's see how that works in practice by defining a simple rule and attaching it to a stack:
1
package spacelift
2
3
deny["not in my town, you don't"] { true }
Copied!
And here's the outcome when trying to run a task:
Data input
This is the schema of the data input that each policy request will receive:
1
{
2
"request": {
3
"command": "string - command that the user is trying to execute as task",
4
"remote_ip": "string - IP of the user trying to log in",
5
"timestamp_ns": "number - current Unix timestamp in nanoseconds"
6
},
7
"session": {
8
"admin": "boolean - is the current user a Spacelift admin",
9
"login": "string - GitHub username of the current user",
10
"name": "string - full name of the current user",
11
"teams": ["string - names of org teams the current user is a member of"]
12
},
13
"stack": {
14
"administrative": "boolean - is the stack administrative",
15
"autodeploy": "boolean - is the stack currently set to autodeploy",
16
"branch": "string - tracked branch of the stack",
17
"labels": ["string - list of arbitrary, user-defined selectors"],
18
"locked_by": "optional string - if the stack is locked, this is the name of the user who did it",
19
"name": "string - name of the stack",
20
"namespace": "string - repository namespace, only relevant to GitLab repositories",
21
"project_root": "optional string - project root as set on the Stack, if any",
22
"repository": "string - name of the source GitHub repository",
23
"state": "string - current state of the stack",
24
"terraform_version": "string or null - last Terraform version used to apply changes"
25
}
26
}
Copied!
Helpers
In addition to our global helper functions, we also provide the following helpers for task policies:
request- an alias forinput.request.session- an alias forinput.session.stack- an alias forinput.stack.
Examples
Let's have a look at a few examples to see what you can accomplish with task policies. You've seen one example already - disabling tasks entirely. That's perhaps both heavy-handed and naive given that admins can detach the policy if needed. So let's only block non-admins from running tasks:
1
package spacelift
2
3
deny["only admins can run tasks"] { not input.session.admin }
Copied!
That's still pretty harsh. We could possibly allow writers to run some commands we consider safe - like resource tainting and untainting. Let's try then, and please excuse the regex:
1
package spacelift
2
3
deny[sprintf("command not allowed (%s)", [command])] {
4
command := input.request.command
5
6
not input.session.admin
7
not re_match("^terraform\\s(un)?taint\\s[\\w\\-\\.]*quot;, command)
8
}
Copied!
If you want to keep whitelisting different commands, it may be more elegant to flip the rule logic, create a series of allowed rules, and define one deny rule as
not allowed. Let's have a look at this approach, and while we're at it let's remind everyone not to run anything during the weekend:1
package spacelift
2
3
command := input.request.command
4
5
deny[sprintf("command not allowed (%s)", [command])] { not allowed }
6
7
deny["no tasks on weekends"] {
8
today := time.weekday(input.request.timestamp_ns)
9
weekend := { "Saturday", "Sunday" }
10
11
weekend[today]
12
}
13
14
allowed { input.session.admin }
15
allowed { re_match("^terraform\\s(un)?taint\\s[\\w\\-\\.]*quot;, command) }
16
allowed { re_match("^terraform\\simport\\s[\\w\\-\\.]*quot;, command) }
Copied!
Last modified 1mo ago
Copy link