Skip to content

Add new scope column to policy list

Artur Fedorov requested to merge 432513-policies-policy-scope-new-column into master

What does this MR do and why?

This MR adds new column for policy list.

Policy list has policy scope column

It can display:

  1. Compliance frameworks list (only 2 labels) and +n counter how many hidden
  2. Project excluded from scope (only 2 items) and +n counter how many hidden
  3. Specific projects (only 2 items) and +n counter how many hidden

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Description UI
Group level group level.png
SPP Project spp.png
Project level project.png

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Enable Feature Flag

Feature.enable(:security_policies_policy_scope)
Feature.enable(:security_policies_policy_scope_project)
  1. Go to Settings -> General (on a root group level)

  2. Toggle the Permissions and group features section

  3. Enable Security policy scope

  4. Go to Group

  5. Secure -> Policies -> New policy -> approval policy or execution policy

  6. Create 3 different polices either vie rule mode or yaml mode:

    type: approval_policy
    name: Compliance frameworks
    description: ''
    enabled: true
    policy_scope:
      compliance_frameworks: (use existing compliance frameworks id's)
        - id: 1
        - id: 2
        - id: 3
        - id: 4
    rules:
      - type: scan_finding
        scanners: []
        vulnerabilities_allowed: 0
        severity_levels: []
        vulnerability_states: []
        branch_type: protected
    actions:
      - type: require_approval
        approvals_required: 1
        user_approvers_ids:
          - 1
    approval_settings:
      block_branch_modification: true
      prevent_pushing_and_force_pushing: true
    type: scan_execution_policy
    name: Excluding projects
    description: ''
    enabled: true 
    policy_scope:
      projects:
        excluding: (use existing projects id's from root group)
          - id: 32
          - id: 31
          - id: 30
    rules:
      - type: pipeline
        branches:
          - '*'
    actions:
      - scan: secret_detection
    type: scan_execution_policy
    name: Excluding projects
    description: ''
    enabled: true 
    policy_scope:
      projects:
        including: (use existing projects id's from root group)
          - id: 32
          - id: 31
          - id: 30
    rules:
      - type: pipeline
        branches:
          - '*'
    actions:
      - scan: secret_detection
  7. If you don't have compliance frameworks, go to Root group -> Settings -> General -> Compliance frameworks

  8. Linked Compliance frameworks to projects in Secure -> Compliance center -> Projects

  9. After you created polices go back to policy list and check column scope section

  10. Go to a created security project (group name - Security Policy Project)

  11. Link this SPP project to other 2-3 groups projects:

    Just go to any project or group and link SPP project as SPP:

    1. Screenshot 2024-03-14 at 14.23.13.png
  12. Go back to SPP project -> Secure -> Policies

  13. Create same policies from yaml example and repeat step 6

  14. Go to any regular project a -> Secure -> Policies (it shouldn't be linked to any project or group as SPP)

  15. Repeat step 6

Related to #432513 #441518 (closed)

Edited by Artur Fedorov

Merge request reports