定義 JSON 原則檔

這裡提供 JSON 原則檔範例。 將 <...> 位置保留元取代為實際值。

• 要在上執行的代理程式工作是使用 target 區塊來定義。
• 用於選取要在代理程式上執行之工作區或動作的屬性由 parameter 區塊定義。

可以在任何編輯器或 IDE 中編輯原則 JSON 檔案。 它們必須是有效的 JSON。

原則 JSON 檔案語法:

  {
      "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "<agent id>"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [{
          "kind": "workspace",
          "tags": [
            "<user_tag>"
          ],
          "resource_groups": [
            "<resource_group>"
          ],
          "locations": [
            "<region>"
          ]
        }]
      }
    }
  }

範例

  {
      "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent-prod-live.deA.e055"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [{
          "kind": "workspace",
          "tags": [
            "live-prod"
          ],
          "resource_groups": [
            "Default"
          ],
          "locations": [
            "eu-de"
          ]
        }]
      }
    }
  }

建立代理程式原則

範例

ibmcloud schematics policy create --name agent-policy-testing-cli-jan-10 --kind agent_assignment_policy --location eu-de --resource-group Default --target-file policy.json

輸出

Creating policy...
                    
ID               agent-policy-testing-cli-jan-10.deP.c737   
Name             agent-policy-testing-cli-jan-10-27   
Description         
Kind             agent_assignment_policy   
Location         eu-de   
Resource Group   aac37f57b20142dba1a435c70aeb12df   
Target              
Tags             [TAGS]   
                  - workspace-policy:prod

使用 API 建立原則的範例

POST /v2/settings/policies HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer <auth_token>
{
    "name": "policy-1",
    "description": "Policy for job execution of secured workspaces on agent1",
    "resource_group": "Default",
    "tags": [
      "policy:secured-job"
    ],
    "location": "us-south",
    "kind": "agent_assignment_policy",
    "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent5.8442"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [
          {
            "kind": "workspace",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "test"
            ],
            "locations": [
              "us-south"
            ]
          }
        ]
      }
    }
  }

使用 API 取得原則的範例

GET /v2/settings/policies/<your policy_id> HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
X-ENABLE-POLICIES: true
Authorization: Bearer <auth_token>

使用 API 更新原則的範例

PATCH /v2/settings/policies/<your policy_id> HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
X-ENABLE-POLICIES: true
Authorization: Bearer <auth_token>
{
    "name": "policy-1",
    "description": "updated Policy for job execution of secured workspaces on agent1",
    "resource_group": "Default",
    "tags": [
      "policy:secured-job"
    ],
    "location": "us-south",
    "kind": "agent_assignment_policy",
    "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent5.13a6"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [
          {
            "kind": "action",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "dummy_resource_group"
            ],
            "locations": [
              "us-south"
            ]
          }
        ]
      }
    }
  }

使用 API 尋找原則的範例

POST /v2/settings/policies/search HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer <auth_token>
{
   "parameter": {
            "kind": "workspace",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "test"
            ],
            "locations": [
              "us-south"
            ]
          },
    "target": "action"
  }

您現在可以使用代理程式來執行 Schematics Terraform 或 Ansible 工作。 代理程式會執行符合已定義選取原則參數之工作區或動作的任何工作:

• 資源群組
• 位置
• 標籤

請注意，必須在工作區或動作建立時間設定標籤。 透過 Schematics 使用者介面所進行的任何標籤變更，在政策評估過程中均不會被偵測或納入考量。

執行之後，工作區或動作工作日誌包含一個標頭，指出在其上執行工作的代理程式。

2023/04/08 15:22:07 -----  New Workspace Action  -----
2023/04/08 15:22:07 Request: activitId=e3fcfdfdb13b07a1c60176e4b95c41ba, account=, owner=steve_strutt@uk.ibm.com, requestID=0a8a3428-b461-4dd0-8104-e859d68d35f6, OrchestratorID=orchestrator-5c8585dc74-6z9s5, agentID=agent-test-da.deA.e055, agentName=agent-test-da, jobRunnerID=jobrunner-5d99b5cfb7-p5xcz
2023/04/08 15:22:07 Related Workspace: name=myworkspace, agentID=agent-test-da.deA.e055 sourcerelease=(not specified), sourceurl=https://github.com/stevestrutt/multitier-vpc-bastion-host, branch=(not specified), folder=.
2023/04/08 15:22:07  --- Ready to execute the command on Agent agent-test-da.deA.e055 ---