Claude AI
5155f08584
Some checks failed
PR Checks / tofu-checks (pull_request) Failing after 4s
1/1 projects applied successfully.
- Enable bpg/proxmox provider (~> 0.90) in production environment - Add data source to verify Proxmox connectivity (read nodes) - SOPS-encrypt Proxmox API token (root@pam!tofu) - Custom Atlantis workflow: decrypt SOPS → inject PROXMOX_VE_API_TOKEN - Update all OPA policies for bpg resource types: - proxmox_vm_qemu → proxmox_virtual_environment_vm - proxmox_lxc → proxmox_virtual_environment_container - Adjust field paths (cpu[0].cores, memory[0].dedicated, etc.) - Firewall check: per-network-device instead of top-level - Password check: via after_sensitive for cloud-init - Tags: list of strings instead of comma-separated
30 lines
871 B
Rego
30 lines
871 B
Rego
package main
|
|
|
|
import rego.v1
|
|
|
|
# VMs must not exceed 16 cores
|
|
deny contains msg if {
|
|
some resource in input.resource_changes
|
|
resource.type == "proxmox_virtual_environment_vm"
|
|
resource.change.actions[_] in {"create", "update"}
|
|
to_number(resource.change.after.cpu[0].cores) > 16
|
|
|
|
msg := sprintf(
|
|
"COST: VM '%s' requests %v cores. Maximum 16. File ADR for exception.",
|
|
[resource.address, resource.change.after.cpu[0].cores],
|
|
)
|
|
}
|
|
|
|
# VMs must not exceed 32 GB RAM
|
|
deny contains msg if {
|
|
some resource in input.resource_changes
|
|
resource.type == "proxmox_virtual_environment_vm"
|
|
resource.change.actions[_] in {"create", "update"}
|
|
to_number(resource.change.after.memory[0].dedicated) > 32768
|
|
|
|
msg := sprintf(
|
|
"COST: VM '%s' requests %v MB RAM. Maximum 32768 (32 GB). File ADR for exception.",
|
|
[resource.address, resource.change.after.memory[0].dedicated],
|
|
)
|
|
}
|