`maqpna infra apply`

Run terraform or tofu apply only once the gateway has approved that exact plan file

Govern-o json | yaml

Synopsis#

maqpna infra apply [--gateway URL] [--session S] [--token-file F] [--wait 30m] [--poll 5s] [--heartbeat 10s] -- terraform|tofu [-chdir=DIR] apply [OPTIONS] PLANFILE

Description#

From the help of maqpna infra:

plan check reads the JSON of a saved plan (terraform show -json PLANFILE > plan.json; "-" reads stdin) and prints each resource change with the attribute paths it touches, the blast-radius tier (0 no change, 1 creates, 2 in-place updates, 3 replaces, deletes and identity/network/DNS/database types, 4 deletes of data-bearing resources or more than 50 changes) and the resources that drove it. Values are shown only with --values, and values the plan marks sensitive never are. With --policy it evaluates infra__apply (server maqpna-infra) against the ToolPolicies as the gateway would, including its default floor (tier 3 and above need approval). Exit code 3 when the decision is deny (or, with --fail-on approval, needs an approval).

apply runs a saved plan under the gateway's governance (gateway.json infra.enabled; token scope tools:maqpna-infra). The plan file is copied to a private directory and hashed; show -json and apply both run on the copy, so the plan that was approved is the plan that is applied. An approval is bound to the plan's SHA-256: re-planning needs a new one. The wrapper refuses an apply without a plan file, planning options (-target, -replace, -var, -destroy, ...) and other subcommands. While the apply runs it polls the gateway every --heartbeat; when the session is revoked (maqpna kill) it interrupts the apply (SIGINT: Terraform stops after the operations in flight). A gateway that cannot be reached blocks the apply before it starts; once started, an unreachable gateway is logged and the apply continues. Exit code 3 when the gateway denies or the kill switch interrupts; otherwise the exit code of the apply.

Gateway, session and token default to $MAQPNA_GATEWAY_URL, $MAQPNA_SESSION and $MAQPNA_TOKEN (or $MAQPNA_TOKEN_FILE).

Flags#

Flag	Type	Description	Default
`--gateway`	string	gateway URL (default $MAQPNA_GATEWAY_URL or the context's gateway)	none
`--heartbeat`	duration	kill-switch polling interval while the apply runs	`10s`
`--poll`	duration	approval polling interval	`5s`
`--session`	string	agent session id	none
`--token-file`	string	file holding the session token (default $MAQPNA_TOKEN)	none
`--wait`	duration	how long to wait for an approval	`30m0s`

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

# Apply a saved plan once the gateway allows it (waits for an approval, honours the kill switch)
$ maqpna infra apply --session sre-1 --token-file .maqpna/token -- terraform apply tfplan
$ maqpna infra apply -- tofu -chdir=envs/prod apply -auto-approve tfplan

What happens when you run it#

Talks to the gateway: --gateway, else MAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context).
--wait: how long to wait for an approval.
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna infra apply