Skip to main content

Configurations

Pack Metadata and Versions

The pack block names and versions a configuration file. With the version and the file fingerprint, you can tell exactly which file a gateway runs, even when two files have the same version.

enabled switches the whole document on or off, including its providers and routes. Keep it true unless you want the gateway to load nothing from the file.

Syntax​

Every config document needs pack with name, version, and enabled. Lint rejects keys that are not in the table below.

policy-config.yaml
pack:
  name: finance-compliance
  version: 2.1.0
  enabled: true

policies:
  chain:
    - audit-logger

policy:
  audit-logger: {}

Fields​

FieldTypeDefaultDescription
namestring, 1 to 200 charactersPack name, stored as pack_name. Required.
versionSemVer stringPack version, stored as config_version. Required.
enabledbooleanMaster switch. false excludes the document. Required.
idstring, 1 to 200 charactersThe name valueIdentifier for API references
authorstring, up to 200 characters""Owner or team of the pack
descriptionstring, up to 2000 characters""What the pack does
tagsmap of stringsTags of the configuration resource

The gateway acts on name, version, and enabled. It stores id, author, description, and tags as metadata.

Examples​

Exclude a pack​

policy-config.yaml
pack:
  name: disabled-pack
  version: 1.0.0
  enabled: false

policies:
  chain:
    - audit-logger

policy:
  audit-logger: {}

The loader registers no chain, routes, providers, callbacks, or test suites from this file. It records local evidence with code pack.excluded and reason pack.enabled=false. To change which pack a gateway uses, deploy a different one. Use enabled: false only when you want nothing from the file.

Read the loaded version and fingerprint​

Before deployment, verdictan gateway check prints both values for a local file:

verdictan gateway check --config policy-config.yaml
Config file: policy-config.yaml (valid)
  Version: 2.1.0
  SHA256:  sha256:...

On a running local gateway, read them from the admin endpoint with a credential that can access it. See verdictan gateway for this access boundary.

curl -fsS http://127.0.0.1:41002/verdictan/config \
  -H "Authorization: Bearer $VERDICTAN_API_TOKEN" \
  | jq '.config.config_version, .config.config_sha256'

Compare both values with the deployment that you expect. A gateway does not reload a changed local file on its own.

Limits and failure behavior​

  • The gateway calculates config_sha256 from the bytes of the file before it parses it. The value has the form sha256:<hex>. Any change, even to a comment or whitespace, gives a new fingerprint.
  • The fingerprint ignores pack.version. Two files with the same version and different content have different fingerprints. Use both values to trace a rollout.
  • Lint rejects a pack without name, version, or enabled, a version that is not SemVer, and any key not in the table.
  • A single-policy document has no pack. It uses policy.name, policy.version, and policy.enabled. See Single-Policy Documents.
  • The tags of a declarative resource come from pack.tags. Change them in the configuration, not with the tag editor in the Console.

Next steps​