Hello! - Is it possible to configure the GitOps wo...
# permit-saas
t
Hello! - Is it possible to configure the GitOps workflow for multiple projects against a single git repository? Ideally we'd like to have a single repo containing policies for all teams / services, so we can standardise PR checks / workflows across our org, and for ease of auditing. I think we can do this by configuring a different main branch for each project, though ideally, it'd be great if every project could branch from
main
and read policies from a given directory. e.g.
Copy code
project_a/
├─ permit/
│  ├─ root.rego
├─ custom/
│  ├─ root.rego
project_b/
├─ permit/
│  ├─ root.rego
├─ custom/
│  ├─ root.rego
a
Hi @Toby Aurelius, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Based on the available documentation, Permit.io's GitOps workflow follows a specific repository structure where ​*each repository is mapped to a specific Permit project, and branches are created and mapped for each Permit environment*​ (1) . When you configure GitOps, Permit creates environment branches following the format
permit/generated/<env_id>
where
<env_id>
is the unique identifier for each environment (2) . The repository structure for each environment branch looks like this:
Copy code
repo/
├── main (initial branch)
└── permit/generated/{env-id}/ (environment branch)
    ├── root.rego
    ├── rbac.rego
    ├── abac.rego
    ├── permit/
    │   └── root.rego
    └── custom/
        └── root.rego
(3) The documentation indicates that ​*by default, each repository is mapped to a specific Permit project*​ (2) . However, the policy code can be nested in different folders within the repository (4) . For your use case of having multiple projects in a single repository with different directories, the documentation doesn't explicitly describe this configuration. Your suggested approach of using ​*different main branches for each project*​ aligns with how the system works - you can specify a
main_branch_name
when configuring the repository (2) . You can also customize the branch name by setting the
custom_branch_name
of your environment . To explore whether directory-based separation is possible for your specific setup, I'd recommend reaching out over Email to discuss your multi-project, single-repository requirements in detail. **
To learn more, see the sources I considered: [[1] Modeling and Implementation Components](https://docs.permit.io/how-to/SDLC/modeling-implementation-components) [[2] Git and Permit](https://docs.permit.io/integrations/gitops/github) [[3] GitOps: Role assignments remain "pending" and never sync to PDP](https://github.com/permitio/opal/issues/876) [[4] GitOps Overview](https://docs.permit.io/integrations/gitops/overview)
d
Hi @Toby Aurelius,You're right that each repo in our GitOps setup is mapped to a single Permit project, and within that repo we auto-manage per-environment branches (
permit/generated/<env_id>
). The directory-based layout you sketched out — where a single
main
holds
project_a/
,
project_b/
, etc., and each project reads from its own folder — isn't something the integration supports today. There's no path/subdirectory selector in the project's GitOps config, so projects can't be scoped to a folder within a shared branch. The branch-per-project approach you already identified is the right workaround and is fully supported. You'd configure each project with its own
main_branch_name
(e.g.
project-a-main
,
project-b-main
) all pointing at the same repo. That gets you most of what you're after. @Thomas, can you shed any light?
🙌 1
t
Hey @Toby Aurelius, our GitOps integration does not work this way. A repo is tied to a project in Permit and then any environment within that project ends up as a branch within that repo.
t
understood, thank you both