Preserve instance ownership
Allow new owner labels but reject changing or removing an existing owner.
Existing owner labels cannot be changed or removed.
apiVersion: atmos/v1
kind: Policy
metadata:
name: affected-protect-owner-label
description: Preserve existing instance ownership while allowing new owner labels.
spec:
policies:
preserve-owner:
on: atmos.affected
rule: >-
input.instances.exists(i,
has(i.before) && has(i.before.metadata) && i.before.metadata != null &&
has(i.before.metadata.labels) && i.before.metadata.labels != null &&
has(i.before.metadata.labels.owner) &&
(!has(i.after) || !has(i.after.metadata) || i.after.metadata == null ||
!has(i.after.metadata.labels) || i.after.metadata.labels == null ||
!has(i.after.metadata.labels.owner) ||
i.before.metadata.labels.owner != i.after.metadata.labels.owner))
action: deny
reason: Existing owner labels cannot be changed or removed.
1 Configure
None. Change owner in the expression to protect a different label.
Run affected analysis against clean, committed worktrees. The policy runs before stack, tag, label, and output filtering. It does not automatically run on commands without affected analysis. Protect discovery settings and load this policy from a governing revision in CI; a policy removed from the candidate directory cannot enforce its own preservation.
2 Save
Save the CEL policy as policy.d/affected-protect-owner-label.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
atmos describe affected --base origin/main
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
