Sentinel Policy set connected to VCS is not automatically updated

Avatar
Daniela Lavric
  • Updated

Introduction

Problem

A Sentinel Policy Set has been added from a Github repository (VCS connected) and Terraform Enterprise (TFE) is not updating the policy set to the latest commit available in Github.

Prerequisites

  • TFE application
  • A VCS connected Sentinel policy set

Cause

Broken or unresponsive GitHub webhook preventing commit notifications from reaching Terraform Enterprise.

Prerequisites

  • TFE API Token (with access to read policy sets)

  • Access to your GitHub repository settings

  • Admin/SSH access to the TFE host (for log inspection)

Resolution Steps

🔍 Step 1: Retrieve Webhook URL from TFE

Use the Terraform API to get the policy set’s webhook:

bash
curl --request GET \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/vnd.api+json" \ https://<your-tfe-hostname>/api/v2/policy-sets/polset-<ID>?include=current_version

  • Replace <your-tfe-hostname> with your TFE hostname.

  • Replace polset-<ID> with the policy set ID found in the TFE UI.

  • Use a valid API token for $TOKEN.

In the output, find the line:

json
"webhook-url": "https://<your-tfe-hostname>/webhooks/vcs/2641bdca-09ad-4252-bd9b-fbba8a091dc2"

Copy the UUID at the end of the webhook URL.

🔗 Step 2: Verify Webhook in GitHub

  • Go to your GitHub repository.

  • Navigate to: Settings > Webhooks

  • Confirm a webhook exists that ends in the UUID you copied above.

  • If not present or incorrect, re-add the webhook manually or trigger a VCS re-sync in TFE.

🧾 Step 3: Check Logs for Webhook Requests

For Replicated Deployments:

bash
docker logs tfe-nginx 2>&1 | grep 2641bdca-09ad-4252-bd9b-fbba8a091dc2

 

For FDO Deployments:

bash
docker exec terraform-enterprise-tfe-1 grep 2641bdca-09ad-4252-bd9b-fbba8a091dc2 /var/log/terraform-enterprise/nginx.log

Expected Output:

140.82.115.148 - - [06/Sep/2023:12:33:58 +0000] "POST /webhooks/vcs/... HTTP/1.1" 200 12 "-" "GitHub-Hookshot/..."

If you get no results or a non-200 status:

🔧 Step 4: Troubleshoot Connectivity

  • Firewall/WAF/Proxy: Ensure nothing is blocking GitHub’s webhook POST requests.

  • Certificate Trust: Confirm GitHub trusts the TLS cert on TFE:

bash
curl https://<your_TFE_fqdn>/_health_check

  • A successful response means the cert is trusted and the app is reachable.

✅ Solution

  • If the webhook is missing or incorrect, re-add it in GitHub or trigger a manual sync from the TFE policy set UI.

  • If the webhook is present but not received, check your network and TLS certificate.

🧾 Still Having Issues?

Open a support ticket and include the following:

  • Commit hashes visible in GitHub but not in TFE

  • Webhook URL (from the API response)

  • Output from:

bash
curl https://<your_TFE_fqdn>/_health_check

  • A TFE support bundle (Replicated or FDO)

📚 Additional Resources

Articles in this section

See more

Related articles