Do not remove policy.yaml file

oslo.policy can not handle policy file removal. As a result, if policy
overrides were defined at some point, but then removed, causes service
outage.

While we could add a handler trigger to restart the service
on policy removal, it's better to simplify the logic and always place an
empty policy.yaml even if no overrides are defined.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/966404
Change-Id: Iacd1ae95ff35e7af2c637f0316bbf5d0cf2eafa8
Signed-off-by: Dmitriy Rabotyagov <dmitriy.rabotyagov@cleura.com>
This commit is contained in:
Dmitriy Rabotyagov
2025-11-14 11:44:04 +01:00
parent 0f27b4b742
commit 7e14800777

View File

@@ -39,7 +39,7 @@
notify:
- Restart uWSGI
- name: Implement policy.yaml if there are overrides configured
- name: Place policy.yaml file
openstack.config_template.config_template:
content: "{{ keystone_policy_overrides }}"
dest: "/etc/keystone/policy.yaml"
@@ -47,17 +47,6 @@
group: "{{ keystone_system_group_name }}"
mode: "0640"
config_type: yaml
when:
- keystone_policy_overrides | length > 0
tags:
- keystone-policy-override
- name: Remove legacy policy.yaml file
ansible.builtin.file:
path: "/etc/keystone/policy.yaml"
state: absent
when:
- keystone_policy_overrides | length == 0
tags:
- keystone-policy-override