Do not remove policy.yaml file
oslo.policy can not handle policy file removal. As a result, if policy overrides were defined at some point, but then removed, causes service outage. While we could add a handler trigger to restart the service on policy removal, it's better to simplify the logic and always place an empty policy.yaml even if no overrides are defined. Depends-On: https://review.opendev.org/c/openstack/ansible-role-python_venv_build/+/966404 Change-Id: Iacd1ae95ff35e7af2c637f0316bbf5d0cf2eafa8 Signed-off-by: Dmitriy Rabotyagov <dmitriy.rabotyagov@cleura.com>
This commit is contained in:
@@ -39,7 +39,7 @@
|
||||
notify:
|
||||
- Restart uWSGI
|
||||
|
||||
- name: Implement policy.yaml if there are overrides configured
|
||||
- name: Place policy.yaml file
|
||||
openstack.config_template.config_template:
|
||||
content: "{{ keystone_policy_overrides }}"
|
||||
dest: "/etc/keystone/policy.yaml"
|
||||
@@ -47,17 +47,6 @@
|
||||
group: "{{ keystone_system_group_name }}"
|
||||
mode: "0640"
|
||||
config_type: yaml
|
||||
when:
|
||||
- keystone_policy_overrides | length > 0
|
||||
tags:
|
||||
- keystone-policy-override
|
||||
|
||||
- name: Remove legacy policy.yaml file
|
||||
ansible.builtin.file:
|
||||
path: "/etc/keystone/policy.yaml"
|
||||
state: absent
|
||||
when:
|
||||
- keystone_policy_overrides | length == 0
|
||||
tags:
|
||||
- keystone-policy-override
|
||||
|
||||
|
||||
Reference in New Issue
Block a user