Merge "Allow purging policy files"

This commit is contained in:
Zuul 2021-09-20 08:09:37 +00:00 committed by Gerrit Code Review
commit 9885d6c067
3 changed files with 83 additions and 32 deletions

View File

@ -33,15 +33,21 @@
# Defaults to /etc/barbican/policy.yaml
#
# [*policy_dirs*]
# (Optional) Path to the keystone policy folder
# (Optional) Path to the barbican policy folder
# Defaults to $::os_service_default
#
# [*purge_config*]
# (optional) Whether to set only the specified policy rules in the policy
# file.
# Defaults to false.
#
class barbican::policy (
$enforce_scope = $::os_service_default,
$enforce_new_defaults = $::os_service_default,
$policies = {},
$policy_path = '/etc/barbican/policy.yaml',
$policy_dirs = $::os_service_default,
$purge_config = false,
) {
include barbican::deps
@ -49,14 +55,16 @@ class barbican::policy (
validate_legacy(Hash, 'validate_hash', $policies)
Openstacklib::Policy::Base {
file_path => $policy_path,
file_user => 'root',
file_group => $::barbican::params::group,
file_format => 'yaml',
$policy_parameters = {
policies => $policies,
policy_path => $policy_path,
file_user => 'root',
file_group => $::barbican::params::group,
file_format => 'yaml',
purge_config => $purge_config,
}
create_resources('openstacklib::policy::base', $policies)
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
oslo::policy { 'barbican_config':
enforce_scope => $enforce_scope,

View File

@ -0,0 +1,6 @@
---
features:
- |
Adds new purge_config parameter. When set to true, the policy file is
cleared during configuration process. This allows to remove any existing
rules before applying them or clean the file when all policies got removed.

View File

@ -2,35 +2,72 @@ require 'spec_helper'
describe 'barbican::policy' do
shared_examples 'barbican::policy' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/barbican/policy.yaml',
:policy_dirs => '/etc/barbican/policy.d',
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
context 'setup policy with parameters' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/barbican/policy.yaml',
:policy_dirs => '/etc/barbican/policy.d',
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
}
}
}
}
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy('/etc/barbican/policy.yaml').with(
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
}
},
:policy_path => '/etc/barbican/policy.yaml',
:file_user => 'root',
:file_group => 'barbican',
:file_format => 'yaml',
:purge_config => false,
)
is_expected.to contain_oslo__policy('barbican_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/barbican/policy.yaml',
:policy_dirs => '/etc/barbican/policy.d',
)
end
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
:key => 'context_is_admin',
:value => 'foo:bar',
:file_user => 'root',
:file_group => 'barbican',
:file_format => 'yaml',
})
is_expected.to contain_oslo__policy('barbican_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/barbican/policy.yaml',
:policy_dirs => '/etc/barbican/policy.d',
)
context 'with empty policies and purge_config enabled' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/barbican/policy.yaml',
:policies => {},
:purge_config => true,
}
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy('/etc/barbican/policy.yaml').with(
:policies => {},
:policy_path => '/etc/barbican/policy.yaml',
:file_user => 'root',
:file_group => 'barbican',
:file_format => 'yaml',
:purge_config => true,
)
is_expected.to contain_oslo__policy('barbican_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/barbican/policy.yaml',
)
end
end
end