Allow purging policy files

This change introduces the new purge_config parameter to the policy
class so that any policy rules not managed by puppet manifests can be
cleared.

Co-Authored-By: Martin Schuppert <mschuppert@redhat.com>
Depends-On: https://review.opendev.org/802305
Change-Id: I12860a99b656df63e8caa75f442ecaecff74e163
This commit is contained in:
Takashi Kajinami 2021-09-04 22:01:47 +09:00
parent f0371cecf2
commit 2683bc9657
3 changed files with 95 additions and 42 deletions

View File

@ -36,12 +36,18 @@
# (Optional) Path to the gnocchi policy folder
# Defaults to $::os_service_default
#
# [*purge_config*]
# (optional) Whether to set only the specified policy rules in the policy
# file.
# Defaults to false.
#
class gnocchi::policy (
$enforce_scope = $::os_service_default,
$enforce_new_defaults = $::os_service_default,
$policies = {},
$policy_path = '/etc/gnocchi/policy.yaml',
$policy_dirs = $::os_service_default,
$purge_config = false,
) {
include gnocchi::deps
@ -49,25 +55,29 @@ class gnocchi::policy (
validate_legacy(Hash, 'validate_hash', $policies)
# TODO(tkajinam): Remove this once version with policy-in-code implementation
# is released.
exec { 'gnocci-oslopolicy-convert-json-to-yaml':
command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}",
unless => "test -f ${policy_path}",
path => ['/bin','/usr/bin','/usr/local/bin'],
require => Anchor['gnocchi::install::end'],
}
Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |>
-> File<| title == $policy_path |>
Openstacklib::Policy::Base {
file_path => $policy_path,
file_user => 'root',
file_group => $::gnocchi::params::group,
file_format => 'yaml',
if ! $purge_config {
# TODO(tkajinam): Remove this once version with policy-in-code implementation
# is released.
exec { 'gnocci-oslopolicy-convert-json-to-yaml':
command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}",
unless => "test -f ${policy_path}",
path => ['/bin','/usr/bin','/usr/local/bin'],
require => Anchor['gnocchi::install::end'],
}
Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |>
-> File<| title == $policy_path |>
}
create_resources('openstacklib::policy::base', $policies)
$policy_parameters = {
policies => $policies,
policy_path => $policy_path,
file_user => 'root',
file_group => $::gnocchi::params::group,
file_format => 'yaml',
purge_config => $purge_config,
}
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
oslo::policy { 'gnocchi_config':
enforce_scope => $enforce_scope,

View File

@ -0,0 +1,6 @@
---
features:
- |
Adds new purge_config parameter. When set to true, the policy file is
cleared during configuration process. This allows to remove any existing
rules before applying them or clean the file when all policies got removed.

View File

@ -2,35 +2,72 @@ require 'spec_helper'
describe 'gnocchi::policy' do
shared_examples 'gnocchi::policy' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/gnocchi/policy.yaml',
:policy_dirs => '/etc/gnocchi/policy.d',
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
context 'setup policy with parameters' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/gnocchi/policy.yaml',
:policy_dirs => '/etc/gnocchi/policy.d',
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
}
}
}
}
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with(
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
}
},
:policy_path => '/etc/gnocchi/policy.yaml',
:file_user => 'root',
:file_group => 'gnocchi',
:file_format => 'yaml',
:purge_config => false,
)
is_expected.to contain_oslo__policy('gnocchi_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/gnocchi/policy.yaml',
:policy_dirs => '/etc/gnocchi/policy.d',
)
end
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
:key => 'context_is_admin',
:value => 'foo:bar',
:file_user => 'root',
:file_group => 'gnocchi',
:file_format => 'yaml',
})
is_expected.to contain_oslo__policy('gnocchi_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/gnocchi/policy.yaml',
:policy_dirs => '/etc/gnocchi/policy.d',
)
context 'with empty policies and purge_config enabled' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/gnocchi/policy.yaml',
:policies => {},
:purge_config => true,
}
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with(
:policies => {},
:policy_path => '/etc/gnocchi/policy.yaml',
:file_user => 'root',
:file_group => 'gnocchi',
:file_format => 'yaml',
:purge_config => true,
)
is_expected.to contain_oslo__policy('gnocchi_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/gnocchi/policy.yaml',
)
end
end
end