Allow purging policy files
This change introduces the new purge_config parameter to the policy class so that any policy rules not managed by puppet manifests can be cleared. Co-Authored-By: Martin Schuppert <mschuppert@redhat.com> Depends-On: https://review.opendev.org/802305 Change-Id: I12860a99b656df63e8caa75f442ecaecff74e163
This commit is contained in:
parent
f0371cecf2
commit
2683bc9657
|
@ -36,12 +36,18 @@
|
||||||
# (Optional) Path to the gnocchi policy folder
|
# (Optional) Path to the gnocchi policy folder
|
||||||
# Defaults to $::os_service_default
|
# Defaults to $::os_service_default
|
||||||
#
|
#
|
||||||
|
# [*purge_config*]
|
||||||
|
# (optional) Whether to set only the specified policy rules in the policy
|
||||||
|
# file.
|
||||||
|
# Defaults to false.
|
||||||
|
#
|
||||||
class gnocchi::policy (
|
class gnocchi::policy (
|
||||||
$enforce_scope = $::os_service_default,
|
$enforce_scope = $::os_service_default,
|
||||||
$enforce_new_defaults = $::os_service_default,
|
$enforce_new_defaults = $::os_service_default,
|
||||||
$policies = {},
|
$policies = {},
|
||||||
$policy_path = '/etc/gnocchi/policy.yaml',
|
$policy_path = '/etc/gnocchi/policy.yaml',
|
||||||
$policy_dirs = $::os_service_default,
|
$policy_dirs = $::os_service_default,
|
||||||
|
$purge_config = false,
|
||||||
) {
|
) {
|
||||||
|
|
||||||
include gnocchi::deps
|
include gnocchi::deps
|
||||||
|
@ -49,25 +55,29 @@ class gnocchi::policy (
|
||||||
|
|
||||||
validate_legacy(Hash, 'validate_hash', $policies)
|
validate_legacy(Hash, 'validate_hash', $policies)
|
||||||
|
|
||||||
# TODO(tkajinam): Remove this once version with policy-in-code implementation
|
if ! $purge_config {
|
||||||
# is released.
|
# TODO(tkajinam): Remove this once version with policy-in-code implementation
|
||||||
exec { 'gnocci-oslopolicy-convert-json-to-yaml':
|
# is released.
|
||||||
command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}",
|
exec { 'gnocci-oslopolicy-convert-json-to-yaml':
|
||||||
unless => "test -f ${policy_path}",
|
command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}",
|
||||||
path => ['/bin','/usr/bin','/usr/local/bin'],
|
unless => "test -f ${policy_path}",
|
||||||
require => Anchor['gnocchi::install::end'],
|
path => ['/bin','/usr/bin','/usr/local/bin'],
|
||||||
}
|
require => Anchor['gnocchi::install::end'],
|
||||||
Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |>
|
}
|
||||||
-> File<| title == $policy_path |>
|
Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |>
|
||||||
|
-> File<| title == $policy_path |>
|
||||||
Openstacklib::Policy::Base {
|
|
||||||
file_path => $policy_path,
|
|
||||||
file_user => 'root',
|
|
||||||
file_group => $::gnocchi::params::group,
|
|
||||||
file_format => 'yaml',
|
|
||||||
}
|
}
|
||||||
|
|
||||||
create_resources('openstacklib::policy::base', $policies)
|
$policy_parameters = {
|
||||||
|
policies => $policies,
|
||||||
|
policy_path => $policy_path,
|
||||||
|
file_user => 'root',
|
||||||
|
file_group => $::gnocchi::params::group,
|
||||||
|
file_format => 'yaml',
|
||||||
|
purge_config => $purge_config,
|
||||||
|
}
|
||||||
|
|
||||||
|
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
|
||||||
|
|
||||||
oslo::policy { 'gnocchi_config':
|
oslo::policy { 'gnocchi_config':
|
||||||
enforce_scope => $enforce_scope,
|
enforce_scope => $enforce_scope,
|
||||||
|
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
features:
|
||||||
|
- |
|
||||||
|
Adds new purge_config parameter. When set to true, the policy file is
|
||||||
|
cleared during configuration process. This allows to remove any existing
|
||||||
|
rules before applying them or clean the file when all policies got removed.
|
|
@ -2,35 +2,72 @@ require 'spec_helper'
|
||||||
|
|
||||||
describe 'gnocchi::policy' do
|
describe 'gnocchi::policy' do
|
||||||
shared_examples 'gnocchi::policy' do
|
shared_examples 'gnocchi::policy' do
|
||||||
let :params do
|
|
||||||
{
|
context 'setup policy with parameters' do
|
||||||
:enforce_scope => false,
|
let :params do
|
||||||
:enforce_new_defaults => false,
|
{
|
||||||
:policy_path => '/etc/gnocchi/policy.yaml',
|
:enforce_scope => false,
|
||||||
:policy_dirs => '/etc/gnocchi/policy.d',
|
:enforce_new_defaults => false,
|
||||||
:policies => {
|
:policy_path => '/etc/gnocchi/policy.yaml',
|
||||||
'context_is_admin' => {
|
:policy_dirs => '/etc/gnocchi/policy.d',
|
||||||
'key' => 'context_is_admin',
|
:policies => {
|
||||||
'value' => 'foo:bar'
|
'context_is_admin' => {
|
||||||
|
'key' => 'context_is_admin',
|
||||||
|
'value' => 'foo:bar'
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
end
|
||||||
|
|
||||||
|
it 'set up the policies' do
|
||||||
|
is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with(
|
||||||
|
:policies => {
|
||||||
|
'context_is_admin' => {
|
||||||
|
'key' => 'context_is_admin',
|
||||||
|
'value' => 'foo:bar'
|
||||||
|
}
|
||||||
|
},
|
||||||
|
:policy_path => '/etc/gnocchi/policy.yaml',
|
||||||
|
:file_user => 'root',
|
||||||
|
:file_group => 'gnocchi',
|
||||||
|
:file_format => 'yaml',
|
||||||
|
:purge_config => false,
|
||||||
|
)
|
||||||
|
is_expected.to contain_oslo__policy('gnocchi_config').with(
|
||||||
|
:enforce_scope => false,
|
||||||
|
:enforce_new_defaults => false,
|
||||||
|
:policy_file => '/etc/gnocchi/policy.yaml',
|
||||||
|
:policy_dirs => '/etc/gnocchi/policy.d',
|
||||||
|
)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
it 'set up the policies' do
|
context 'with empty policies and purge_config enabled' do
|
||||||
is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
|
let :params do
|
||||||
:key => 'context_is_admin',
|
{
|
||||||
:value => 'foo:bar',
|
:enforce_scope => false,
|
||||||
:file_user => 'root',
|
:enforce_new_defaults => false,
|
||||||
:file_group => 'gnocchi',
|
:policy_path => '/etc/gnocchi/policy.yaml',
|
||||||
:file_format => 'yaml',
|
:policies => {},
|
||||||
})
|
:purge_config => true,
|
||||||
is_expected.to contain_oslo__policy('gnocchi_config').with(
|
}
|
||||||
:enforce_scope => false,
|
end
|
||||||
:enforce_new_defaults => false,
|
|
||||||
:policy_file => '/etc/gnocchi/policy.yaml',
|
it 'set up the policies' do
|
||||||
:policy_dirs => '/etc/gnocchi/policy.d',
|
is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with(
|
||||||
)
|
:policies => {},
|
||||||
|
:policy_path => '/etc/gnocchi/policy.yaml',
|
||||||
|
:file_user => 'root',
|
||||||
|
:file_group => 'gnocchi',
|
||||||
|
:file_format => 'yaml',
|
||||||
|
:purge_config => true,
|
||||||
|
)
|
||||||
|
is_expected.to contain_oslo__policy('gnocchi_config').with(
|
||||||
|
:enforce_scope => false,
|
||||||
|
:enforce_new_defaults => false,
|
||||||
|
:policy_file => '/etc/gnocchi/policy.yaml',
|
||||||
|
)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue