Allow purging policy files

This change introduces the new purge_config parameter to the policy
class so that any policy rules not managed by puppet manifests can be
cleared.

Co-Authored-By: Martin Schuppert <mschuppert@redhat.com>
Depends-On: https://review.opendev.org/802305
Change-Id: Ia5fecab4cb81dda87766b950433cdad3ce75b9eb

manifests/inspector/policy.pp

@@ -36,12 +36,18 @@
 #   (Optional) Path to the ironic-inspector policy folder
 #   Defaults to $::os_service_default
 #
+# [*purge_config*]
+#   (optional) Whether to set only the specified policy rules in the policy
+#    file.
+#    Defaults to false.
+#
 class ironic::inspector::policy (
   $enforce_scope        = $::os_service_default,
   $enforce_new_defaults = $::os_service_default,
   $policies             = {},
   $policy_path          = '/etc/ironic-inspector/policy.yaml',
   $policy_dirs          = $::os_service_default,
+  $purge_config         = false,
 ) {
 
   include ironic::deps
@@ -49,14 +55,16 @@ class ironic::inspector::policy (
 
   validate_legacy(Hash, 'validate_hash', $policies)
 
-  Openstacklib::Policy::Base {
-    file_path   => $policy_path,
+  $policy_parameters = {
+    policies     => $policies,
+    policy_path  => $policy_path,
     file_user    => 'root',
     file_group   => $::ironic::params::group,
     file_format  => 'yaml',
+    purge_config => $purge_config,
   }
 
-  create_resources('openstacklib::policy::base', $policies)
+  create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
 
   oslo::policy { 'ironic_inspector_config':
     enforce_scope        => $enforce_scope,

manifests/policy.pp

@@ -36,12 +36,18 @@
 #   (Optional) Path to the ironic policy folder
 #   Defaults to $::os_service_default
 #
+# [*purge_config*]
+#   (optional) Whether to set only the specified policy rules in the policy
+#    file.
+#    Defaults to false.
+#
 class ironic::policy (
   $enforce_scope        = $::os_service_default,
   $enforce_new_defaults = $::os_service_default,
   $policies             = {},
   $policy_path          = '/etc/ironic/policy.yaml',
   $policy_dirs          = $::os_service_default,
+  $purge_config         = false,
 ) {
 
   include ironic::deps
@@ -49,14 +55,16 @@ class ironic::policy (
 
   validate_legacy(Hash, 'validate_hash', $policies)
 
-  Openstacklib::Policy::Base {
-    file_path   => $policy_path,
+  $policy_parameters = {
+    policies     => $policies,
+    policy_path  => $policy_path,
     file_user    => 'root',
     file_group   => $::ironic::params::group,
     file_format  => 'yaml',
+    purge_config => $purge_config,
   }
 
-  create_resources('openstacklib::policy::base', $policies)
+  create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
 
   oslo::policy { 'ironic_config':
     enforce_scope        => $enforce_scope,

releasenotes/notes/policy_purge_config-f61123cb72ed68c1.yaml

@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Adds new purge_config parameter. When set to true, the policy file is
+    cleared during configuration process. This allows to remove any existing
+    rules before applying them or clean the file when all policies got removed.

spec/classes/ironic_inspector_policy_spec.rb

@@ -2,6 +2,8 @@ require 'spec_helper'
 
 describe 'ironic::inspector::policy' do
   shared_examples 'ironic::inspector::policy' do
+
+    context 'setup policy with parameters' do
       let :params do
         {
           :enforce_scope        => false,
@@ -18,13 +20,19 @@ describe 'ironic::inspector::policy' do
       end
 
       it 'set up the policies' do
-      is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
-        :key         => 'context_is_admin',
-        :value       => 'foo:bar',
+        is_expected.to contain_openstacklib__policy('/etc/ironic-inspector/policy.yaml').with(
+          :policies     => {
+            'context_is_admin' => {
+              'key'   => 'context_is_admin',
+              'value' => 'foo:bar'
+            }
+          },
+          :policy_path  => '/etc/ironic-inspector/policy.yaml',
           :file_user    => 'root',
           :file_group   => 'ironic',
           :file_format  => 'yaml',
-      })
+          :purge_config => false,
+        )
         is_expected.to contain_oslo__policy('ironic_inspector_config').with(
           :enforce_scope        => false,
           :enforce_new_defaults => false,
@@ -34,6 +42,35 @@ describe 'ironic::inspector::policy' do
       end
     end
 
+    context 'with empty policies and purge_config enabled' do
+      let :params do
+        {
+          :enforce_scope        => false,
+          :enforce_new_defaults => false,
+          :policy_path          => '/etc/ironic-inspector/policy.yaml',
+          :policies             => {},
+          :purge_config         => true,
+        }
+      end
+
+      it 'set up the policies' do
+        is_expected.to contain_openstacklib__policy('/etc/ironic-inspector/policy.yaml').with(
+          :policies     => {},
+          :policy_path  => '/etc/ironic-inspector/policy.yaml',
+          :file_user    => 'root',
+          :file_group   => 'ironic',
+          :file_format  => 'yaml',
+          :purge_config => true,
+        )
+        is_expected.to contain_oslo__policy('ironic_inspector_config').with(
+          :enforce_scope        => false,
+          :enforce_new_defaults => false,
+          :policy_file          => '/etc/ironic-inspector/policy.yaml',
+        )
+      end
+    end
+  end
+
   on_supported_os({
     :supported_os => OSDefaults.get_supported_os
   }).each do |os,facts|

spec/classes/ironic_policy_spec.rb

@@ -2,6 +2,8 @@ require 'spec_helper'
 
 describe 'ironic::policy' do
   shared_examples 'ironic::policy' do
+
+    context 'setup policy with parameters' do
       let :params do
         {
           :enforce_scope        => false,
@@ -18,13 +20,19 @@ describe 'ironic::policy' do
       end
 
       it 'set up the policies' do
-      is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
-        :key         => 'context_is_admin',
-        :value       => 'foo:bar',
+        is_expected.to contain_openstacklib__policy('/etc/ironic/policy.yaml').with(
+          :policies     => {
+            'context_is_admin' => {
+              'key'   => 'context_is_admin',
+              'value' => 'foo:bar'
+            }
+          },
+          :policy_path  => '/etc/ironic/policy.yaml',
           :file_user    => 'root',
           :file_group   => 'ironic',
           :file_format  => 'yaml',
-      })
+          :purge_config => false,
+        )
         is_expected.to contain_oslo__policy('ironic_config').with(
           :enforce_scope        => false,
           :enforce_new_defaults => false,
@@ -34,6 +42,35 @@ describe 'ironic::policy' do
       end
     end
 
+    context 'with empty policies and purge_config enabled' do
+      let :params do
+        {
+          :enforce_scope        => false,
+          :enforce_new_defaults => false,
+          :policy_path          => '/etc/ironic/policy.yaml',
+          :policies             => {},
+          :purge_config         => true,
+        }
+      end
+
+      it 'set up the policies' do
+        is_expected.to contain_openstacklib__policy('/etc/ironic/policy.yaml').with(
+          :policies     => {},
+          :policy_path  => '/etc/ironic/policy.yaml',
+          :file_user    => 'root',
+          :file_group   => 'ironic',
+          :file_format  => 'yaml',
+          :purge_config => true,
+        )
+        is_expected.to contain_oslo__policy('ironic_config').with(
+          :enforce_scope        => false,
+          :enforce_new_defaults => false,
+          :policy_file          => '/etc/ironic/policy.yaml',
+        )
+      end
+    end
+  end
+
   on_supported_os({
     :supported_os => OSDefaults.get_supported_os
   }).each do |os,facts|