Add support for the oslo_policy/enforce_scope parameter

Depends-on: https://review.opendev.org/#/c/759008/
Change-Id: Ib54f3adbeb2eaa72b74bd8cadd81a468dbcc0321
This commit is contained in:
Takashi Kajinami 2020-10-21 21:06:07 +09:00
parent e361dcbd5f
commit 64cf6c13cc
3 changed files with 21 additions and 6 deletions

View File

@ -4,6 +4,10 @@
#
# === Parameters
#
# [*enforce_scope*]
# (Optional) Whether or not to enforce scope when evaluating policies.
# Defaults to $::os_service_default.
#
# [*policies*]
# (Optional) Set of policies to configure for keystone
# Example :
@ -24,8 +28,9 @@
# Defaults to /etc/keystone/policy.json
#
class keystone::policy (
$policies = {},
$policy_path = '/etc/keystone/policy.json',
$enforce_scope = $::os_service_default,
$policies = {},
$policy_path = '/etc/keystone/policy.json',
) {
include keystone::deps
@ -41,6 +46,9 @@ class keystone::policy (
create_resources('openstacklib::policy::base', $policies)
oslo::policy { 'keystone_config': policy_file => $policy_path }
oslo::policy { 'keystone_config':
enforce_scope => $enforce_scope,
policy_file => $policy_path
}
}

View File

@ -0,0 +1,5 @@
---
features:
- |
The new ``keystone::policy::enforce_scope`` parameter has been added to
support the corresponding parameter in oslo.policy library.

View File

@ -4,8 +4,9 @@ describe 'keystone::policy' do
shared_examples 'keystone::policy' do
let :params do
{
:policy_path => '/etc/keystone/policy.json',
:policies => {
:enforce_scope => false,
:policy_path => '/etc/keystone/policy.json',
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
@ -22,7 +23,8 @@ describe 'keystone::policy' do
:file_group => 'keystone',
})
is_expected.to contain_oslo__policy('keystone_config').with(
:policy_file => '/etc/keystone/policy.json',
:enforce_scope => false,
:policy_file => '/etc/keystone/policy.json',
)
end
end