From 572c33e76feb741e43654f21f013a293243e0e2c Mon Sep 17 00:00:00 2001
From: Yanis Guenane <yanis.guenane@enovance.com>
Date: Fri, 26 Sep 2014 18:59:53 -0400
Subject: [PATCH] policy.json: Allow one to manage them from the puppet module

This commit allow a deployer to manage the policies via this module
It relies on augeas to change only the policy needed. The init takes
a hash of policies and apply them.

Change-Id: I534e76f4f7385e9057aaee0a5ec5d463dc918646
---
 manifests/api.pp                 |  3 +++
 manifests/policy.pp              | 29 ++++++++++++++++++++++
 spec/classes/nova_policy_spec.rb | 41 ++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 manifests/policy.pp
 create mode 100644 spec/classes/nova_policy_spec.rb

diff --git a/manifests/api.pp b/manifests/api.pp
index 098863741..d3c055665 100644
--- a/manifests/api.pp
+++ b/manifests/api.pp
@@ -155,16 +155,19 @@ class nova::api(
 ) {
 
   include nova::params
+  include nova::policy
   require keystone::python
   include cinder::client
 
   Package<| title == 'nova-api' |> -> Nova_paste_api_ini<| |>
 
   Package<| title == 'nova-common' |> -> Class['nova::api']
+  Package<| title == 'nova-common' |> -> Class['nova::policy']
 
   Nova_paste_api_ini<| |> ~> Exec['post-nova_config']
 
   Nova_paste_api_ini<| |> ~> Service['nova-api']
+  Class['nova::policy'] ~> Service['nova-api']
 
   if $auth_strategy {
     warning('The auth_strategy parameter is deprecated and has no effect.')
diff --git a/manifests/policy.pp b/manifests/policy.pp
new file mode 100644
index 000000000..d7ec755b6
--- /dev/null
+++ b/manifests/policy.pp
@@ -0,0 +1,29 @@
+# == Class: nova::policy
+#
+# Configure the nova policies
+#
+# === Parameters
+#
+# [*policies*]
+#   (optional) Set of policies to configure for nova
+#   Example : { 'nova-context_is_admin' => {'context_is_admin' => 'true'}, 'nova-default' => {'default' => 'rule:admin_or_owner'} }
+#   Defaults to empty hash.
+#
+# [*policy_path*]
+#   (optional) Path to the nova policy.json file
+#   Defaults to /etc/nova/policy.json
+#
+class nova::policy (
+  $policies    = {},
+  $policy_path = '/etc/nova/policy.json',
+) {
+
+  validate_hash($policies)
+
+  Openstacklib::Policy::Base {
+    file_path => $policy_path,
+  }
+
+  create_resources('openstacklib::policy::base', $policies)
+
+}
diff --git a/spec/classes/nova_policy_spec.rb b/spec/classes/nova_policy_spec.rb
new file mode 100644
index 000000000..2d6992e9e
--- /dev/null
+++ b/spec/classes/nova_policy_spec.rb
@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe 'nova::policy' do
+
+  shared_examples_for 'nova policies' do
+    let :params do
+      {
+        :policy_path => '/etc/nova/policy.json',
+        :policies    => {
+          'context_is_admin' => {
+            'key'   => 'context_is_admin',
+            'value' => 'foo:bar'
+          }
+        }
+      }
+    end
+
+    it 'set up the policies' do
+      should contain_openstacklib__policy__base('context_is_admin').with({
+        :key   => 'context_is_admin',
+        :value => 'foo:bar'
+      })
+    end
+  end
+
+  context 'on Debian platforms' do
+    let :facts do
+      { :osfamily => 'Debian' }
+    end
+
+    it_configures 'nova policies'
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'nova policies'
+  end
+end