policy.json: Allow one to manage them from the puppet module

This commit allow a deployer to manage the policies via this module
It relies on augeas to change only the policy needed. The init takes
a hash of policies and apply them.

Change-Id: I534e76f4f7385e9057aaee0a5ec5d463dc918646

manifests/api.pp

@@ -155,16 +155,19 @@ class nova::api(
 ) {
 
   include nova::params
+  include nova::policy
   require keystone::python
   include cinder::client
 
   Package<| title == 'nova-api' |> -> Nova_paste_api_ini<| |>
 
   Package<| title == 'nova-common' |> -> Class['nova::api']
+  Package<| title == 'nova-common' |> -> Class['nova::policy']
 
   Nova_paste_api_ini<| |> ~> Exec['post-nova_config']
 
   Nova_paste_api_ini<| |> ~> Service['nova-api']
+  Class['nova::policy'] ~> Service['nova-api']
 
   if $auth_strategy {
     warning('The auth_strategy parameter is deprecated and has no effect.')

manifests/policy.pp

@@ -0,0 +1,29 @@
+# == Class: nova::policy
+#
+# Configure the nova policies
+#
+# === Parameters
+#
+# [*policies*]
+#   (optional) Set of policies to configure for nova
+#   Example : { 'nova-context_is_admin' => {'context_is_admin' => 'true'}, 'nova-default' => {'default' => 'rule:admin_or_owner'} }
+#   Defaults to empty hash.
+#
+# [*policy_path*]
+#   (optional) Path to the nova policy.json file
+#   Defaults to /etc/nova/policy.json
+#
+class nova::policy (
+  $policies    = {},
+  $policy_path = '/etc/nova/policy.json',
+) {
+
+  validate_hash($policies)
+
+  Openstacklib::Policy::Base {
+    file_path => $policy_path,
+  }
+
+  create_resources('openstacklib::policy::base', $policies)
+
+}

spec/classes/nova_policy_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe 'nova::policy' do
+
+  shared_examples_for 'nova policies' do
+    let :params do
+      {
+        :policy_path => '/etc/nova/policy.json',
+        :policies    => {
+          'context_is_admin' => {
+            'key'   => 'context_is_admin',
+            'value' => 'foo:bar'
+          }
+        }
+      }
+    end
+
+    it 'set up the policies' do
+      should contain_openstacklib__policy__base('context_is_admin').with({
+        :key   => 'context_is_admin',
+        :value => 'foo:bar'
+      })
+    end
+  end
+
+  context 'on Debian platforms' do
+    let :facts do
+      { :osfamily => 'Debian' }
+    end
+
+    it_configures 'nova policies'
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'nova policies'
+  end
+end