From 607d8a854dc57dbcd92b055d045cb1f9a9bd02cd Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Tue, 16 Mar 2021 18:35:37 +0900
Subject: [PATCH] Add support for the oslo_policy/enforce_scope parameter

Depends-on: https://review.opendev.org/#/c/759008/
Change-Id: Ief74bb444f72dae125e73e611c8412b118ae0ee9
---
 manifests/policy.pp                            | 18 +++++++++++++-----
 ..._policy-enforce_scope-bf46392b4cb2055e.yaml |  5 +++++
 spec/classes/nova_policy_spec.rb               | 16 ++++++++--------
 3 files changed, 26 insertions(+), 13 deletions(-)
 create mode 100644 releasenotes/notes/oslo_policy-enforce_scope-bf46392b4cb2055e.yaml

diff --git a/manifests/policy.pp b/manifests/policy.pp
index 73402af9f..e42bc36ab 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -4,6 +4,10 @@
 #
 # === Parameters
 #
+# [*enforce_scope*]
+#  (Optional) Whether or not to enforce scope when evaluating policies.
+#  Defaults to $::os_service_default.
+#
 # [*policies*]
 #   (Optional) Set of policies to configure for nova
 #   Example :
@@ -24,8 +28,9 @@
 #   Defaults to /etc/nova/policy.yaml
 #
 class nova::policy (
-  $policies    = {},
-  $policy_path = '/etc/nova/policy.yaml',
+  $enforce_scope = $::os_service_default,
+  $policies      = {},
+  $policy_path   = '/etc/nova/policy.yaml',
 ) {
 
   include nova::deps
@@ -33,15 +38,18 @@ class nova::policy (
 
   validate_legacy(Hash, 'validate_hash', $policies)
 
-  $policy_defaults = {
+  Openstacklib::Policy::Base {
     file_path   => $policy_path,
     file_user   => 'root',
     file_group  => $::nova::params::group,
     file_format => 'yaml',
   }
 
-  create_resources('openstacklib::policy::base', $policies, $policy_defaults)
+  create_resources('openstacklib::policy::base', $policies)
 
-  oslo::policy { 'nova_config': policy_file => $policy_path }
+  oslo::policy { 'nova_config':
+    enforce_scope => $enforce_scope,
+    policy_file   => $policy_path
+  }
 
 }
diff --git a/releasenotes/notes/oslo_policy-enforce_scope-bf46392b4cb2055e.yaml b/releasenotes/notes/oslo_policy-enforce_scope-bf46392b4cb2055e.yaml
new file mode 100644
index 000000000..8bfa442ec
--- /dev/null
+++ b/releasenotes/notes/oslo_policy-enforce_scope-bf46392b4cb2055e.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The new ``nova::policy::enforce_scope`` parameter has been added to
+    support the corresponding parameter in oslo.policy library.
diff --git a/spec/classes/nova_policy_spec.rb b/spec/classes/nova_policy_spec.rb
index 0e1aed825..55c85ee1e 100644
--- a/spec/classes/nova_policy_spec.rb
+++ b/spec/classes/nova_policy_spec.rb
@@ -1,12 +1,12 @@
 require 'spec_helper'
 
 describe 'nova::policy' do
-
-  shared_examples_for 'nova policies' do
+  shared_examples 'nova::policy' do
     let :params do
       {
-        :policy_path => '/etc/nova/policy.yaml',
-        :policies    => {
+        :enforce_scope => false,
+        :policy_path   => '/etc/nova/policy.yaml',
+        :policies      => {
           'context_is_admin' => {
             'key'   => 'context_is_admin',
             'value' => 'foo:bar'
@@ -24,21 +24,21 @@ describe 'nova::policy' do
         :file_format => 'yaml',
       })
       is_expected.to contain_oslo__policy('nova_config').with(
-        :policy_file => '/etc/nova/policy.yaml',
+        :enforce_scope => false,
+        :policy_file   => '/etc/nova/policy.yaml',
       )
     end
   end
 
   on_supported_os({
-    :supported_os   => OSDefaults.get_supported_os
+    :supported_os => OSDefaults.get_supported_os
   }).each do |os,facts|
     context "on #{os}" do
       let (:facts) do
         facts.merge!(OSDefaults.get_facts())
       end
 
-      it_configures 'nova policies'
+      it_behaves_like 'nova::policy'
     end
   end
-
 end