d7c27f5051
If all policies get deleted, previously created policy files won't get removed and the api policy file is still used. Let's make sure the policy file gets purged if the policies hash is empty. Depends-On: https://review.opendev.org/802305 Change-Id: Ic9b5ccd8fc23f6cebc06f62d972b64efd2400396
77 lines
1.9 KiB
Puppet
77 lines
1.9 KiB
Puppet
# == Class: nova::policy
|
|
#
|
|
# Configure the nova policies
|
|
#
|
|
# === Parameters
|
|
#
|
|
# [*enforce_scope*]
|
|
# (Optional) Whether or not to enforce scope when evaluating policies.
|
|
# Defaults to $::os_service_default.
|
|
#
|
|
# [*enforce_new_defaults*]
|
|
# (Optional) Whether or not to use old deprecated defaults when evaluating
|
|
# policies.
|
|
# Defaults to $::os_service_default.
|
|
#
|
|
# [*policies*]
|
|
# (Optional) Set of policies to configure for nova
|
|
# Example :
|
|
# {
|
|
# 'nova-context_is_admin' => {
|
|
# 'key' => 'context_is_admin',
|
|
# 'value' => 'true'
|
|
# },
|
|
# 'nova-default' => {
|
|
# 'key' => 'default',
|
|
# 'value' => 'rule:admin_or_owner'
|
|
# }
|
|
# }
|
|
# Defaults to empty hash.
|
|
#
|
|
# [*policy_path*]
|
|
# (Optional) Path to the nova policy.yaml file
|
|
# Defaults to /etc/nova/policy.yaml
|
|
#
|
|
# [*policy_dirs*]
|
|
# (Optional) Path to the nova policy folder
|
|
# Defaults to $::os_service_default
|
|
#
|
|
# [*purge_config*]
|
|
# (optional) Whether to set only the specified policy rules in the policy
|
|
# file.
|
|
# Defaults to false.
|
|
#
|
|
class nova::policy (
|
|
$enforce_scope = $::os_service_default,
|
|
$enforce_new_defaults = $::os_service_default,
|
|
$policies = {},
|
|
$policy_path = '/etc/nova/policy.yaml',
|
|
$policy_dirs = $::os_service_default,
|
|
$purge_config = false,
|
|
) {
|
|
|
|
include nova::deps
|
|
include nova::params
|
|
|
|
validate_legacy(Hash, 'validate_hash', $policies)
|
|
|
|
$policy_parameters = {
|
|
policies => $policies,
|
|
policy_path => $policy_path,
|
|
file_user => 'root',
|
|
file_group => $::nova::params::group,
|
|
file_format => 'yaml',
|
|
purge_config => $purge_config,
|
|
}
|
|
|
|
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
|
|
|
|
oslo::policy { 'nova_config':
|
|
enforce_scope => $enforce_scope,
|
|
enforce_new_defaults => $enforce_new_defaults,
|
|
policy_file => $policy_path,
|
|
policy_dirs => $policy_dirs,
|
|
}
|
|
|
|
}
|