From 89124fb85d08f1caa4d1900194d86b64dbec1954 Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Sat, 4 Sep 2021 21:50:37 +0900 Subject: [PATCH] Allow purging policy files This change introduces the new purge_config parameter to the policy class so that any policy rules not managed by puppet manifests can be cleared. Co-Authored-By: Martin Schuppert Depends-On: https://review.opendev.org/802305 Change-Id: Ia4e3b30c1ad7b9aaae2bd9377a539c77899c4f47 --- manifests/policy.pp | 28 ++++-- .../policy_purge_config-4566bc63357aace8.yaml | 6 ++ spec/classes/ec2api_policy_spec.rb | 85 ++++++++++++++----- 3 files changed, 89 insertions(+), 30 deletions(-) create mode 100644 releasenotes/notes/policy_purge_config-4566bc63357aace8.yaml diff --git a/manifests/policy.pp b/manifests/policy.pp index 97015a9..5b046c1 100644 --- a/manifests/policy.pp +++ b/manifests/policy.pp @@ -32,11 +32,22 @@ # (Optional) Path to the ec2api policy.yaml file # Defaults to /etc/ec2api/policy.yaml # +# [*policy_dirs*] +# (Optional) Path to the ec2api policy folder +# Defaults to $::os_service_default +# +# [*purge_config*] +# (optional) Whether to set only the specified policy rules in the policy +# file. +# Defaults to false. +# class ec2api::policy ( $enforce_scope = $::os_service_default, $enforce_new_defaults = $::os_service_default, $policies = {}, $policy_path = '/etc/ec2api/policy.yaml', + $policy_dirs = $::os_service_default, + $purge_config = false, ) { include ec2api::deps @@ -44,19 +55,22 @@ class ec2api::policy ( validate_legacy(Hash, 'validate_hash', $policies) - Openstacklib::Policy::Base { - file_path => $policy_path, - file_user => 'root', - file_group => $::ec2api::params::group, - file_format => 'yaml', + $policy_parameters = { + policies => $policies, + policy_path => $policy_path, + file_user => 'root', + file_group => $::ec2api::params::group, + file_format => 'yaml', + purge_config => $purge_config, } - create_resources('openstacklib::policy::base', $policies) + create_resources('openstacklib::policy', { $policy_path => $policy_parameters }) oslo::policy { 'ec2api_config': enforce_scope => $enforce_scope, enforce_new_defaults => $enforce_new_defaults, - policy_file => $policy_path + policy_file => $policy_path, + policy_dirs => $policy_dirs, } } diff --git a/releasenotes/notes/policy_purge_config-4566bc63357aace8.yaml b/releasenotes/notes/policy_purge_config-4566bc63357aace8.yaml new file mode 100644 index 0000000..ecb17ae --- /dev/null +++ b/releasenotes/notes/policy_purge_config-4566bc63357aace8.yaml @@ -0,0 +1,6 @@ +--- +features: + - | + Adds new purge_config parameter. When set to true, the policy file is + cleared during configuration process. This allows to remove any existing + rules before applying them or clean the file when all policies got removed. diff --git a/spec/classes/ec2api_policy_spec.rb b/spec/classes/ec2api_policy_spec.rb index d373acf..f08f566 100644 --- a/spec/classes/ec2api_policy_spec.rb +++ b/spec/classes/ec2api_policy_spec.rb @@ -2,33 +2,72 @@ require 'spec_helper' describe 'ec2api::policy' do shared_examples 'ec2api::policy' do - let :params do - { - :enforce_scope => false, - :enforce_new_defaults => false, - :policy_path => '/etc/ec2api/policy.yaml', - :policies => { - 'context_is_admin' => { - 'key' => 'context_is_admin', - 'value' => 'foo:bar' + + context 'setup policy with parameters' do + let :params do + { + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_path => '/etc/ec2api/policy.yaml', + :policy_dirs => '/etc/ec2api/policy.d', + :policies => { + 'context_is_admin' => { + 'key' => 'context_is_admin', + 'value' => 'foo:bar' + } } } - } + end + + it 'set up the policies' do + is_expected.to contain_openstacklib__policy('/etc/ec2api/policy.yaml').with( + :policies => { + 'context_is_admin' => { + 'key' => 'context_is_admin', + 'value' => 'foo:bar' + } + }, + :policy_path => '/etc/ec2api/policy.yaml', + :file_user => 'root', + :file_group => 'ec2api', + :file_format => 'yaml', + :purge_config => false, + ) + is_expected.to contain_oslo__policy('ec2api_config').with( + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_file => '/etc/ec2api/policy.yaml', + :policy_dirs => '/etc/ec2api/policy.d', + ) + end end - it 'set up the policies' do - is_expected.to contain_openstacklib__policy__base('context_is_admin').with({ - :key => 'context_is_admin', - :value => 'foo:bar', - :file_user => 'root', - :file_group => 'ec2api', - :file_format => 'yaml', - }) - is_expected.to contain_oslo__policy('ec2api_config').with( - :enforce_scope => false, - :enforce_new_defaults => false, - :policy_file => '/etc/ec2api/policy.yaml', - ) + context 'with empty policies and purge_config enabled' do + let :params do + { + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_path => '/etc/ec2api/policy.yaml', + :policies => {}, + :purge_config => true, + } + end + + it 'set up the policies' do + is_expected.to contain_openstacklib__policy('/etc/ec2api/policy.yaml').with( + :policies => {}, + :policy_path => '/etc/ec2api/policy.yaml', + :file_user => 'root', + :file_group => 'ec2api', + :file_format => 'yaml', + :purge_config => true, + ) + is_expected.to contain_oslo__policy('ec2api_config').with( + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_file => '/etc/ec2api/policy.yaml', + ) + end end end