From 2683bc96575772edb5a1a0cc0a57695132fd5900 Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Sat, 4 Sep 2021 22:01:47 +0900 Subject: [PATCH] Allow purging policy files This change introduces the new purge_config parameter to the policy class so that any policy rules not managed by puppet manifests can be cleared. Co-Authored-By: Martin Schuppert Depends-On: https://review.opendev.org/802305 Change-Id: I12860a99b656df63e8caa75f442ecaecff74e163 --- manifests/policy.pp | 44 ++++++---- .../policy_purge_config-842778b72b5916f8.yaml | 6 ++ spec/classes/gnocchi_policy_spec.rb | 87 +++++++++++++------ 3 files changed, 95 insertions(+), 42 deletions(-) create mode 100644 releasenotes/notes/policy_purge_config-842778b72b5916f8.yaml diff --git a/manifests/policy.pp b/manifests/policy.pp index 67cc4a1d..8a4b3c3f 100644 --- a/manifests/policy.pp +++ b/manifests/policy.pp @@ -36,12 +36,18 @@ # (Optional) Path to the gnocchi policy folder # Defaults to $::os_service_default # +# [*purge_config*] +# (optional) Whether to set only the specified policy rules in the policy +# file. +# Defaults to false. +# class gnocchi::policy ( $enforce_scope = $::os_service_default, $enforce_new_defaults = $::os_service_default, $policies = {}, $policy_path = '/etc/gnocchi/policy.yaml', $policy_dirs = $::os_service_default, + $purge_config = false, ) { include gnocchi::deps @@ -49,25 +55,29 @@ class gnocchi::policy ( validate_legacy(Hash, 'validate_hash', $policies) - # TODO(tkajinam): Remove this once version with policy-in-code implementation - # is released. - exec { 'gnocci-oslopolicy-convert-json-to-yaml': - command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}", - unless => "test -f ${policy_path}", - path => ['/bin','/usr/bin','/usr/local/bin'], - require => Anchor['gnocchi::install::end'], - } - Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |> - -> File<| title == $policy_path |> - - Openstacklib::Policy::Base { - file_path => $policy_path, - file_user => 'root', - file_group => $::gnocchi::params::group, - file_format => 'yaml', + if ! $purge_config { + # TODO(tkajinam): Remove this once version with policy-in-code implementation + # is released. + exec { 'gnocci-oslopolicy-convert-json-to-yaml': + command => "oslopolicy-convert-json-to-yaml --namespace gnocchi --policy-file /etc/gnocchi/policy.json --output-file ${policy_path}", + unless => "test -f ${policy_path}", + path => ['/bin','/usr/bin','/usr/local/bin'], + require => Anchor['gnocchi::install::end'], + } + Exec<| title == 'gnocchi-oslopolicy-convert-json-to-yaml' |> + -> File<| title == $policy_path |> } - create_resources('openstacklib::policy::base', $policies) + $policy_parameters = { + policies => $policies, + policy_path => $policy_path, + file_user => 'root', + file_group => $::gnocchi::params::group, + file_format => 'yaml', + purge_config => $purge_config, + } + + create_resources('openstacklib::policy', { $policy_path => $policy_parameters }) oslo::policy { 'gnocchi_config': enforce_scope => $enforce_scope, diff --git a/releasenotes/notes/policy_purge_config-842778b72b5916f8.yaml b/releasenotes/notes/policy_purge_config-842778b72b5916f8.yaml new file mode 100644 index 00000000..ecb17aed --- /dev/null +++ b/releasenotes/notes/policy_purge_config-842778b72b5916f8.yaml @@ -0,0 +1,6 @@ +--- +features: + - | + Adds new purge_config parameter. When set to true, the policy file is + cleared during configuration process. This allows to remove any existing + rules before applying them or clean the file when all policies got removed. diff --git a/spec/classes/gnocchi_policy_spec.rb b/spec/classes/gnocchi_policy_spec.rb index 1f29a60c..b100ac7d 100644 --- a/spec/classes/gnocchi_policy_spec.rb +++ b/spec/classes/gnocchi_policy_spec.rb @@ -2,35 +2,72 @@ require 'spec_helper' describe 'gnocchi::policy' do shared_examples 'gnocchi::policy' do - let :params do - { - :enforce_scope => false, - :enforce_new_defaults => false, - :policy_path => '/etc/gnocchi/policy.yaml', - :policy_dirs => '/etc/gnocchi/policy.d', - :policies => { - 'context_is_admin' => { - 'key' => 'context_is_admin', - 'value' => 'foo:bar' + + context 'setup policy with parameters' do + let :params do + { + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_path => '/etc/gnocchi/policy.yaml', + :policy_dirs => '/etc/gnocchi/policy.d', + :policies => { + 'context_is_admin' => { + 'key' => 'context_is_admin', + 'value' => 'foo:bar' + } } } - } + end + + it 'set up the policies' do + is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with( + :policies => { + 'context_is_admin' => { + 'key' => 'context_is_admin', + 'value' => 'foo:bar' + } + }, + :policy_path => '/etc/gnocchi/policy.yaml', + :file_user => 'root', + :file_group => 'gnocchi', + :file_format => 'yaml', + :purge_config => false, + ) + is_expected.to contain_oslo__policy('gnocchi_config').with( + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_file => '/etc/gnocchi/policy.yaml', + :policy_dirs => '/etc/gnocchi/policy.d', + ) + end end - it 'set up the policies' do - is_expected.to contain_openstacklib__policy__base('context_is_admin').with({ - :key => 'context_is_admin', - :value => 'foo:bar', - :file_user => 'root', - :file_group => 'gnocchi', - :file_format => 'yaml', - }) - is_expected.to contain_oslo__policy('gnocchi_config').with( - :enforce_scope => false, - :enforce_new_defaults => false, - :policy_file => '/etc/gnocchi/policy.yaml', - :policy_dirs => '/etc/gnocchi/policy.d', - ) + context 'with empty policies and purge_config enabled' do + let :params do + { + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_path => '/etc/gnocchi/policy.yaml', + :policies => {}, + :purge_config => true, + } + end + + it 'set up the policies' do + is_expected.to contain_openstacklib__policy('/etc/gnocchi/policy.yaml').with( + :policies => {}, + :policy_path => '/etc/gnocchi/policy.yaml', + :file_user => 'root', + :file_group => 'gnocchi', + :file_format => 'yaml', + :purge_config => true, + ) + is_expected.to contain_oslo__policy('gnocchi_config').with( + :enforce_scope => false, + :enforce_new_defaults => false, + :policy_file => '/etc/gnocchi/policy.yaml', + ) + end end end