Merge "Add support for policy settings of ironic-inspector"

manifests/inspector.pp

@@ -319,6 +319,7 @@ class ironic::inspector (
   include ironic::params
   include ironic::pxe::common
   include ironic::inspector::db
+  include ironic::inspector::policy
   include ironic::inspector::swift
   include ironic::inspector::ironic
 

manifests/inspector/policy.pp

@@ -0,0 +1,68 @@
+# == Class: ironic::inspector::policy
+#
+# Configure the ironic-inspector policies
+#
+# === Parameters
+#
+# [*enforce_scope*]
+#  (Optional) Whether or not to enforce scope when evaluating policies.
+#  Defaults to $::os_service_default.
+#
+# [*enforce_new_defaults*]
+#  (Optional) Whether or not to use old deprecated defaults when evaluating
+#  policies.
+#  Defaults to $::os_service_default.
+#
+# [*policies*]
+#   (Optional) Set of policies to configure for ironic-inspector
+#   Example :
+#     {
+#       'ironic_inspector-context_is_admin' => {
+#         'key' => 'context_is_admin',
+#         'value' => 'true'
+#       },
+#       'ironic_inspector-default' => {
+#         'key' => 'default',
+#         'value' => 'rule:admin_or_owner'
+#       }
+#     }
+#   Defaults to empty hash.
+#
+# [*policy_path*]
+#   (Optional) Path to the ironic-inspector policy.yaml file
+#   Defaults to /etc/ironic-inspector/policy.yaml
+#
+# [*policy_dirs*]
+#   (Optional) Path to the ironic-inspector policy folder
+#   Defaults to $::os_service_default
+#
+class ironic::inspector::policy (
+  $enforce_scope        = $::os_service_default,
+  $enforce_new_defaults = $::os_service_default,
+  $policies             = {},
+  $policy_path          = '/etc/ironic-inspector/policy.yaml',
+  $policy_dirs          = $::os_service_default,
+) {
+
+  include ironic::deps
+  include ironic::params
+
+  validate_legacy(Hash, 'validate_hash', $policies)
+
+  Openstacklib::Policy::Base {
+    file_path   => $policy_path,
+    file_user   => 'root',
+    file_group  => $::ironic::params::group,
+    file_format => 'yaml',
+  }
+
+  create_resources('openstacklib::policy::base', $policies)
+
+  oslo::policy { 'ironic_inspector_config':
+    enforce_scope        => $enforce_scope,
+    enforce_new_defaults => $enforce_new_defaults,
+    policy_file          => $policy_path,
+    policy_dirs          => $policy_dirs,
+  }
+
+}

releasenotes/notes/ironic-inspector-policy-a2573003212dd2be.yaml

@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The new ``ironic::inspector::policy`` class has been added to support
+    policy settings for ironic-inspector.

spec/classes/ironic_inspector_policy_spec.rb

@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe 'ironic::inspector::policy' do
+  shared_examples 'ironic::inspector::policy' do
+    let :params do
+      {
+        :enforce_scope        => false,
+        :enforce_new_defaults => false,
+        :policy_path          => '/etc/ironic-inspector/policy.yaml',
+        :policy_dirs          => '/etc/ironic-inspector/policy.d',
+        :policies             => {
+          'context_is_admin' => {
+            'key'   => 'context_is_admin',
+            'value' => 'foo:bar'
+          }
+        }
+      }
+    end
+
+    it 'set up the policies' do
+      is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
+        :key         => 'context_is_admin',
+        :value       => 'foo:bar',
+        :file_user   => 'root',
+        :file_group  => 'ironic',
+        :file_format => 'yaml',
+      })
+      is_expected.to contain_oslo__policy('ironic_inspector_config').with(
+        :enforce_scope        => false,
+        :enforce_new_defaults => false,
+        :policy_file          => '/etc/ironic-inspector/policy.yaml',
+        :policy_dirs          => '/etc/ironic-inspector/policy.d',
+      )
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_behaves_like 'ironic::inspector::policy'
+    end
+  end
+end