openstack/puppet-heat
Code Issues Proposed changes

Allow purging policy files

Browse Source 
This change introduces the new purge_config parameter to the policy
class so that any policy rules not managed by puppet manifests can be
cleared.

Co-Authored-By: Martin Schuppert <mschuppert@redhat.com>
Depends-On: https://review.opendev.org/802305
Change-Id: Ife9db20f914ae773881f4c78871b8232ecf42d17
This commit is contained in:
Takashi Kajinami 2021-09-04 22:03:31 +09:00
parent 93bc3cf679
commit b7d4441ce9
3 changed files with 82 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
manifests/policy.pp
View File

@ -36,12 +36,18 @@
# (Optional) Path to the heat policy folder
# Defaults to $::os_service_default
#
# [*purge_config*]
# (optional) Whether to set only the specified policy rules in the policy
# file.
# Defaults to false.
#
class heat::policy (
$enforce_scope = $::os_service_default,
$enforce_new_defaults = $::os_service_default,
$policies = {},
$policy_path = '/etc/heat/policy.yaml',
$policy_dirs = $::os_service_default,
$purge_config = false,
) {
include heat::deps
@ -49,14 +55,16 @@ class heat::policy (
validate_legacy(Hash, 'validate_hash', $policies)
Openstacklib::Policy::Base {
file_path => $policy_path,
$policy_parameters = {
policies => $policies,
policy_path => $policy_path,
file_user => 'root',
file_group => $::heat::params::group,
file_format => 'yaml',
purge_config => $purge_config,
}
create_resources('openstacklib::policy::base', $policies)
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
oslo::policy { 'heat_config':
enforce_scope => $enforce_scope,

6
releasenotes/notes/policy_purge_config-9d835d1c097c621b.yaml Normal file
View File

@ -0,0 +1,6 @@
---
features:
- |
Adds new purge_config parameter. When set to true, the policy file is
cleared during configuration process. This allows to remove any existing
rules before applying them or clean the file when all policies got removed.

45
spec/classes/heat_policy_spec.rb
View File

@ -2,6 +2,8 @@ require 'spec_helper'
describe 'heat::policy' do
shared_examples 'heat::policy' do
context 'setup policy with parameters' do
let :params do
{
:enforce_scope => false,
@ -18,13 +20,19 @@ describe 'heat::policy' do
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
:key => 'context_is_admin',
:value => 'foo:bar',
is_expected.to contain_openstacklib__policy('/etc/heat/policy.yaml').with(
:policies => {
'context_is_admin' => {
'key' => 'context_is_admin',
'value' => 'foo:bar'
}
},
:policy_path => '/etc/heat/policy.yaml',
:file_user => 'root',
:file_group => 'heat',
:file_format => 'yaml',
})
:purge_config => false,
)
is_expected.to contain_oslo__policy('heat_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
@ -34,6 +42,35 @@ describe 'heat::policy' do
end
end
context 'with empty policies and purge_config enabled' do
let :params do
{
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_path => '/etc/heat/policy.yaml',
:policies => {},
:purge_config => true,
}
end
it 'set up the policies' do
is_expected.to contain_openstacklib__policy('/etc/heat/policy.yaml').with(
:policies => {},
:policy_path => '/etc/heat/policy.yaml',
:file_user => 'root',
:file_group => 'heat',
:file_format => 'yaml',
:purge_config => true,
)
is_expected.to contain_oslo__policy('heat_config').with(
:enforce_scope => false,
:enforce_new_defaults => false,
:policy_file => '/etc/heat/policy.yaml',
)
end
end
end
on_supported_os({
:supported_os => OSDefaults.get_supported_os
}).each do |os,facts|