starlingx/config
Code Issues Proposed changes
Files
9aee309999c4feb6aa2eaebfc9d139360893ede5
config/sysinv/sysinv/opensuse/sysinv.spec
Joao Victor Portal 9aee309999 Deprecate old policy engine and restrict access 
This commit does two different changes: it changes the policy engine to
oslo_policy and restrict access to sysinv API to users of projects
'admin' or 'services'.

The policy engine deprecated is the one present in the file
"sysinv/sysinv/sysinv/sysinv/openstack/common/policy.py" (780 lines).
This file is no longer used by this repository and was not deleted
because it is used by other repositories, like starlingx/update. The
library oslo_policy is used in its place. In fact, the deprecated engine
seems to be an ancient version of oslo_policy. The library oslo_policy
changed the default format of configuration files from JSON to YAML, so
the configuration files named "policy.json" were changed to
"policy.yaml". The file that initializes and wraps oslo_policy
("sysinv/sysinv/sysinv/sysinv/common/policy.py") contains the minimal
implementation to use this library.

The access to sysinv API, before this commit, was restricted to users
with role "admin" or "administrator" from any project. This commit
restricts the access to users with role "admin" of projects "admin" or
"services". This change should not cause problems, because role
"administrator" doesn't exist and because all users from Starlingx are
from projects "admin" or "services". This change is needed to avoid
access from admin users of other projects.

To test custom policy rules set in the file "/etc/sysinv/policy.yaml",
it will be used the Service Parameter API actions create/apply/modify/
delete/get (commands "system service-parameter-[add/apply/modify/delete/
list]". To test default policy for sysinv API commands, it will be used
the command to change the system description (PATCH "/v1/isystems",
command "system modify --description='test'"). On test plan, these
commands will be reffered as "test commands". Any change in the file
"/etc/sysinv/policy.yaml" is detected by policy engine and rules are
updated.

Test Plan:

PASS: Successfully deploy an AIO-SX using an Debian image with this
commit present. Successfully create, through openstack CLI, the users:
'testreader' with role 'reader' in project 'admin',
'adminsvc' with role 'admin' in project 'services' and
'otheradmin' with role 'admin' in project 'notadminproject'.
Create openrc files for all new users. Note: the other user that will be
used is the already existing 'admin' with role 'admin' in project
'admin'.
PASS: In the deployed AIO-SX, check the behavior of test commands
through different users: for "admin" and "adminsvc" users, all commands
are successful; for user "testreader", only "service-parameter-list"
command is successful and for user "otheradmin" no command is
successful.
PASS: In the deployed AIO-SX, add the following lines in file
"/etc/sysinv/policy.yaml":
config_api:service_parameter:add: role:reader
config_api:service_parameter:apply: role:reader
config_api:service_parameter:delete: role:reader
config_api:service_parameter:get: role:reader
config_api:service_parameter:modify: role:reader
and check the behavior of test commands through different users:
for "admin" and "adminsvc" users, all commands are successful; for users
"testreader" and "otheradmin", all commands are successful except the
change in the system description ("system modify --description='test'").
PASS: In the deployed AIO-SX, to assert that public API works without
authentication, execute the commands:
"curl -v http://<MGMT_IP>:6385/v1/" and
"curl -v http://<MGMT_IP>:6385/v1/isystems/mgmtvlan" and
verify that they are accepted and that the HTTP response is 200,
and execute the commands:
"curl -v http://<MGMT_IP>:6385/v1/isystems/" and
"curl -v http://<MGMT_IP>:6385/v1/service_parameter" and
verify that they are rejected and that the HTTP response is 401.
PASS: Repeat all tests above changing the deploy to AIO-DX using an
CentOS image.
PASS: Successfully execute Debian AIO-SX daily regression and sanity
tests using an image containing this change.

Story: 2010149
Task: 45984

Signed-off-by: Joao Victor Portal <Joao.VictorPortal@windriver.com>
Change-Id: Id7aa387e154afb1441a8484b076cdc97f2fc46cb
2022-08-10 11:18:38 -03:00

196 lines
6.4 KiB
RPMSpec
Raw Blame History

Summary: System Inventory
Name: sysinv
Version: 1.0.0
Release: %{tis_patch_ver}%{?_tis_dist}
License: Apache-2.0
Group: Development/Tools/Other
URL: https://opendev.org/starlingx/update
Source0: %{name}-%{version}.tar.gz
BuildRequires: python-setuptools
BuildRequires: python-pbr
BuildRequires: python2-pip
BuildRequires: systemd
Requires: cgcs-patch
Requires: controllerconfig
Requires: platform-utils
Requires: python-boto3
Requires: python-cephclient
Requires: python-fmclient
Requires: python-parted
Requires: python2-coverage
Requires: python2-docker
Requires: python2-eventlet
Requires: python2-ipaddr
Requires: python2-jsonpatch
Requires: python2-keyring
Requires: python2-keystoneauth1
Requires: python2-keystonemiddleware
Requires: python2-kubernetes
Requires: python2-netaddr
Requires: python2-paste
Requires: python2-rfc3986
Requires: python2-pyudev
Requires: python2-pbr
Requires: python2-psutil
Requires: python2-requests
Requires: python2-retrying
Requires: python2-webob
Requires: python2-WebTest
Requires: python2-WSME
Requires: python2-six
Requires: python2-sqlalchemy
Requires: python2-stevedore
Requires: python2-oslo.i18n
Requires: python2-oslo.config
Requires: python2-oslo.concurrency
Requires: python2-oslo.db
Requires: python2-oslo.log
Requires: python2-oslo.policy
Requires: python2-oslo.rootwrap
Requires: python2-oslo.serialization
Requires: python2-oslo.service
Requires: python2-oslo.utils
Requires: python2-pecan
Requires: tsconfig
%description
StarlingX System Inventory
%define local_bindir /usr/bin/
%define local_etc_goenabledd /etc/goenabled.d/
%define local_etc_sysinv /etc/sysinv/
%define local_etc_motdd /etc/motd.d/
%define pythonroot /usr/lib64/python2.7/site-packages
%define ocf_resourced /usr/lib/ocf/resource.d
%define debug_package %{nil}
%prep
%setup -n %{name}-%{version}/%{name}
# Remove bundled egg-info
rm -rf *.egg-info
%build
export PBR_VERSION=%{version}
%{__python} setup.py build
%install
export PBR_VERSION=%{version}
%{__python} setup.py install --root=%{buildroot} \
--install-lib=%{pythonroot} \
--prefix=/usr \
--install-data=/usr/share \
--single-version-externally-managed
install -d -m 755 %{buildroot}%{local_etc_goenabledd}
install -p -D -m 755 etc/sysinv/sysinv_goenabled_check.sh %{buildroot}%{local_etc_goenabledd}/sysinv_goenabled_check.sh
install -d -m 755 %{buildroot}%{local_etc_sysinv}
install -p -D -m 644 etc/sysinv/policy.yaml %{buildroot}%{local_etc_sysinv}/policy.yaml
install -p -D -m 644 etc/sysinv/crushmap-storage-model.txt %{buildroot}%{local_etc_sysinv}/crushmap-storage-model.txt
install -p -D -m 644 etc/sysinv/crushmap-controller-model.txt %{buildroot}%{local_etc_sysinv}/crushmap-controller-model.txt
install -p -D -m 644 etc/sysinv/crushmap-aio-sx.txt %{buildroot}%{local_etc_sysinv}/crushmap-aio-sx.txt
install -d -m 755 %{buildroot}%{local_etc_motdd}
install -p -D -m 755 etc/sysinv/motd-system %{buildroot}%{local_etc_motdd}/10-system
install -d -m 755 %{buildroot}%{local_etc_sysinv}/upgrades
install -p -D -m 755 etc/sysinv/delete_load.sh %{buildroot}%{local_etc_sysinv}/upgrades/delete_load.sh
install -m 755 -p -D scripts/sysinv-api %{buildroot}/usr/lib/ocf/resource.d/platform/sysinv-api
install -m 755 -p -D scripts/sysinv-conductor %{buildroot}/usr/lib/ocf/resource.d/platform/sysinv-conductor
install -m 644 -p -D scripts/sysinv-api.service %{buildroot}%{_unitdir}/sysinv-api.service
install -m 644 -p -D scripts/sysinv-conductor.service %{buildroot}%{_unitdir}/sysinv-conductor.service
#install -p -D -m 755 %%{buildroot}/usr/bin/sysinv-api %%{buildroot}/usr/bin/sysinv-api
#install -p -D -m 755 %%{buildroot}/usr/bin/sysinv-agent %%{buildroot}/usr/bin/sysinv-agent
#install -p -D -m 755 %%{buildroot}/usr/bin/sysinv-fpga-agent %%{buildroot}/usr/bin/sysinv-fpga-agent
#install -p -D -m 755 %%{buildroot}/usr/bin/sysinv-conductor %%{buildroot}/usr/bin/sysinv-conductor
install -d -m 755 %{buildroot}%{local_bindir}
install -p -D -m 755 scripts/partition_info.sh %{buildroot}%{local_bindir}/partition_info.sh
install -p -D -m 755 scripts/manage-partitions %{buildroot}%{local_bindir}/manage-partitions
install -p -D -m 755 scripts/query_pci_id %{buildroot}%{local_bindir}/query_pci_id
# Add once she-bang is fixed
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/agent.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/conductor.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/dbsync.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/dnsmasq_lease_update.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/helm.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/puppet.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/sysinv_deploy_helper.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/cmd/upgrade.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/openstack/common/rootwrap/cmd.py
#chmod 755 %%{buildroot}%%{pythonroot}/sysinv/openstack/common/rpc/zmq_receiver.py
%clean
echo "CLEAN CALLED"
rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root,-)
%doc LICENSE
%{local_bindir}/*
%{pythonroot}/%{name}
%{pythonroot}/%{name}-%{version}*.egg-info
%dir %{local_etc_goenabledd}
%{local_etc_goenabledd}/*
%dir %{local_etc_sysinv}
%config %{local_etc_sysinv}/*
%dir %{local_etc_motdd}
%{local_etc_motdd}/*
# SM OCF Start/Stop/Monitor Scripts
%dir /usr/lib/ocf
%dir %{ocf_resourced}
%dir %{ocf_resourced}/platform
%{ocf_resourced}/platform/sysinv-api
%{ocf_resourced}/platform/sysinv-conductor
# systemctl service files
%{_unitdir}/sysinv-api.service
%{_unitdir}/sysinv-conductor.service
%{_bindir}/sysinv-agent
%{_bindir}/sysinv-fpga-agent
%{_bindir}/sysinv-api
%{_bindir}/sysinv-conductor
%{_bindir}/sysinv-dbsync
%{_bindir}/sysinv-dnsmasq-lease-update
%{_bindir}/sysinv-rootwrap
%{_bindir}/sysinv-upgrade
%{_bindir}/sysinv-puppet
%{_bindir}/sysinv-helm
%{_bindir}/sysinv-utils
%pre
%service_add_pre sysinv-api.service sysinv-api.target
%service_add_pre sysinv-conductor.service sysinv-conductor.target
%post
%service_add_post sysinv-api.service sysinv-api.target
%service_add_post sysinv-conductor.service sysinv-conductor.target
%preun
%service_del_preun sysinv-api.service sysinv-api.target
%service_del_preun sysinv-conductor.service sysinv-conductor.target
%postun
%service_del_postun sysinv-api.service sysinv-api.target
%service_del_postun sysinv-conductor.service sysinv-conductor.target
%changelog
View Git Blame Copy Permalink