1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
# == Class: neutron::policy
#
# Configure the neutron policies
#
# === Parameters
#
# [*enforce_scope*]
# (Optional) Whether or not to enforce scope when evaluating policies.
# Defaults to $facts['os_service_default'].
#
# [*enforce_new_defaults*]
# (Optional) Whether or not to use old deprecated defaults when evaluating
# policies.
# Defaults to $facts['os_service_default'].
#
# [*policies*]
# (Optional) Set of policies to configure for neutron
# Example :
# {
# 'neutron-context_is_admin' => {
# 'key' => 'context_is_admin',
# 'value' => 'true'
# },
# 'neutron-default' => {
# 'key' => 'default',
# 'value' => 'rule:admin_or_owner'
# }
# }
# Defaults to empty hash.
#
# [*policy_path*]
# (Optional) Path to the neutron policy.yaml file
# Defaults to /etc/neutron/policy.yaml
#
# [*policy_default_rule*]
# (Optional) Default rule. Enforced when a requested rule is not found.
# Defaults to $facts['os_service_default'].
#
# [*policy_dirs*]
# (Optional) Path to the neutron policy folder
# Defaults to $facts['os_service_default']
#
# [*purge_config*]
# (optional) Whether to set only the specified policy rules in the policy
# file.
# Defaults to false.
#
class neutron::policy (
$enforce_scope = $facts['os_service_default'],
$enforce_new_defaults = $facts['os_service_default'],
Hash $policies = {},
$policy_path = '/etc/neutron/policy.yaml',
$policy_default_rule = $facts['os_service_default'],
$policy_dirs = $facts['os_service_default'],
Boolean $purge_config = false,
) {
include neutron::deps
include neutron::params
$policy_parameters = {
policies => $policies,
policy_path => $policy_path,
file_user => 'root',
file_group => $::neutron::params::group,
file_format => 'yaml',
purge_config => $purge_config,
tag => 'neutron',
}
create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
# policy config should occur in the config block also.
Anchor['neutron::config::begin']
-> Openstacklib::Policy[$policy_path]
-> Anchor['neutron::config::end']
oslo::policy { 'neutron_config':
enforce_scope => $enforce_scope,
enforce_new_defaults => $enforce_new_defaults,
policy_file => $policy_path,
policy_default_rule => $policy_default_rule,
policy_dirs => $policy_dirs,
}
}
|
