Andrew Bogott has submitted this change and it was merged.
Change subject: Add a couple of missing files from designate/Juno
......................................................................
Add a couple of missing files from designate/Juno
Bug: T104587
Change-Id: I80a3236d22c40b89ba1cf0521fdb8ccf528c8c11
---
A modules/openstack/files/juno/designate/policy.json
A modules/openstack/files/juno/designate/rootwrap.conf
2 files changed, 121 insertions(+), 0 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/openstack/files/juno/designate/policy.json
b/modules/openstack/files/juno/designate/policy.json
new file mode 100644
index 0000000..9d96379
--- /dev/null
+++ b/modules/openstack/files/juno/designate/policy.json
@@ -0,0 +1,94 @@
+{
+ "admin": "role:admin or is_admin:True",
+ "owner": "tenant:%(tenant_id)s",
+ "admin_or_owner": "rule:admin or rule:owner",
+ "target": "tenant:%(target_tenant_id)s",
+ "owner_or_target":"rule:target or rule:owner",
+ "admin_or_owner_or_target":"rule:owner_or_target or rule:admin",
+ "admin_or_target":"rule:admin or rule:target",
+
+ "default": "rule:admin_or_owner",
+
+ "all_tenants": "rule:admin",
+
+ "use_low_ttl": "rule:admin",
+
+ "get_quotas": "rule:admin_or_owner",
+ "get_quota": "rule:admin_or_owner",
+ "set_quota": "rule:admin",
+ "reset_quotas": "rule:admin",
+
+ "create_tld": "rule:admin",
+ "find_tlds": "rule:admin",
+ "get_tld": "rule:admin",
+ "update_tld": "rule:admin",
+ "delete_tld": "rule:admin",
+
+ "create_tsigkey": "rule:admin",
+ "find_tsigkeys": "rule:admin",
+ "get_tsigkey": "rule:admin",
+ "update_tsigkey": "rule:admin",
+ "delete_tsigkey": "rule:admin",
+
+ "find_tenants": "rule:admin",
+ "get_tenant": "rule:admin",
+ "count_tenants": "rule:admin",
+
+ "create_domain": "rule:admin_or_owner",
+ "get_domains": "rule:admin_or_owner",
+ "get_domain": "rule:admin_or_owner",
+ "get_domain_servers": "rule:admin_or_owner",
+ "find_domains": "rule:admin_or_owner",
+ "find_domain": "rule:admin_or_owner",
+ "update_domain": "rule:admin_or_owner",
+ "delete_domain": "rule:admin_or_owner",
+ "abandon_domain": "rule:admin",
+ "count_domains": "rule:admin_or_owner",
+ "touch_domain": "rule:admin_or_owner",
+
+ "create_record": "rule:admin_or_owner",
+ "get_records": "rule:admin_or_owner",
+ "get_record": "rule:admin_or_owner",
+ "find_records": "rule:admin_or_owner",
+ "find_record": "rule:admin_or_owner",
+ "update_record": "rule:admin_or_owner",
+ "delete_record": "rule:admin_or_owner",
+ "count_records": "rule:admin_or_owner",
+
+ "use_sudo": "rule:admin",
+
+ "create_blacklist": "rule:admin",
+ "find_blacklist": "rule:admin",
+ "find_blacklists": "rule:admin",
+ "get_blacklist": "rule:admin",
+ "update_blacklist": "rule:admin",
+ "delete_blacklist": "rule:admin",
+ "use_blacklisted_domain": "rule:admin",
+
+ "create_pool": "rule:admin",
+ "find_pools": "rule:admin",
+ "find_pool": "rule:admin",
+ "get_pool": "rule:admin",
+ "update_pool": "rule:admin",
+ "delete_pool": "rule:admin",
+
+ "diagnostics_ping": "rule:admin",
+ "diagnostics_sync_domains": "rule:admin",
+ "diagnostics_sync_domain": "rule:admin",
+ "diagnostics_sync_record": "rule:admin",
+
+ "create_zone_transfer_request": "rule:admin_or_owner",
+ "get_zone_transfer_request": "rule:admin_or_owner or
tenant:%(target_tenant_id)s or None:%(target_tenant_id)s",
+ "get_zone_transfer_request_detailed": "rule:admin_or_owner",
+ "find_zone_transfer_requests": "@",
+ "find_zone_transfer_request": "@",
+ "update_zone_transfer_request": "rule:admin_or_owner",
+ "delete_zone_transfer_request": "rule:admin_or_owner",
+
+ "create_zone_transfer_accept": "rule:admin_or_owner or
tenant:%(target_tenant_id)s or None:%(target_tenant_id)s",
+ "get_zone_transfer_accept": "rule:admin_or_owner",
+ "find_zone_transfer_accepts": "rule:admin",
+ "find_zone_transfer_accept": "rule:admin",
+ "update_zone_transfer_accept": "rule:admin",
+ "delete_zone_transfer_accept": "rule:admin"
+}
diff --git a/modules/openstack/files/juno/designate/rootwrap.conf
b/modules/openstack/files/juno/designate/rootwrap.conf
new file mode 100644
index 0000000..79bfb40
--- /dev/null
+++ b/modules/openstack/files/juno/designate/rootwrap.conf
@@ -0,0 +1,27 @@
+# Configuration for designate-rootwrap
+# This file should be owned by (and only-writeable by) the root user
+
+[DEFAULT]
+# List of directories to load filter definitions from (separated by ',').
+# These directories MUST all be only writeable by root !
+filters_path=/etc/designate/rootwrap.d,/usr/share/designate/rootwrap
+
+# List of directories to search executables in, in case filters do not
+# explicitely specify a full path (separated by ',')
+# If not specified, defaults to system PATH environment variable.
+# These directories MUST all be only writeable by root !
+exec_dirs=/sbin,/usr/sbin,/bin,/usr/bin
+
+# Enable logging to syslog
+# Default value is False
+use_syslog=False
+
+# Which syslog facility to use.
+# Valid values include auth, authpriv, syslog, user0, user1...
+# Default value is 'syslog'
+syslog_log_facility=syslog
+
+# Which messages to log.
+# INFO means log all usage
+# ERROR means only log unsuccessful attempts
+syslog_log_level=ERROR
--
To view, visit https://gerrit.wikimedia.org/r/234050
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I80a3236d22c40b89ba1cf0521fdb8ccf528c8c11
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
