Add support for constrained extension policy #3589
Open
mgunnala wants to merge 5 commits into
Open
Conversation
mgunnala
requested review from
ZhidongPeng,
maddieford,
nagworld9 and
narrieta
as code owners
narrieta
reviewed
Apr 13, 2026
| self._policy_engine.check_extension_policy(ext_handler_i.ext_handler.name, extension_is_signed) | ||
|
|
||
| # Create runtime policy file for extension before enabling | ||
| self._policy_engine.create_runtime_policy_file(ext_handler_i) |
Contributor
There was a problem hiding this comment.
Let's have the calls to update_settings and create_runtime_policy_file in two consecutive lines, i.e. move this one a few lines below and the one above as part of __setup_new_handler
| self._policy_engine.check_extension_policy(ext_handler_i.ext_handler.name, extension_is_signed) | ||
|
|
||
| # Create runtime policy file for extension before enabling | ||
| self._policy_engine.create_runtime_policy_file(ext_handler_i) |
Contributor
There was a problem hiding this comment.
The extension handler should get the policy from the policy engine and create the file, instead of the policy engine having knowledge/dependencies of the extension manifest, config directory, etc
| return | ||
|
|
||
| runtime_policy_file_path = ext_handler_i.get_runtime_policy_file() | ||
| supports_policy = ext_handler_i.load_manifest().supports_policy() |
Contributor
There was a problem hiding this comment.
we need some validation when reading the extension manifest
| self.patch_is_cvm.start() | ||
| self.maxDiff = None # When long error messages don't match, display the entire diff. | ||
|
|
||
| self.runtime_policy_path = os.path.join(conf.get_lib_dir(), "OSTCExtensions.ExampleHandlerLinux-1.0.0", "config", "waagent_runtime_policy.json") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Issue #
This PR adds support for constrained extension (runtime) policy. If "runtimePolicy" is specified for an extension in the policy file, and the extension supports runtime policy, the agent writes this policy to a file in the extension's config directory.
Behavior:
PR information
developbranch.Quality of Code and Contribution Guidelines
Distro maintenance information, if applicable