Skip to content

Commit b87609b

Browse files
vyzigoldvyzigold
committed
Allow nova_api_audit_map.conf in DefaultConfigOverride
Allow providing a nova_api_audit_map.conf file through the DefaultConfigOverride to NovaAPI.
1 parent 123b74b commit b87609b

10 files changed

Lines changed: 184 additions & 9 deletions

File tree

‎api/bases/nova.openstack.org_nova.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ spec:
7575
additionalProperties:
7676
type: string
7777
description: DefaultConfigOverwrite - interface to overwrite default
78-
config files like e.g. api-paste.ini or policy.yaml.
78+
config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
7979
type: object
8080
networkAttachments:
8181
description: NetworkAttachments is a list of NetworkAttachment

‎api/bases/nova.openstack.org_novaapis.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
additionalProperties:
9090
type: string
9191
description: DefaultConfigOverwrite - interface to overwrite default
92-
config files like e.g. api-paste.ini or policy.yaml.
92+
config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
9393
type: object
9494
keystoneAuthURL:
9595
description: |-

‎api/nova/v1beta1/novaapi_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ type NovaAPITemplate struct {
5454
CustomServiceConfig string `json:"customServiceConfig"`
5555

5656
// +kubebuilder:validation:Optional
57-
// DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini or policy.yaml.
57+
// DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
5858
DefaultConfigOverwrite map[string]string `json:"defaultConfigOverwrite,omitempty"`
5959

6060
// +kubebuilder:validation:Optional
@@ -171,7 +171,7 @@ type NovaAPISpec struct {
171171
TLS tls.API `json:"tls,omitempty"`
172172

173173
// +kubebuilder:validation:Optional
174-
// DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini or policy.yaml.
174+
// DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
175175
DefaultConfigOverwrite map[string]string `json:"defaultConfigOverwrite,omitempty"`
176176

177177
// +kubebuilder:validation:Required

‎api/nova/v1beta1/novaapi_webhook.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func ValidateAPIDefaultConfigOverwrite(
148148
return ValidateDefaultConfigOverwrite(
149149
basePath,
150150
defaultConfigOverwrite,
151-
[]string{"policy.yaml", "api-paste.ini"})
151+
[]string{"policy.yaml", "api-paste.ini", "nova_api_audit_map.conf"})
152152
}
153153

154154
// ValidateTopology validates the referenced TopoRef.Namespace.

‎config/crd/bases/nova.openstack.org_nova.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ spec:
7575
additionalProperties:
7676
type: string
7777
description: DefaultConfigOverwrite - interface to overwrite default
78-
config files like e.g. api-paste.ini or policy.yaml.
78+
config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
7979
type: object
8080
networkAttachments:
8181
description: NetworkAttachments is a list of NetworkAttachment

‎config/crd/bases/nova.openstack.org_novaapis.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
additionalProperties:
9090
type: string
9191
description: DefaultConfigOverwrite - interface to overwrite default
92-
config files like e.g. api-paste.ini or policy.yaml.
92+
config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf.
9393
type: object
9494
keystoneAuthURL:
9595
description: |-

‎templates/nova/api/config/nova-api-config.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,13 @@
8383
"dest": "/etc/my.cnf",
8484
"owner": "nova",
8585
"perm": "0644"
86+
},
87+
{
88+
"source": "/var/lib/openstack/config/nova_api_audit_map.conf",
89+
"dest": "/etc/nova/nova_api_audit_map.conf",
90+
"owner": "nova",
91+
"perm": "0600",
92+
"optional": true
8693
}
8794
],
8895
"permissions": [

‎test/functional/nova/validation_webhook_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -726,7 +726,7 @@ var _ = Describe("Nova validation", func() {
726726
ContainSubstring(
727727
"invalid: spec.defaultConfigOverwrite: " +
728728
"Invalid value: \"foo.conf\": Only the following keys " +
729-
"are valid: policy.yaml, api-paste.ini",
729+
"are valid: policy.yaml, api-paste.ini, nova_api_audit_map.conf",
730730
),
731731
)
732732
})
@@ -764,7 +764,7 @@ var _ = Describe("Nova validation", func() {
764764
ContainSubstring(
765765
"invalid: spec.apiServiceTemplate.defaultConfigOverwrite: " +
766766
"Invalid value: \"provider.yaml\": Only the following " +
767-
"keys are valid: policy.yaml, api-paste.ini"),
767+
"keys are valid: policy.yaml, api-paste.ini, nova_api_audit_map.conf"),
768768
)
769769
})
770770

‎test/kuttl/test-suites/default/config-tests/01-assert.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,7 @@ commands:
142142
set -euxo pipefail
143143
RP_UUID=$(oc exec -n $NAMESPACE openstackclient -- openstack resource provider list --name nova-kuttl-cell1-compute-fake1-compute-0 -f value -c uuid)
144144
oc exec -n $NAMESPACE openstackclient -- openstack resource provider trait list $RP_UUID | grep CUSTOM_FOO
145+
- script: |
146+
set -euxo pipefail
147+
oc exec -n $NAMESPACE openstackclient -- openstack server list
148+
oc logs -n $NAMESPACE nova-api-0 | grep oslo.messaging.notification

‎test/kuttl/test-suites/default/config-tests/01-deploy-with-default-config-overwrite.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,170 @@ spec:
88
defaultConfigOverwrite:
99
policy.yaml: |
1010
"os_compute_api:os-flavor-manage:create": "!"
11+
api-paste.ini: |
12+
############
13+
# Metadata #
14+
############
15+
[composite:metadata]
16+
use = egg:Paste#urlmap
17+
/: meta
18+
19+
[pipeline:meta]
20+
pipeline = cors http_proxy_to_wsgi metaapp
21+
22+
[app:metaapp]
23+
paste.app_factory = nova.api.metadata.handler:MetadataRequestHandler.factory
24+
25+
#############
26+
# OpenStack #
27+
#############
28+
29+
[composite:osapi_compute]
30+
use = call:nova.api.openstack.urlmap:urlmap_factory
31+
/: oscomputeversions
32+
/v2: oscomputeversion_legacy_v2
33+
/v2.1: oscomputeversion_v2
34+
/v2/+: openstack_compute_api_v21_legacy_v2_compatible
35+
/v2.1/+: openstack_compute_api_v21
36+
37+
[composite:openstack_compute_api_v21]
38+
use = call:nova.api.auth:pipeline_factory_v21
39+
keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext audit osapi_compute_app_v21
40+
noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 audit osapi_compute_app_v21
41+
42+
[composite:openstack_compute_api_v21_legacy_v2_compatible]
43+
use = call:nova.api.auth:pipeline_factory_v21
44+
keystone = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler authtoken keystonecontext legacy_v2_compatible audit osapi_compute_app_v21
45+
noauth2 = cors http_proxy_to_wsgi compute_req_id faultwrap request_log sizelimit osprofiler noauth2 legacy_v2_compatible audit osapi_compute_app_v21
46+
47+
[filter:request_log]
48+
paste.filter_factory = nova.api.openstack.requestlog:RequestLog.factory
49+
50+
[filter:compute_req_id]
51+
paste.filter_factory = nova.api.compute_req_id:ComputeReqIdMiddleware.factory
52+
53+
[filter:faultwrap]
54+
paste.filter_factory = nova.api.openstack:FaultWrapper.factory
55+
56+
[filter:noauth2]
57+
paste.filter_factory = nova.api.openstack.auth:NoAuthMiddleware.factory
58+
59+
[filter:osprofiler]
60+
paste.filter_factory = nova.profiler:WsgiMiddleware.factory
61+
62+
[filter:sizelimit]
63+
paste.filter_factory = oslo_middleware:RequestBodySizeLimiter.factory
64+
65+
[filter:http_proxy_to_wsgi]
66+
paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
67+
68+
[filter:legacy_v2_compatible]
69+
paste.filter_factory = nova.api.openstack:LegacyV2CompatibleWrapper.factory
70+
71+
[app:osapi_compute_app_v21]
72+
paste.app_factory = nova.api.openstack.compute:APIRouterV21.factory
73+
74+
[pipeline:oscomputeversions]
75+
pipeline = cors faultwrap request_log http_proxy_to_wsgi oscomputeversionapp
76+
77+
[pipeline:oscomputeversion_v2]
78+
pipeline = cors compute_req_id faultwrap request_log http_proxy_to_wsgi oscomputeversionapp_v2
79+
80+
[pipeline:oscomputeversion_legacy_v2]
81+
pipeline = cors compute_req_id faultwrap request_log http_proxy_to_wsgi legacy_v2_compatible oscomputeversionapp_v2
82+
83+
[app:oscomputeversionapp]
84+
paste.app_factory = nova.api.openstack.compute.versions:Versions.factory
85+
86+
[app:oscomputeversionapp_v2]
87+
paste.app_factory = nova.api.openstack.compute.versions:VersionsV2.factory
88+
89+
##########
90+
# Shared #
91+
##########
92+
93+
[filter:cors]
94+
paste.filter_factory = oslo_middleware.cors:filter_factory
95+
oslo_config_project = nova
96+
97+
[filter:keystonecontext]
98+
paste.filter_factory = nova.api.auth:NovaKeystoneContext.factory
99+
100+
[filter:authtoken]
101+
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
102+
103+
[filter:audit]
104+
paste.filter_factory = keystonemiddleware.audit:filter_factory
105+
audit_map_file = /etc/nova/nova_api_audit_map.conf
106+
nova_api_audit_map.conf: |
107+
[DEFAULT]
108+
target_endpoint_type = None
109+
110+
[custom_actions]
111+
enable = enable
112+
disable = disable
113+
delete = delete
114+
startup = start/startup
115+
shutdown = stop/shutdown
116+
reboot = start/reboot
117+
os-migrations/get = read
118+
os-server-password/post = update
119+
120+
[path_keywords]
121+
add = None
122+
action = None
123+
enable = None
124+
disable = None
125+
configure-project = None
126+
defaults = None
127+
delete = None
128+
detail = None
129+
diagnostics = None
130+
entries = entry
131+
extensions = alias
132+
flavors = flavor
133+
images = image
134+
ips = label
135+
limits = None
136+
metadata = key
137+
os-agents = os-agent
138+
os-aggregates = os-aggregate
139+
os-availability-zone = None
140+
os-certificates = None
141+
os-cloudpipe = None
142+
os-fixed-ips = ip
143+
os-extra_specs = key
144+
os-flavor-access = None
145+
os-floating-ip-dns = domain
146+
os-floating-ips-bulk = host
147+
os-floating-ip-pools = None
148+
os-floating-ips = floating-ip
149+
os-hosts = host
150+
os-hypervisors = hypervisor
151+
os-instance-actions = instance-action
152+
os-keypairs = keypair
153+
os-migrations = None
154+
os-networks = network
155+
os-quota-sets = tenant
156+
os-security-groups = security_group
157+
os-security-group-rules = rule
158+
os-server-password = None
159+
os-services = None
160+
os-simple-tenant-usage = tenant
161+
os-virtual-interfaces = None
162+
os-volume_attachments = attachment
163+
os-volumes_boot = None
164+
os-volumes = volume
165+
os-volume-types = volume-type
166+
os-snapshots = snapshot
167+
reboot = None
168+
servers = server
169+
shutdown = None
170+
startup = None
171+
statistics = None
172+
173+
[service_endpoints]
174+
compute = service/compute
11175
cellTemplates:
12176
cell0:
13177
cellDatabaseInstance: openstack

0 commit comments

Comments
 (0)