Reviewed: https://review.opendev.org/690630
Committed:
https://git.openstack.org/cgit/openstack/keystone/commit/?id=ba8dd06e123adb353c5bb71d75c345cf3e463ba8
Submitter: Zuul
Branch: master
commit ba8dd06e123adb353c5bb71d75c345cf3e463ba8
Author: Ben Nemec <bne...@redhat.com>
Date: Wed Oct 23 16:11:35 2019 +0000
Parse cli args in get_enforcer
Previously this call to the conf object couldn't parse cli args
because the oslo.policy tool was registering its cli opts on a
private conf object, so attempting to parse them on the global
object would fail. The dependency makes oslo.policy use the global
object instead so cli arg parsing works correctly.
This is important because ignoring cli args as this was previously
doing caused things like --config-file to be dropped, which meant
that running the tool with that option specified did not work as
expected.
Depends-On: https://review.opendev.org/690628
Change-Id: Id553743277a35660a40d6b3b02847d7a35abbfb9
Closes-Bug: 1849518
** Changed in: keystone
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1849518
Title:
oslopolicy-list-redundant loses cli args when used with keystone
Status in OpenStack Identity (keystone):
Fix Released
Status in oslo.policy:
Fix Released
Bug description:
There is an issue with the configuration handling in oslo.policy and
keystone that causes cli args like --config-file to be ignored in the
keystone enforcer when running oslopolicy-list-redundant.
Specifically, because keystone re-initializes the global config object
when creating the enforcer[0], and doesn't pass any cli args to it,
those cli args get ignored. This can cause problems if, for example,
the policy file is not in the default location and is instead
specified in the config file passed via --config-file. Since --config-
file gets ignored by the enforcer, it just looks in the default
location and doesn't find a file.
One solution would be to have oslo.policy initialize the global config
object itself (switching [1] to use the global object instead of a
local one) and remove the initialization from the enforcer entirely.
One potential downside of this is that if a project's enforcer needs
project-specific config setup it wouldn't be possible for that to
happen (oslo.policy wouldn't know about it), but since that doesn't
apply to keystone and would only really be an issue if a project's
enforcer had a dependency on a cli arg (cli args are the only thing
that need to be registered before calling the conf object), I think
it's a worthwhile tradeoff.
0:
https://github.com/openstack/keystone/blob/1ef56e58ec63f19eff25a1044c8831ba8f97e26a/keystone/common/rbac_enforcer/policy.py#L43
1:
https://github.com/openstack/oslo.policy/blob/0f7e144d013155f27f74b0eb91b7ae0f1530a86b/oslo_policy/generator.py#L399
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1849518/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
