-
Notifications
You must be signed in to change notification settings - Fork 231
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ipasudorule: Add support for batch mode and multiple sudorules #1290
Conversation
@rjeffman Is it possible to add multiple sudorules using a JSON file? |
@varunmylaraiah it should be, as this is handled by Ansible before ansible-freeipa kicks in. |
/azp run CheckPR |
Azure Pipelines successfully started running 1 pipeline(s). |
2cd75a9
to
bb42267
Compare
The pydocstyle check is failing due to a false positive, please, see PR #1310. |
Hi Rafael, I'm seeing an error and not sure what I might be missing here
|
177fa50
to
410ed84
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The PR looks good to me, and downstream tests have passed with this PR
410ed84
to
9ff7bc1
Compare
This patch adds the class EntryFactory to the ansible-freeipa module utils. This class allows the handling of modules with multiple object entries as list of objects. When the multi-object parameter is not used, it creates a list of a single object, allowing for the same code idiom to be used. The entries created can be used both as objects, by acessing the values as properties, or as dictionaires, by accessing the elements as key-value pairs.
23e22c3
to
8feb829
Compare
The tests are lacking the cleanup before the test items are created. This could lead to issues with existing, but conflicting items like for example external users. |
Currently, ipasudorule must add or modify a single sudorule at a time, incurring in more load in the server if there are many rules to be processed. This patch adds suport for adding multiple sudorules in one playbook task by using the parameter 'sudorules' and defining a list of sudorules configurations to be ensured. As multiple sudorules will be processed, the patch also enables batch mode processing of sudorules, trying to reduce the load on the server. Test 'tests/sudorule/test_sudorule_client_context.yml' was modified to include tasks with 'sudorules' to be executed both on the server or on the client context. New tests were added to the sudorule test suite: tests/sudorule/test_sudorules.yml tests/sudorule/test_sudorules_member_case_insensitive.yml
Unless there's a real need to use privileged access or to gather Ansible facts upfront, we should always set "become: false" and "gather_facts: false". In the case that only a few Ansible facts are required, 'ansible.builtin.setup' with 'gather_subset' should be used. As the YAML 1.2 standard dictates, boolean values should only use 'true' or 'false' values. This patch fixes these issues in the 'sudorule' test suite.
8feb829
to
6c94fe9
Compare
@t-woerner test were fixed and TEMP commit removed. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Currently, ipasudorule must add or modify a single sudorule at a time, incurring in more load in the server if there are many rules to be processed.
This patch adds suport for adding multiple sudorules in one playbook task by using the parameter 'sudorules' and defining a list of sudorules configurations to be ensured.
As multiple sudorules will be processed, the patch also enables batch mode processing of sudorules, trying to reduce the load on the server.
To be able to process parameter values in the 'sudorules' dictionary, the method to retrieve parameters from the module in lowercase was refactored, allowing any parameter value, either from the module or from a dict, to be converted.
Test 'tests/sudorule/test_sudorule_client_context.yml' was modified to include tasks with 'sudorules' to be executed both on the server or on the client context.
New tests were added to the sudorule test suite: