Fix file permissions.
Fixes-bug: PROD-36504
Change-Id: I02edb8108a748fe2e97a5aeddc1a931d824439ad
diff --git a/README.rst b/README.rst
index 75ce582..961e8db 100644
--- a/README.rst
+++ b/README.rst
@@ -1869,6 +1869,37 @@
group: 224.0.0.1
+Change files/directories permissions for neutron service:
+=======================================
+In order to change file permissions the following should be set:
+
+'files' - block to set permissions for files.
+- full path to file
+- user ( default value is 'root' ) this parameter is optional.
+- group ( default value is 'neutron' ) this parameter is optional
+- mode ( default value is '0640' ) this parameter is optional
+
+'directories' - block to set permissions for directories.
+- full path to directory
+- user ( default value is 'root' ) this parameter is optional
+- group ( default value is 'neutron' ) this parameter is optional
+- mode ( default value is '0750' ) this parameter is optional
+
+.. code-block:: yaml
+
+ neutron:
+ files:
+ /etc/neutron/neutron.conf:
+ user: 'root'
+ group: 'neutron'
+ mode: '0750'
+ directories:
+ /etc/neutron:
+ user: 'root'
+ group: 'neutron'
+ mode: '0750'
+
+
Upgrades
========
diff --git a/metadata/service/compute/ovn/single.yml b/metadata/service/compute/ovn/single.yml
index a1fb5bc..eb631b2 100644
--- a/metadata/service/compute/ovn/single.yml
+++ b/metadata/service/compute/ovn/single.yml
@@ -2,6 +2,7 @@
- neutron
classes:
- service.neutron.support
+- service.neutron.file_permissions
parameters:
_param:
ovn_external_bridge: br-floating
diff --git a/metadata/service/compute/single.yml b/metadata/service/compute/single.yml
index 075c9a5..1aa181b 100644
--- a/metadata/service/compute/single.yml
+++ b/metadata/service/compute/single.yml
@@ -2,6 +2,7 @@
- neutron
classes:
- service.neutron.support
+- service.neutron.file_permissions
parameters:
_param:
openstack_log_appender: false
diff --git a/metadata/service/control/cluster.yml b/metadata/service/control/cluster.yml
index f95a0b7..4866cdf 100644
--- a/metadata/service/control/cluster.yml
+++ b/metadata/service/control/cluster.yml
@@ -2,6 +2,7 @@
- neutron
classes:
- service.neutron.support
+- service.neutron.file_permissions
parameters:
_param:
keystone_neutron_endpoint_type: internal
diff --git a/metadata/service/control/single.yml b/metadata/service/control/single.yml
index 44917e3..ca3f783 100644
--- a/metadata/service/control/single.yml
+++ b/metadata/service/control/single.yml
@@ -2,6 +2,7 @@
- neutron
classes:
- service.neutron.support
+- service.neutron.file_permissions
parameters:
_param:
keystone_neutron_endpoint_type: internal
diff --git a/metadata/service/file_permissions.yml b/metadata/service/file_permissions.yml
new file mode 100644
index 0000000..75bc0c5
--- /dev/null
+++ b/metadata/service/file_permissions.yml
@@ -0,0 +1,8 @@
+parameters:
+ neutron:
+ directories:
+ /etc/neutron:
+ mode: '0750'
+ files:
+ /etc/neutron/api-paste.ini:
+ mode: '0640'
diff --git a/metadata/service/gateway/single.yml b/metadata/service/gateway/single.yml
index 5dfa8c4..97314f6 100644
--- a/metadata/service/gateway/single.yml
+++ b/metadata/service/gateway/single.yml
@@ -2,6 +2,7 @@
- neutron
classes:
- service.neutron.support
+- service.neutron.file_permissions
parameters:
_param:
openstack_log_appender: false
diff --git a/neutron/file_permissions.sls b/neutron/file_permissions.sls
new file mode 100644
index 0000000..b456057
--- /dev/null
+++ b/neutron/file_permissions.sls
@@ -0,0 +1,22 @@
+{% if pillar.neutron.files is defined %}
+{%- for file_full_path, file_mode in pillar.neutron.files.iteritems() %}
+{{ file_full_path }}_permissions:
+ file.managed:
+ - name: {{ file_full_path }}
+ - mode: {{ file_mode.get('mode', '0640') }}
+ - user: {{ file_mode.get('user', 'root') }}
+ - group: {{ file_mode.get('group', 'neutron') }}
+ - replace: false
+{%- endfor %}
+{% endif %}
+
+{% if pillar.neutron.directories is defined %}
+{%- for directory_path, directory_mode in pillar.neutron.directories.iteritems() %}
+{{ directory_path }}_permissions:
+ file.directory:
+ - name: {{ directory_path }}
+ - mode: {{ directory_mode.get('mode', '0750') }}
+ - user: {{ directory_mode.get('user', 'root') }}
+ - group: {{ directory_mode.get('group', 'neutron') }}
+{%- endfor %}
+{% endif %}
\ No newline at end of file
diff --git a/neutron/init.sls b/neutron/init.sls
index 811d852..b9003d3 100644
--- a/neutron/init.sls
+++ b/neutron/init.sls
@@ -14,4 +14,5 @@
{% endif %}
{% if pillar.neutron.client is defined %}
- neutron.client
-{% endif %}
\ No newline at end of file
+{% endif %}
+- neutron.file_permissions