mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-03-20 03:57:02 +08:00
[ansible-lint] prefix variable names for rabbit/user role
ansible-lint requires that variables for roles are prefixed with the name of the role. This commit prefixes the variables for the rabbit/user role with user_ as required by ansible-lint Signed-off-by: Ryan Lerch <rlerch@redhat.com>
This commit is contained in:
committed by
Aurélien Bompard
parent
cae52420bb
commit
4a4e7e07cb
@@ -1,23 +1,23 @@
|
||||
---
|
||||
rabbitmq_server: "rabbitmq01{{ env_suffix }}.iad2.fedoraproject.org"
|
||||
vhost: /pubsub
|
||||
publish_only: true
|
||||
user_rabbitmq_server: "rabbitmq01{{ env_suffix }}.iad2.fedoraproject.org"
|
||||
user_vhost: /pubsub
|
||||
user_publish_only: true
|
||||
|
||||
# Read privileges:
|
||||
# If publish_only: no reading. Otherwise, read from queues prefixed
|
||||
# with their name and bind to the topic exchange
|
||||
read_priv: "{{ publish_only|ternary('^$', '^(zmq\\.topic)|^(amq\\.topic)|(' + username + '.*)$') }}"
|
||||
user_read_priv: "{{ user_publish_only|ternary('^$', '^(zmq\\.topic)|^(amq\\.topic)|(' + user_username + '.*)$') }}"
|
||||
|
||||
# Write privileges:
|
||||
# If publish_only: only write to the exchange. Otherwise, write to
|
||||
# queues prefixed with their name and any prefixes in write_queues,
|
||||
# and publish to the topic exchange
|
||||
write_priv: "^(amq\\.topic){% if not publish_only %}|({{ username }}.*){% for queue in write_queues|default([]) %}|({{ queue }}.*){% endfor %}{% endif %}$"
|
||||
user_write_priv: "^(amq\\.topic){% if not user_publish_only %}|({{ username }}.*){% for queue in write_queues|default([]) %}|({{ queue }}.*){% endfor %}{% endif %}$"
|
||||
|
||||
# Topic authorization:
|
||||
# Ref: https://www.rabbitmq.com/access-control.html#topic-authorisation
|
||||
sent_topics: .*
|
||||
topic_permissions:
|
||||
user_sent_topics: .*
|
||||
user_topic_permissions:
|
||||
- vhost: "{{ vhost }}"
|
||||
read_priv: .*
|
||||
write_priv: "{{ sent_topics }}"
|
||||
|
||||
@@ -17,13 +17,13 @@
|
||||
# See https://www.rabbitmq.com/access-control.html#permissions for details on
|
||||
# the RabbitMQ permissions configuration.
|
||||
|
||||
- name: Validate username {{ username }}
|
||||
- name: Validate username {{ user_username }}
|
||||
assert:
|
||||
that:
|
||||
- username is defined
|
||||
- username != "admin"
|
||||
- username != "guest"
|
||||
- username != "nagios-monitoring"
|
||||
- user_username is defined
|
||||
- user_username != "admin"
|
||||
- user_username != "guest"
|
||||
- user_username != "nagios-monitoring"
|
||||
fail_msg: "This user name is reserved"
|
||||
tags:
|
||||
- config
|
||||
@@ -31,7 +31,7 @@
|
||||
- rabbitmq_cluster
|
||||
|
||||
- debug:
|
||||
msg: "Topic permissions: {{ topic_permissions }}"
|
||||
msg: "Topic permissions: {{ user_topic_permissions }}"
|
||||
tags:
|
||||
- config
|
||||
- fedora-messaging
|
||||
@@ -39,15 +39,15 @@
|
||||
|
||||
# See https://www.rabbitmq.com/access-control.html#permissions for details on
|
||||
# the RabbitMQ permissions configuration.
|
||||
- name: Create the {{ username }} user in RabbitMQ
|
||||
delegate_to: "{{ rabbitmq_server }}"
|
||||
- name: Create the {{ user_username }} user in RabbitMQ
|
||||
delegate_to: "{{ user_rabbitmq_server }}"
|
||||
community.rabbitmq.rabbitmq_user:
|
||||
user: "{{ username }}"
|
||||
vhost: "{{ vhost }}"
|
||||
read_priv: "{{ read_priv }}"
|
||||
write_priv: "{{ write_priv }}"
|
||||
user: "{{ user_username }}"
|
||||
vhost: "{{ user_vhost }}"
|
||||
read_priv: "{{ user_read_priv }}"
|
||||
write_priv: "{{ user_write_priv }}"
|
||||
configure_priv: "^$" # No configuration permissions
|
||||
topic_permissions: "{{ topic_permissions }}"
|
||||
topic_permissions: "{{ user_topic_permissions }}"
|
||||
state: present
|
||||
tags:
|
||||
- config
|
||||
|
||||
Reference in New Issue
Block a user