Re: define Classes

Thank's  it's ok!!!!

Le lundi 17 mai 2021 à 17:19:36 UTC+2, Nick Anderson a écrit :

> thierry thunot <[email protected]> writes: 
>
> Hi, 
>
> I see a few things here. 
>
> In your *access* promise, admit_keys looks to be iterating ( note the use 
> of $( ), so, if it were working, I would only expect the last key in the 
> list to be authorized. 
>
> bundle server  regles_controle_acces{
>   access:
>     any::
>
> #      .....
>
>
>       "$(def.env_pc_tthunot_prod_acces[path])"
>         handle => "$(def.env_pc_tthunot_prod_acces[handle])",
>         shortcut => "$(def.env_pc_tthunot_prod_acces[shortcut])",
>         comment => "$(def.env_pc_tthunot_prod_acces[comment])",
>         admit_keys => { "$(def.env_pc_tthunot_prod_acces[admit_keys])"};
>
> #      ....}
>
> I would try to use the @( notation, but I am unsure if that will work 
> directly. It's possible that you would need to extract it into a list and 
> reference that. 
>
> bundle server  regles_controle_acces{
>   access:
>     any::
>
> #      .....
>
>
>       "$(def.env_pc_tthunot_prod_acces[path])"
>         handle => "$(def.env_pc_tthunot_prod_acces[handle])",
>         shortcut => "$(def.env_pc_tthunot_prod_acces[shortcut])",
>         comment => "$(def.env_pc_tthunot_prod_acces[comment])"
>
> ,
>         admit_keys => { "@(def.env_pc_tthunot_prod_acces[admit_keys])"};#      ....}
>
> Perhaps: 
>
> bundle server  regles_controle_acces{
>   vars:
>     "my_keys_allowed_to_access" slist => getvalues( "def.env_pc_tthunot_prod_acces[admit_keys]" );
>   access:
>     any::#      .....
>
>
>       "$(def.env_pc_tthunot_prod_acces[path])"
>         handle => "$(def.env_pc_tthunot_prod_acces[handle])",
>         shortcut => "$(def.env_pc_tthunot_prod_acces[shortcut])",
>         comment => "$(def.env_pc_tthunot_prod_acces[comment])"
>
> ,
>         admit_keys => { "@(my_keys_allowed_to_access)"};#      ....}
>
> With your policy to set a class for the environment: 
> Listing 1: Example Policy
>
> classes:
>    "env_pc_tthunot_preprod" or => {"@(def.env_pc_tthunot_preprod_acces[admit_keys])",};
>       "env_pc_tthunot_prod" or => {"@(def.env_pc_tthunot_prod_acces[admit_keys])", };
>
> @(def.env_pc_tthunot_prod_acces[admit_keys]) should resolve to a list of 
> strings for your host IDs, e.g, "MD5=e7df0693fd20ede7fbc13ac8e5d8d5", 
> "MD5=a312e43c410f587320d845ee98b7". Note, = is not a valid character in 
> class names, also even canonified, I would not expect there to be a class 
> matching MD5_a312e43c410f587320d845ee98b7 by default. There should be a 
> class that is prefixed with PK_ followed by the canonified key digest, 
> e.g. PK_MD5_a312e43c410f587320d845ee98b7. 
>
> A couple options come to mind: 
>
>    - Use some() 
>    <https://docs.cfengine.com/docs/master/reference-functions-some.html> 
>    to search the list based on regular expression for an entry matching the 
>    host, e.g. some("$(sys.key_digest)", 
>    "def.env_pc_tthunot_prepod_access[admit_keys]") 
>    - Use maplist() 
>    <https://docs.cfengine.com/docs/master/reference-functions-maplist.html> 
>    to transform the list on the fly from a list of Key IDs to the list of 
>    class names that correlate to the keys (prefixing with PK_ and 
>    canonifying the key digest. 
>
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/56b1473e-0d22-4d32-a511-f83cb0bbc987n%40googlegroups.com.