The following is a sample Patrole configuration for adaptation and use. It is auto-generated from Patrole when this documentation is built, so if you are having issues with an option, please compare your version of Patrole with the version of this documentation.
Note that the Patrole configuration options actually live inside the Tempest configuration file; at runtime, Tempest populates its own configuration file with Patrole groups and options, assuming that Patrole is correctly installed and recognized as a plugin.
The sample configuration can also be viewed in file form.
[DEFAULT]
[patrole]
#
# From patrole.config
#
# The current RBAC role against which to run Patrole
# tests. (string value)
#rbac_test_role = admin
# Enables RBAC tests. (boolean value)
#enable_rbac = true
# DEPRECATED: If true, throws RbacParsingException for policies which
# don't exist or are not included in the service's policy file. If
# false, throws
# skipException. (boolean value)
# This option is deprecated for removal.
# Its value may be silently ignored in the future.
# Reason: This option allows for the possibility
# of false positives. As a testing framework, Patrole should fail any
# test that
# passes in an invalid policy.
#strict_policy_check = true
# List of the paths to search for policy files. Each
# policy path assumes that the service name is included in the path
# once. Also
# assumes Patrole is on the same host as the policy files. The paths
# should be
# ordered by precedence, with high-priority paths before low-priority
# paths. The
# first path that is found to contain the service's policy file will
# be used.
# (list value)
#custom_policy_files = /etc/%s/policy.json
#
# This option determines whether Patrole should run against a
# `custom_requirements_file` which defines RBAC requirements. The
# purpose of setting this flag to True is to verify that RBAC policy
# is in accordance to requirements. The idea is that the
# `custom_requirements_file` perfectly defines what the RBAC
# requirements are.
#
# Here are the possible outcomes when running the Patrole tests
# against
# a `custom_requirements_file`:
#
# YAML definition: allowed
# test run: allowed
# test result: pass
#
# YAML definition: allowed
# test run: not allowed
# test result: fail (under-permission)
#
# YAML definition: not allowed
# test run: allowed
# test result: fail (over-permission)
# (boolean value)
#test_custom_requirements = false
#
# File path of the yaml file that defines your RBAC requirements. This
# file must be located on the same host that Patrole runs on. The yaml
# file should be written as follows:
#
# ```
# <service>:
# <api_action>:
# - <allowed_role>
# - <allowed_role>
# - <allowed_role>
# <api_action>:
# - <allowed_role>
# - <allowed_role>
# <service>
# <api_action>:
# - <allowed_role>
# ```
# Where:
# service = the service that is being tested (cinder, nova, etc)
# api_action = the policy action that is being tested. Examples:
# - volume:create
# - os_compute_api:servers:start
# - add_image
# allowed_role = the Keystone role that is allowed to perform the API
# (string value)
#custom_requirements_file = <None>
[patrole_log]
#
# From patrole.config
#
# Enables reporting on RBAC expected and actual test results for each
# Patrole test (boolean value)
#enable_reporting = false
# Name of file where output from 'enable_reporting' is logged. Note
# that this file is recreated on each invocation of patrole (string
# value)
#report_log_name = patrole.log
# Path (relative or absolute) where the output from 'enable_reporting'
# is logged. This is combined withreport_log_name to generate the full
# path. (string value)
#report_log_path = .
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.