Merge pull request #99 from unibonn/queue_super_users

Queue super users
HEP-Puppet · Feb 25, 2019 · c8e29d8 · c8e29d8
2 parents 434accb + f030d9c
commit c8e29d8
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 0 deletions.
diff --git a/manifests/config/security.pp b/manifests/config/security.pp
@@ -16,6 +16,8 @@
   $managers                     = $htcondor::managers
   $workers                      = $htcondor::workers
 
+  $queue_super_users            = $htcondor::queue_super_users
+  $queue_super_user_impersonate = $htcondor::queue_super_user_impersonate
   $use_anonymous_auth           = $htcondor::use_anonymous_auth
   $use_fs_auth                  = $htcondor::use_fs_auth
   $use_password_auth            = $htcondor::use_password_auth

diff --git a/manifests/init.pp b/manifests/init.pp
@@ -187,6 +187,8 @@
   $htcondor::params::template_highavailability,
   $use_htcondor_account_mapping   =
   $htcondor::params::use_htcondor_account_mapping,
+  $queue_super_users              = $htcondor::params::queue_super_users,
+  $queue_super_user_impersonate   = $htcondor::params::queue_super_user_impersonate,
   $use_anonymous_auth             = $htcondor::params::use_anonymous_auth,
   $use_fs_auth                    = $htcondor::params::use_fs_auth,
   $use_password_auth              = $htcondor::params::use_password_auth,

diff --git a/manifests/params.pp b/manifests/params.pp
@@ -106,6 +106,8 @@
   $condor_gid                     = hiera('condor_gid', 0)
 
   # authentication
+  $queue_super_users              = hiera_array('queue_super_users', [])
+  $queue_super_user_impersonate   = hiera('queue_super_user_impersonate', '')
   $use_anonymous_auth             = hiera('use_anonymous_auth', false)
   $use_fs_auth                    = hiera('use_fs_auth', true)
   $use_password_auth              = hiera('use_password_auth', true)

diff --git a/templates/10_security.config.erb b/templates/10_security.config.erb
@@ -73,6 +73,13 @@ ALLOW_CONFIG = root@$(FULL_HOSTNAME)
 ALLOW_NEGOTIATOR = $(CMS)
 ALLOW_NEGOTIATOR_SCHEDD = $(CMS)
 
+<% if ! @queue_super_users.empty? then -%>
+QUEUE_SUPER_USERS = <%= @queue_super_users.flatten.join(', ') %>
+<% end -%>
+<% if ! @queue_super_user_impersonate.empty? then -%>
+QUEUE_SUPER_USER_MAY_IMPERSONATE = <%= @queue_super_user_impersonate %>
+<% end -%>
+
 # Don't allow nobody to run jobs
 SCHEDD.DENY_WRITE = nobody@$(UID_DOMAIN)
 # Authentication