Defined Type: cassandra::schema::permission
- Defined in:
- manifests/schema/permission.pp
Overview
Grant or revoke permissions.
To use this class, a suitable authenticator
(e.g. PasswordAuthenticator)
and authorizer
(e.g. CassandraAuthorizer) must be set in the Cassandra
class.
WARNING: Specifying keyspace 'ALL' and 'ALL' for permissions at the same time is not currently supported by this module.
30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 |
# File 'manifests/schema/permission.pp', line 30
define cassandra::schema::permission (
$user_name,
$ensure = present,
$keyspace_name = 'ALL',
$permission_name = 'ALL',
$table_name = undef,
){
include 'cassandra::schema'
if upcase($keyspace_name) == 'ALL' and upcase($permission_name) == 'ALL' {
fail('"ALL" keyspaces AND "ALL" permissions are mutually exclusive.')
} elsif $table_name {
$resource = "TABLE ${keyspace_name}.${table_name}"
} elsif upcase($keyspace_name) == 'ALL' {
$resource = 'ALL KEYSPACES'
} else {
$resource = "KEYSPACE ${keyspace_name}"
}
$read_script = "LIST ALL PERMISSIONS ON ${resource}"
$upcase_permission_name = upcase($permission_name)
$pattern = "\s${user_name} |\s*${user_name} |\s.*\s${upcase_permission_name}$"
$read_command = "${::cassandra::schema::cqlsh_opts} -e \"${read_script}\" ${::cassandra::schema::cqlsh_conn} | grep '${pattern}'"
if upcase($permission_name) == 'ALL' {
cassandra::schema::permission { "${title} - ALTER":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'ALTER',
table_name => $table_name,
}
cassandra::schema::permission { "${title} - AUTHORIZE":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'AUTHORIZE',
table_name => $table_name,
}
# The CREATE permission is not relevant to tables.
if !$table_name {
cassandra::schema::permission { "${title} - CREATE":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'CREATE',
table_name => $table_name,
}
}
cassandra::schema::permission { "${title} - DROP":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'DROP',
table_name => $table_name,
}
cassandra::schema::permission { "${title} - MODIFY":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'MODIFY',
table_name => $table_name,
}
cassandra::schema::permission { "${title} - SELECT":
ensure => $ensure,
user_name => $user_name,
keyspace_name => $keyspace_name,
permission_name => 'SELECT',
table_name => $table_name,
}
} elsif $ensure == present {
$create_script = "GRANT ${permission_name} ON ${resource} TO ${user_name}"
$create_command = "${::cassandra::schema::cqlsh_opts} -e \"${create_script}\" ${::cassandra::schema::cqlsh_conn
}"
exec { $create_script:
command => $create_command,
unless => $read_command,
require => Exec['::cassandra::schema connection test'],
}
} elsif $ensure == absent {
$delete_script = "REVOKE ${permission_name} ON ${resource} FROM ${user_name}"
$delete_command = "${::cassandra::schema::cqlsh_opts} -e \"${delete_script}\" ${::cassandra::schema::cqlsh_conn}"
exec { $delete_script:
command => $delete_command,
onlyif => $read_command,
require => Exec['::cassandra::schema connection test'],
}
} else {
fail("Unknown action (${ensure}) for ensure attribute.")
}
}
|