CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [8.5.0](https://github.com/theforeman/puppet-pulpcore/tree/8.5.0) (2023-09-18)
+
+[Full Changelog](https://github.com/theforeman/puppet-pulpcore/compare/8.4.0...8.5.0)
+
+**Implemented enhancements:**
+
+- Refs [\#36709](https://projects.theforeman.org/issues/36709) - Expose ANSIBLE\_PERMISSION\_CLASSES setting [\#304](https://github.com/theforeman/puppet-pulpcore/pull/304) ([ekohl](https://github.com/ekohl))
+
 ## [8.4.0](https://github.com/theforeman/puppet-pulpcore/tree/8.4.0) (2023-08-22)
 
 [Full Changelog](https://github.com/theforeman/puppet-pulpcore/compare/8.3.0...8.4.0)

manifests/plugin/ansible.pp

@@ -2,8 +2,11 @@
 # @param ansible_galaxy_path
 #   In the Apache configuration the path to forward to the api app
 #   for ansible galaxy support
+# @param permission_classes
+#   Configure the RBAC permission classes
 class pulpcore::plugin::ansible (
   String $ansible_galaxy_path = '/pulp_ansible/galaxy/',
+  Optional[Array[String[1]]] $permission_classes = undef,
 ) {
   $context = {
     'directories' => [],
@@ -25,8 +28,14 @@
     $external_api_url = "https://${pulpcore::servername}"
   }
 
+  $config_context = {
+    'external_api_url'     => $external_api_url,
+    'external_content_url' => $external_content_url,
+    'permission_classes'   => $permission_classes,
+  }
+
   pulpcore::plugin { 'ansible':
-    config        => "ANSIBLE_API_HOSTNAME = \"${external_api_url}\"\nANSIBLE_CONTENT_HOSTNAME = \"${external_content_url}\"",
+    config        => epp('pulpcore/settings-ansible.py.epp', $config_context),
     https_content => epp('pulpcore/apache-fragment.epp', $context),
   }
 }

metadata.json

@@ -1,6 +1,6 @@
 {
   "name": "theforeman-pulpcore",
-  "version": "8.4.0",
+  "version": "8.5.0",
   "author": "theforeman",
   "summary": "Installs next generation Pulp server",
   "license": "GPL-3.0-or-later",

spec/classes/plugin_ansible_spec.rb

@@ -26,6 +26,23 @@
         is_expected.to contain_concat__fragment('plugin-ansible')
           .with_content(%r{^ANSIBLE_API_HOSTNAME = "https://foo.example.com"})
           .with_content(%r{^ANSIBLE_CONTENT_HOSTNAME = "https://foo.example.com/pulp/content"})
+          .without_content(/ANSIBLE_PERMISSION_CLASSES/)
+      end
+
+      context 'with permission classes' do
+        context 'set to an empty array' do
+          let(:params) { { permission_classes: [] } }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_concat__fragment('plugin-ansible').with_content(/^ANSIBLE_PERMISSION_CLASSES = \[\]$/) }
+        end
+
+        context 'set to a value' do
+          let(:params) { { permission_classes: ['foo', 'bar'] } }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_concat__fragment('plugin-ansible').with_content(/^ANSIBLE_PERMISSION_CLASSES = \["foo", "bar"\]$/) }
+        end
       end
     end
   end

templates/settings-ansible.py.epp

@@ -0,0 +1,9 @@
+<% | Stdlib::Httpurl $external_api_url,
+     Stdlib::Httpurl $external_content_url,
+     Optional[Array[String[1]]] $permission_classes,
+| -%>
+ANSIBLE_API_HOSTNAME = "<%= $external_api_url %>"
+ANSIBLE_CONTENT_HOSTNAME = "<%= $external_content_url %>"
+<% if $permission_classes { -%>
+ANSIBLE_PERMISSION_CLASSES = <%= to_python($permission_classes) %>
+<% } -%>