Block extensions disallowed by policy #3259
Conversation
mgunnala
requested review from
narrieta,
ZhidongPeng,
nagworld9 and
maddieford
as code owners
| Error raised during agent extension policy enforcement. | ||
| """ | ||
| # TODO: when CRP adds terminal error code for policy-related extension failures, set that as the default code. | ||
| def __init__(self, msg, inner=None, code=-1): |
There was a problem hiding this comment.
should this default code be 1009 (terminal enable failure) for now? or just remove the default?
There was a problem hiding this comment.
I think you can remove the default
mgunnala
force-pushed
the
allowlist_2
branch
from
b440696
to
a37508f
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #3259 +/- ##
===========================================
+ Coverage 71.97% 72.77% +0.79%
===========================================
Files 103 114 +11
Lines 15692 17081 +1389
Branches 2486 2277 -209
===========================================
+ Hits 11295 12431 +1136
- Misses 3881 4107 +226
- Partials 516 543 +27 ☔ View full report in Codecov by Sentry. |
| Error raised during agent extension policy enforcement. | ||
| """ | ||
| # TODO: when CRP adds terminal error code for policy-related extension failures, set that as the default code. | ||
| def __init__(self, msg, inner=None, code=-1): |
There was a problem hiding this comment.
I think you can remove the default
| """ | ||
| # TODO: when CRP adds terminal error code for policy-related extension failures, set that as the default code. | ||
| def __init__(self, msg, inner=None, code=-1): | ||
| msg = "Extension is disallowed by agent policy and will not be processed: {0}".format(msg) |
There was a problem hiding this comment.
In case where agent failed to parse policy, I'm not sure we should say 'Extension is disallowed by policy'. In this case, extension is disallowed because there's some issue reading or parsing the policy.
I also am hesitant about 'agent policy' since policy is provided by customer
| policy_op, policy_err_code = policy_err_map.get(ext_handler.state) | ||
| if policy_error is not None: | ||
| err = ExtensionPolicyError(msg="", inner=policy_error, code=policy_err_code) | ||
| self.__handle_and_report_ext_handler_errors(handler_i, err, |
There was a problem hiding this comment.
Does this create .status files for single config extensions?
| ext_handler.name, | ||
| conf.get_policy_file_path()) | ||
| err = ExtensionPolicyError(msg, code=policy_err_code) | ||
| self.__handle_and_report_ext_handler_errors(handler_i, err, |
There was a problem hiding this comment.
same question here about .status file for single config extensions
Description
Issue #
PR #2 for the policy engine allowlist feature:
PR information
Quality of Code and Contribution Guidelines