#!/usr/bin/env python
#==============================================================================
# Copyright and license info is available in the LICENSE file included with
# the Server Deployment Package (SDP), and also available online:
# https://swarm.workshop.perforce.com/projects/perforce-software-sdp/view/main/LICENSE
#------------------------------------------------------------------------------
# MANAGED BY ANSIBLE (perforce-sdp-install / group_limits.yml) -- do not edit by
# hand. The exempt user and group lists are templated from host_vars
# (p4_trigger_exempt_users / p4_trigger_exempt_groups).
#------------------------------------------------------------------------------
"""
Usage:
keep_group_unset form-in group "/p4/common/bin/triggers/keep_group_unset.py %formfile% %user%"
This script is designed to run as a form in trigger on the server. It changes any unlimited
group values to unset.
"""
import os
import re
import sys
import tempfile
admins = [ {% for u in p4_trigger_exempt_users %}'{{ u }}'{% if not loop.last %}, {% endif %}{% endfor %} ]
user = sys.argv[2]
# Exit if the perforce user is modifying the form.
if user in admins:
sys.exit(0)
input = open(sys.argv[1], "r")
fd, temppath = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(sys.argv[1])))
output = os.fdopen(fd, "w")
admingroup = False
admingroups = [{% for g in p4_trigger_exempt_groups %}"{{ g }}"{% if not loop.last %}, {% endif %}{% endfor %}]
for line in input.readlines():
# Exit if group being modified is an admin group.
m = re.match(r"^Group:\s+(\S+)", line)
if m and m.group(1) in admingroups:
admingroup = True
break
if re.search(r"^Max.*:", line):
line = re.sub(":.*", ": unset" , line)
elif re.search(r"^Timeout.*:", line):
line = re.sub(":.*", ": unset" , line)
output.write(line)
input.close()
output.close()
if admingroup == False:
os.replace(temppath, sys.argv[1])
else:
os.remove(temppath)
sys.exit(0)
| # | Change | User | Description | Committed | |
|---|---|---|---|---|---|
| #1 | 32894 | Russell C. Jackson (Rusty) |
Add group resource guardrails to perforce-sdp-install; inventory cleanup Guardrails (gated on guardrails_enabled, commit server): - New group_limits phase (thin orchestrator + group_limits/ subdir: deploy_scripts, set_limits, populate) included from main.yml. Templates the SDP keep_group_unset.py trigger and update_limits.py from inventory so no group/user name is hardcoded; sets Max* on each managed group via the new idempotent files/manage_p4group.py helper; populates the limits group once (marker-guarded). No new cron -- the SDP's hourly master cron maintains membership. - Every group name is its own variable (p4_baseline_group, p4_integrators_group, p4_unlimited_group, p4_admins_group, p4_replicas_group); p4_group_limits is a list of {name, limits}. Naming convention in group_vars/main; per-environment values + enable flag in each commit server's host_vars; safe fallbacks in defaults. - Molecule: install scenario now runs the guardrails phase after configure_new_server and verifies the scripts are deployed and the limits/p4-unlimited groups carry the expected values. README + docs updated. Inventory cleanup: - Removed the 2kgla1tst2 and la1v-rjackson commit hosts (host_vars + inventory). - Renamed the top-level inventory group central -> main (group_vars dir moved, references updated across inventory, molecule, README, CLAUDE.md). ansible-lint production-clean; playbooks syntax-check; helper/templates compile. |