keep_group_unset.py.j2 #1

  • //
  • guest/
  • russell_jackson/
  • ansible-sdp/
  • roles/
  • perforce-sdp-install/
  • templates/
  • keep_group_unset.py.j2
  • View
  • Commits
  • Open Download .zip Download (2 KB)
#!/usr/bin/env python
#==============================================================================
# Copyright and license info is available in the LICENSE file included with
# the Server Deployment Package (SDP), and also available online:
# https://swarm.workshop.perforce.com/projects/perforce-software-sdp/view/main/LICENSE
#------------------------------------------------------------------------------
# MANAGED BY ANSIBLE (perforce-sdp-install / group_limits.yml) -- do not edit by
# hand. The exempt user and group lists are templated from host_vars
# (p4_trigger_exempt_users / p4_trigger_exempt_groups).
#------------------------------------------------------------------------------

"""
Usage:

    keep_group_unset form-in group "/p4/common/bin/triggers/keep_group_unset.py %formfile% %user%"

This script is designed to run as a form in trigger on the server. It changes any unlimited
group values to unset.
"""

import os
import re
import sys
import tempfile

admins = [ {% for u in p4_trigger_exempt_users %}'{{ u }}'{% if not loop.last %}, {% endif %}{% endfor %} ]

user = sys.argv[2]
# Exit if the perforce user is modifying the form.
if user in admins:
  sys.exit(0)

input = open(sys.argv[1], "r")
fd, temppath = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(sys.argv[1])))
output = os.fdopen(fd, "w")
admingroup = False
admingroups = [{% for g in p4_trigger_exempt_groups %}"{{ g }}"{% if not loop.last %}, {% endif %}{% endfor %}]

for line in input.readlines():
# Exit if group being modified is an admin group.
  m = re.match(r"^Group:\s+(\S+)", line)
  if m and m.group(1) in admingroups:
    admingroup = True
    break
  if re.search(r"^Max.*:", line):
      line = re.sub(":.*", ": unset" , line)
  elif re.search(r"^Timeout.*:", line):
      line = re.sub(":.*", ": unset" , line)
  output.write(line)

input.close()
output.close()

if admingroup == False:
  os.replace(temppath, sys.argv[1])
else:
  os.remove(temppath)

sys.exit(0)
# Change User Description Committed
#1 32894 Russell C. Jackson (Rusty) Add group resource guardrails to perforce-sdp-install; inventory cleanup

Guardrails (gated on guardrails_enabled, commit server):
- New group_limits phase (thin orchestrator + group_limits/ subdir:
  deploy_scripts, set_limits, populate) included from main.yml. Templates the
  SDP keep_group_unset.py trigger and update_limits.py from inventory so no
  group/user name is hardcoded; sets Max* on each managed group via the new
  idempotent files/manage_p4group.py helper; populates the limits group once
  (marker-guarded). No new cron -- the SDP's hourly master cron maintains
  membership.
- Every group name is its own variable (p4_baseline_group, p4_integrators_group,
  p4_unlimited_group, p4_admins_group, p4_replicas_group); p4_group_limits is a
  list of {name, limits}. Naming convention in group_vars/main; per-environment
  values + enable flag in each commit server's host_vars; safe fallbacks in
  defaults.
- Molecule: install scenario now runs the guardrails phase after
  configure_new_server and verifies the scripts are deployed and the
  limits/p4-unlimited groups carry the expected values. README + docs updated.

Inventory cleanup:
- Removed the 2kgla1tst2 and la1v-rjackson commit hosts (host_vars + inventory).
- Renamed the top-level inventory group central -> main (group_vars dir moved,
  references updated across inventory, molecule, README, CLAUDE.md).

ansible-lint production-clean; playbooks syntax-check; helper/templates compile.