From c30d9c0a08f064b36a6ebb5fba1f2d6d2d9aa8fb Mon Sep 17 00:00:00 2001
From: Ben Nemec <bnemec@redhat.com>
Date: Tue, 26 Mar 2019 16:08:44 +0000
Subject: [PATCH] Add exclude-groups option to config validator

When dynamic groups are used, the sample config data may not know
about those group names. As a result, validation of such files will
always fail. This makes it hard to automate config checks since the
output would need to be inspected manually to verify that the missing
options are all from the dynamic group.

Ideally, we would provide some way to map sample config groups to
the dynamic group name used in the actual config, but that would be
more complicated and still might not work in every case if a project
doesn't include sample sections for a dynamic group (although they
_should_ be doing so).

Allowing certain group names to be excluded from validation lets
us to solve this problem in a simple way and maintain validation of
99%[0] of the config options and enables the validation to be scripted
since it won't need manual verification of the error output.

Change-Id: I352fd48f86ecb876fe26a5e50e9a2633af1fff3d
0: citation needed ;-)
---
 doc/source/cli/validator.rst                             | 9 +++++++++
 oslo_config/validator.py                                 | 8 ++++++++
 .../notes/validator-exclude-groups-ad2f046522a3407e.yaml | 8 ++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 releasenotes/notes/validator-exclude-groups-ad2f046522a3407e.yaml

diff --git a/doc/source/cli/validator.rst b/doc/source/cli/validator.rst
index 637aeeb5..b508b71a 100644
--- a/doc/source/cli/validator.rst
+++ b/doc/source/cli/validator.rst
@@ -61,3 +61,12 @@ a sample config file ``config-data.yaml`` created by the config generator::
     ERROR:root:keystone_authtoken/project_name not found
     ERROR:root:keystone_authtoken/password not found
     ERROR:root:keystone_authtoken/auth_url not found
+
+Handling Dynamic Groups
+-----------------------
+
+Some services register group names dynamically at runtime based on other
+configuration. This is problematic for the validator because these groups won't
+be present in the sample config data. The ``--exclude-group`` option for the
+validator can be used to ignore such groups and allow the other options in a
+config file to be validated normally.
diff --git a/oslo_config/validator.py b/oslo_config/validator.py
index b296d92b..6f8771e2 100644
--- a/oslo_config/validator.py
+++ b/oslo_config/validator.py
@@ -48,6 +48,12 @@ _validator_opts = [
         'fatal-warnings',
         default=False,
         help='Report failure if any warnings are found.'),
+    cfg.MultiStrOpt(
+        'exclude-group',
+        default=[],
+        help='Groups that should not be validated if they are present in the '
+             'specified input-file. This may be necessary for dynamically '
+             'named groups which do not appear in the sample config data.'),
 ]
 
 
@@ -96,6 +102,8 @@ def _validate(conf):
     warnings = False
     errors = False
     for section, options in sections.items():
+        if section in conf.exclude_group:
+            continue
         for option in options:
             if _validate_deprecated_opt(section, option, opt_data):
                 logging.warn('Deprecated opt %s/%s found', section, option)
diff --git a/releasenotes/notes/validator-exclude-groups-ad2f046522a3407e.yaml b/releasenotes/notes/validator-exclude-groups-ad2f046522a3407e.yaml
new file mode 100644
index 00000000..64973e28
--- /dev/null
+++ b/releasenotes/notes/validator-exclude-groups-ad2f046522a3407e.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    The ``oslo-config-validator`` tool now has a new option,
+    ``--exclude-group``, that allows deployers to ignore certain groups that
+    might not appear in the sample config data, perhaps because the name of
+    the group depends on other configuration values. This way the validator
+    can still be used on the known groups.