From 26298a65c2261aef90481d6f8e56cf4d36f0fb72 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 30 Sep 2020 10:00:54 +0900
Subject: [PATCH] Allow partial override about SshServerOptions

When operator needs to change any options described in sshd_config,
he/she should use the parameter named SshServerOptions to define
the updated configuration.

However the problem here is that he/she should define the whole content
instead of the actual lines to be overridden, otherwise some of the
lines defined in its default can be missing from configuration. This
makes it difficutlt to properly update the parameter during update or
upgrade, since operators always need to check whetehr any change has
been made about the default of SshServerOptions.

This change introduces a new parameter, SshServerOptionsOverride, which
can be used to override specific line in SshServerOptions. Note that
SshServerOptions should still be used if any of the lines in
SshServerOptions needs to be removed.

Backport Note:
Resolved the conflict caused by sshd-baremetal-ansible.yaml, which
doesn't exist in stable branches.

Change-Id: I8a018c8c7435a753c8ed5b5fa211d91d053f8d67
(cherry picked from commit bfd97da0bfa386642d47e8d317aad70c99594cd5)
---
 deployment/sshd/sshd-baremetal-puppet.yaml             | 10 +++++++++-
 .../ssh-server-options-overrides-f677913bfd65efe1.yaml |  6 ++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 releasenotes/notes/ssh-server-options-overrides-f677913bfd65efe1.yaml

diff --git a/deployment/sshd/sshd-baremetal-puppet.yaml b/deployment/sshd/sshd-baremetal-puppet.yaml
index d8412a4f5a..c712528194 100644
--- a/deployment/sshd/sshd-baremetal-puppet.yaml
+++ b/deployment/sshd/sshd-baremetal-puppet.yaml
@@ -60,6 +60,11 @@ parameters:
       Subsystem: 'sftp  /usr/libexec/openssh/sftp-server'
     description: Mapping of sshd_config values
     type: json
+  SshServerOptionsOverrides:
+    default: {}
+    description: Mapping of sshd_config values to override definitions in
+                 SshServerOptions
+    type: json
   PasswordAuthentication:
     default: 'no'
     description: Whether or not disable password authentication
@@ -86,7 +91,10 @@ outputs:
       config_settings:
         tripleo::profile::base::sshd::bannertext: {get_param: BannerText}
         tripleo::profile::base::sshd::motd: {get_param: MessageOfTheDay}
-        tripleo::profile::base::sshd::options: {get_param: SshServerOptions}
+        tripleo::profile::base::sshd::options:
+          map_merge:
+            - {get_param: SshServerOptions}
+            - {get_param: SshServerOptionsOverrides}
         tripleo::profile::base::sshd::password_authentication: {get_param: PasswordAuthentication}
       step_config: |
         include tripleo::profile::base::sshd
diff --git a/releasenotes/notes/ssh-server-options-overrides-f677913bfd65efe1.yaml b/releasenotes/notes/ssh-server-options-overrides-f677913bfd65efe1.yaml
new file mode 100644
index 0000000000..f92f919a03
--- /dev/null
+++ b/releasenotes/notes/ssh-server-options-overrides-f677913bfd65efe1.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    The new ``SshServerOptionsOverrides`` parameter has been added. This
+    parameter can be used to override a part of sshd_config, which is defined
+    by the ``SshServerOptions``.