Use a larger fapolicyd cache in deployment tests

[jakduch]

Summary

• override the fapolicyd subject cache to 65353 for high-churn development tests
• keep the smaller Forklift default unchanged for other deployments
• add a regression test for the security playbook override

Testing

• pytest --confcutdir=tests/unit tests/unit/security_test.py — 1 passed
• ruff check tests/unit/security_test.py
• ansible-lint development/playbooks/security/security.yaml — production profile, no findings

Fixes #880

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 1c5c3e38-b65a-4fa4-905e-0a8ad234c06e

📥 Commits

Reviewing files that changed from the base of the PR and between 6c79648 and 64dd901.

📒 Files selected for processing (2)

• development/playbooks/security/security.yaml
• tests/unit/security_test.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The development security playbook now passes fapolicyd_subj_cache_size: 65353 to the fapolicyd role. A unit test checks the value on the Setup fapolicyd task.

Changes

Fapolicyd cache configuration

Layer / File(s)	Summary
Set and verify the subject cache size development/playbooks/security/security.yaml, tests/unit/security_test.py	The playbook passes 65353 as fapolicyd_subj_cache_size to the role when security_mode == 'fapolicyd'. The unit test checks that value on the Setup fapolicyd task.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: evgeni

Merge Risk: ⚪ Minimal · up to 64dd9

The development playbook applies the larger cache setting, and a test protects that override. No concrete deployment failure is established; the change appears ready to merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 64dd9

The override is limited to the development security playbook and does not change who can enable fapolicyd or introduce a public interface. No security bypass is established, but the larger cache has not been validated against the deployed daemon.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The immediate configuration scope is the playbook’s quadlet and proxy hosts when fapolicyd mode is selected; the changed test provides no additional attacker-controlled route to those hosts.

Trust Boundaries and Controls

• observed — The existing security-mode condition controls whether the privileged playbook invokes the external fapolicyd role; this PR changes the value passed across that role boundary, not the condition.

Resilience and Maintainability Implications

• inferred — The static assertion cannot establish whether the deployed role accepts the value or whether enforcement remains active after the configuration change.

Hardening Proposals

• proposed — On a representative fapolicyd-mode deployment, verify the effective cache setting, daemon health, and resource use after applying the playbook.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: using a larger fapolicyd cache for deployment tests.
Description check	✅ Passed	The description accurately covers the cache override, preserved default, regression test, validation results, and linked issue.
Linked Issues check	✅ Passed	Issue [#880] requires fapolicyd_subj_cache_size to be 65353 in the development security playbook. The change adds this value to the theforeman.forklift.fapolicyd role invocation and keeps the ex…
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the development security playbook override and its regression test. Both changes directly support issue [#880]. No unrelated implementation or test changes are iden…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jakduch]

The current exact-head run reached the deployment tests successfully. Its only real failure is katello_events reporting FAIL in the external-database job, followed by the expected Hammer ping cascade. That is the shared restart bug tracked in #889, not the fapolicyd cache change. I am leaving this branch unchanged.