From ec58a46c900e6b88bfa3aeaff07e959d7704c539 Mon Sep 17 00:00:00 2001
From: Marcus Poller <marcus.poller@betadots.de>
Date: Tue, 15 Sep 2026 11:18:39 +0200
Subject: [PATCH] allow primary to clean jrubies code cache after code
 deployment

Signed-off-by: Marcus Poller <marcus.poller@betadots.de>
---
 ezbake/config/conf.d/auth.conf | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ezbake/config/conf.d/auth.conf b/ezbake/config/conf.d/auth.conf
index 2f009a810..2f9c7a1d8 100644
--- a/ezbake/config/conf.d/auth.conf
+++ b/ezbake/config/conf.d/auth.conf
@@ -314,6 +314,20 @@ authorization: {
             sort-order: 500
             name: "puppet tasks information"
         },
+        {
+           match-request: {
+               path: "/puppet-admin-api/v1/environment-cache"
+               type: path
+               method: delete
+           }
+           allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+           }
+           sort-order: 500
+           name: "primary can clean cache after code deploy"
+        },
         {
             # Deny everything else. This ACL is not strictly
             # necessary, but illustrates the default policy