Allow for only a [configurable] tag set

lib/vmpooler/api/v1.rb

@@ -476,6 +476,10 @@ module Vmpooler
               unless arg.is_a?(Hash)
                 failure = true
               end
+
+              if config['allowed_tags']
+                failure = true if not (arg.keys - config['allowed_tags']).empty?
+              end
             else
               failure = true
           end

spec/vmpooler/api/v1_spec.rb

@@ -341,6 +341,23 @@ describe Vmpooler::API::V1 do
           expect(last_response.status).to eq(400)
         end
 
+      context '(allowed_tags configured)' do
+        let(:config) { {
+          config: {
+            'allowed_tags' => ['created_by', 'project', 'url']
+          }
+        } }
+
+        it 'fails if specified tag is not in allowed_tags array' do
+          put "#{prefix}/vm/testhost", '{"tags":{"created_by":"rspec","tested_by":"rspec"}}'
+
+          expect(last_response).to_not be_ok
+          expect(last_response.header['Content-Type']).to eq('application/json')
+          expect(last_response.body).to eq(JSON.pretty_generate({'ok' => false}))
+          expect(last_response.status).to eq(400)
+        end
+      end
+
       context '(tagfilter configured)' do
         let(:config) { {
           tagfilter: { 'url' => '(.*)\/' },

vmpooler.yaml.example

@@ -156,6 +156,9 @@
 #     Same as vm_lifetime, but applied if a valid authentication token is
 #     included during the request.
 #
+#   - allowed_tags
+#     If set, restricts tags to those specified in this array.
+#
 #   - domain
 #     If set, returns a top-level 'domain' JSON key in POST requests
 
@@ -169,6 +172,9 @@
   vm_checktime: 15
   vm_lifetime: 12
   vm_lifetime_auth: 24
+  allowed_tags:
+    - 'created_by'
+    - 'project'
   domain: 'company.com'
 
 # :pools: