host-factory in policy

host-factory-policy.rb

policy 'tomcat_policy' do
  security_admin_group = group '/security_admin'
  devops_group = group 'devops'

  tomcat_hosts_layer = layer 'tomcat_hosts'

  tomcat_factory = host_factory 'tomcat_factory',
    :layers => [tomcat_hosts_layer],
    :roleid => security_admin_group.roleid

  tomcat_hosts_layer.role.grant_to tomcat_factory, :admin_option => true

  tomcat_variables = [
    variable('database_password'),
    variable('api_key')
  ]

  tomcat_variables.each do |v|
    v.permit 'read', devops_group
    v.permit 'execute', devops_group
    v.permit 'update', devops_group

    v.permit 'execute', tomcat_hosts_layer
  end
end