Skip to content

Commit 25b0e51

Browse files
mnasiadkamnasiadka
authored
Merge pull request #283 from stackhpc/upstream/2026.1-2026-06-01
Synchronise 2026.1 with upstream
2 parents 84e36e5 + df8a4b6 commit 25b0e51

10 files changed

Lines changed: 309 additions & 500 deletions

File tree

‎neutron/conf/policies/base.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@
7676
# related to the "network owner" and network isn't really parent of the subnet
7777
# or port. Because of that, using parent owner in those cases may be
7878
# missleading for users so it's better to keep also "network owner" rules.
79+
NET_OWNER_MANAGER = 'role:manager and ' + RULE_NET_OWNER
7980
NET_OWNER_MEMBER = 'role:member and ' + RULE_NET_OWNER
8081
NET_OWNER_READER = 'role:reader and ' + RULE_NET_OWNER
8182
ADMIN_OR_NET_OWNER_MEMBER = (

‎neutron/conf/policies/port.py‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,6 @@
100100
check_str=neutron_policy.policy_or(
101101
'not rule:network_device',
102102
base.ADMIN_OR_SERVICE,
103-
base.PROJECT_MANAGER,
104103
base.NET_OWNER_MEMBER
105104
),
106105
scope_types=['project'],
@@ -119,7 +118,6 @@
119118
name='create_port:mac_address',
120119
check_str=neutron_policy.policy_or(
121120
base.ADMIN_OR_SERVICE,
122-
base.PROJECT_MANAGER,
123121
base.NET_OWNER_MEMBER),
124122
scope_types=['project'],
125123
description='Specify ``mac_address`` attribute when creating a port',
@@ -136,7 +134,6 @@
136134
name='create_port:fixed_ips',
137135
check_str=neutron_policy.policy_or(
138136
base.ADMIN_OR_SERVICE,
139-
base.PROJECT_MANAGER,
140137
base.NET_OWNER_MEMBER,
141138
'rule:shared'),
142139
scope_types=['project'],
@@ -155,7 +152,6 @@
155152
name='create_port:fixed_ips:ip_address',
156153
check_str=neutron_policy.policy_or(
157154
base.ADMIN_OR_SERVICE,
158-
base.PROJECT_MANAGER,
159155
base.NET_OWNER_MEMBER),
160156
scope_types=['project'],
161157
description='Specify IP address in ``fixed_ips`` when creating a port',
@@ -172,7 +168,6 @@
172168
name='create_port:fixed_ips:subnet_id',
173169
check_str=neutron_policy.policy_or(
174170
base.ADMIN_OR_SERVICE,
175-
base.PROJECT_MANAGER,
176171
base.NET_OWNER_MEMBER,
177172
'rule:shared'),
178173
scope_types=['project'],
@@ -191,7 +186,6 @@
191186
name='create_port:port_security_enabled',
192187
check_str=neutron_policy.policy_or(
193188
base.ADMIN_OR_SERVICE,
194-
base.PROJECT_MANAGER,
195189
base.NET_OWNER_MEMBER),
196190
scope_types=['project'],
197191
description=(
@@ -258,7 +252,6 @@
258252
name='create_port:allowed_address_pairs',
259253
check_str=neutron_policy.policy_or(
260254
base.ADMIN_OR_NET_OWNER_MEMBER,
261-
base.PROJECT_MANAGER,
262255
base.SERVICE),
263256
scope_types=['project'],
264257
description=(
@@ -276,7 +269,6 @@
276269
name='create_port:allowed_address_pairs:mac_address',
277270
check_str=neutron_policy.policy_or(
278271
base.ADMIN_OR_NET_OWNER_MEMBER,
279-
base.PROJECT_MANAGER,
280272
base.SERVICE),
281273
scope_types=['project'],
282274
description=(
@@ -294,7 +286,6 @@
294286
name='create_port:allowed_address_pairs:ip_address',
295287
check_str=neutron_policy.policy_or(
296288
base.ADMIN_OR_NET_OWNER_MEMBER,
297-
base.PROJECT_MANAGER,
298289
base.SERVICE),
299290
scope_types=['project'],
300291
description=(
@@ -496,7 +487,6 @@
496487
check_str=neutron_policy.policy_or(
497488
'not rule:network_device',
498489
base.ADMIN_OR_SERVICE,
499-
base.PROJECT_MANAGER,
500490
base.NET_OWNER_MEMBER,
501491
),
502492
scope_types=['project'],
@@ -515,7 +505,7 @@
515505
name='update_port:mac_address',
516506
check_str=neutron_policy.policy_or(
517507
base.ADMIN_OR_SERVICE,
518-
base.PROJECT_MANAGER
508+
base.NET_OWNER_MANAGER,
519509
),
520510
scope_types=['project'],
521511
description='Update ``mac_address`` attribute of a port',
@@ -532,7 +522,6 @@
532522
name='update_port:fixed_ips',
533523
check_str=neutron_policy.policy_or(
534524
base.ADMIN_OR_SERVICE,
535-
base.PROJECT_MANAGER,
536525
base.NET_OWNER_MEMBER
537526
),
538527
scope_types=['project'],
@@ -550,7 +539,6 @@
550539
name='update_port:fixed_ips:ip_address',
551540
check_str=neutron_policy.policy_or(
552541
base.ADMIN_OR_SERVICE,
553-
base.PROJECT_MANAGER,
554542
base.NET_OWNER_MEMBER
555543
),
556544
scope_types=['project'],
@@ -571,7 +559,6 @@
571559
name='update_port:fixed_ips:subnet_id',
572560
check_str=neutron_policy.policy_or(
573561
base.ADMIN_OR_SERVICE,
574-
base.PROJECT_MANAGER,
575562
base.NET_OWNER_MEMBER,
576563
'rule:shared'
577564
),
@@ -594,7 +581,6 @@
594581
name='update_port:port_security_enabled',
595582
check_str=neutron_policy.policy_or(
596583
base.ADMIN_OR_SERVICE,
597-
base.PROJECT_MANAGER,
598584
base.NET_OWNER_MEMBER
599585
),
600586
scope_types=['project'],
@@ -653,7 +639,6 @@
653639
name='update_port:allowed_address_pairs',
654640
check_str=neutron_policy.policy_or(
655641
base.ADMIN_OR_NET_OWNER_MEMBER,
656-
base.PROJECT_MANAGER,
657642
base.SERVICE),
658643
scope_types=['project'],
659644
description='Update ``allowed_address_pairs`` attribute of a port',
@@ -668,7 +653,6 @@
668653
name='update_port:allowed_address_pairs:mac_address',
669654
check_str=neutron_policy.policy_or(
670655
base.ADMIN_OR_NET_OWNER_MEMBER,
671-
base.PROJECT_MANAGER,
672656
base.SERVICE),
673657
scope_types=['project'],
674658
description=(
@@ -686,7 +670,6 @@
686670
name='update_port:allowed_address_pairs:ip_address',
687671
check_str=neutron_policy.policy_or(
688672
base.ADMIN_OR_NET_OWNER_MEMBER,
689-
base.PROJECT_MANAGER,
690673
base.SERVICE),
691674
scope_types=['project'],
692675
description=(

‎neutron/plugins/ml2/extensions/dns_integration.py‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
from neutron_lib.exceptions import dns as dns_exc
2424
from neutron_lib.plugins import directory
2525
from neutron_lib.plugins.ml2 import api
26-
from neutron_lib.plugins import utils as plugin_utils
2726
from oslo_config import cfg
2827
from oslo_log import log as logging
2928

@@ -349,9 +348,23 @@ def _get_details(self, context, network_id):
349348

350349
class DNSExtensionDriverML2(DNSExtensionDriver):
351350

351+
def __init__(self):
352+
super().__init__()
353+
self._vlan_driver = None
354+
self._plugin = None
355+
352356
def initialize(self):
353357
LOG.info("DNSExtensionDriverML2 initialization complete")
354358

359+
@property
360+
def vlan_driver(self):
361+
if not self._vlan_driver:
362+
if not self._plugin:
363+
self._plugin = directory.get_plugin()
364+
self._vlan_driver = self._plugin.type_manager.drivers.get(
365+
lib_const.TYPE_VLAN)
366+
return self._vlan_driver
367+
355368
def _is_tunnel_project_network(self, provider_net):
356369
if provider_net['network_type'] == lib_const.TYPE_GENEVE:
357370
tunnel_ranges = cfg.CONF.ml2_type_geneve.vni_ranges
@@ -369,15 +382,15 @@ def _is_tunnel_project_network(self, provider_net):
369382
return int(tun_min) <= segmentation_id <= int(tun_max)
370383

371384
def _is_vlan_project_network(self, provider_net):
372-
network_vlan_ranges = plugin_utils.parse_network_vlan_ranges(
373-
cfg.CONF.ml2_type_vlan.network_vlan_ranges)
374-
vlan_ranges = network_vlan_ranges[provider_net['physical_network']]
385+
if not self.vlan_driver:
386+
return False
387+
network_vlan_ranges = self.vlan_driver.obj.get_network_segment_ranges()
388+
vlan_ranges = network_vlan_ranges.get(provider_net['physical_network'])
375389
if not vlan_ranges:
376390
return False
377391
segmentation_id = int(provider_net['segmentation_id'])
378-
for vlan_range in vlan_ranges:
379-
if vlan_range[0] <= segmentation_id <= vlan_range[1]:
380-
return True
392+
return any(vlan_range[0] <= segmentation_id <= vlan_range[1]
393+
for vlan_range in vlan_ranges)
381394

382395
def external_dns_not_needed(self, context, network, subnets):
383396
dns_driver = _get_dns_driver()

‎neutron/services/ovn_l3/plugin.py‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -183,18 +183,20 @@ def subscribe(self):
183183
cancellable=True)
184184

185185
def _post_fork_initialize(self, resource, event, trigger, payload=None):
186+
# TODO(ralonsoh): once [1] is released and required in Neutron, it
187+
# won't be needed the ``get_method_class`` method.
188+
# [1] https://review.opendev.org/c/openstack/neutron-lib/+/988563
189+
if utils.get_method_class(trigger) != wsgi.WorkerService:
190+
return
191+
186192
if not self._nb_ovn or not self._sb_ovn:
187193
raise ovn_l3_exc.MechanismDriverOVNNotReady()
188194

189195
# Register needed events, only for the Neutron API workers.
190-
# TODO(ralonsoh): once [1] is released and required in Neutron, it
191-
# won't be needed the ``get_method_class`` method.
192-
# [1] https://review.opendev.org/c/openstack/neutron-lib/+/988563
193-
if utils.get_method_class(trigger) == wsgi.WorkerService:
194-
self._nb_ovn.idl.notify_handler.watch_events([
195-
ovsdb_monitor.LogicalRouterPortEvent(self),
196-
ovsdb_monitor.LogicalRouterPortGatewayChassisEvent(self),
197-
])
196+
self._nb_ovn.idl.notify_handler.watch_events([
197+
ovsdb_monitor.LogicalRouterPortEvent(self),
198+
ovsdb_monitor.LogicalRouterPortGatewayChassisEvent(self),
199+
])
198200

199201
def _add_neutron_router_interface(self, context, router_id,
200202
interface_info):

‎neutron/services/portforwarding/pf_plugin.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -416,7 +416,7 @@ def update_floatingip_port_forwarding(self, context, id, floatingip_id,
416416
with db_api.CONTEXT_WRITER.using(context):
417417
fip_obj = self._get_fip_obj(context, floatingip_id)
418418
pf_obj = pf.PortForwarding.get_object(context, id=id)
419-
if not pf_obj:
419+
if not pf_obj or pf_obj.floatingip_id != floatingip_id:
420420
raise pf_exc.PortForwardingNotFound(id=id)
421421
original_pf_obj = copy.deepcopy(pf_obj)
422422
ori_internal_port_id = pf_obj.internal_port_id
@@ -670,7 +670,7 @@ def get_floatingip_port_forwarding(self, context, id, floatingip_id,
670670
fields=None):
671671
self._get_fip_obj(context, floatingip_id)
672672
obj = pf.PortForwarding.get_object(context, id=id)
673-
if not obj:
673+
if not obj or obj.floatingip_id != floatingip_id:
674674
raise pf_exc.PortForwardingNotFound(id=id)
675675
return obj
676676

0 commit comments

Comments
 (0)