Skip to content

Commit 827124d

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Allow service role to create/update port device_id" into stable/2025.1
2 parents 4a90f83 + d78d001 commit 827124d

3 files changed

Lines changed: 123 additions & 0 deletions

File tree

‎neutron/conf/policies/port.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,20 @@
8181
deprecated_reason=DEPRECATED_REASON,
8282
deprecated_since=versionutils.deprecated.WALLABY)
8383
),
84+
policy.DocumentedRuleDefault(
85+
name='create_port:device_id',
86+
check_str=neutron_policy.policy_or(
87+
base.ADMIN_OR_PROJECT_MEMBER,
88+
base.SERVICE),
89+
scope_types=['project'],
90+
description='Specify ``device_id`` attribute when creating a port',
91+
operations=ACTION_POST,
92+
deprecated_rule=policy.DeprecatedRule(
93+
name='create_port:device_id',
94+
check_str=neutron_policy.RULE_ANY,
95+
deprecated_reason=DEPRECATED_REASON,
96+
deprecated_since=versionutils.deprecated.WALLABY)
97+
),
8498
policy.DocumentedRuleDefault(
8599
name='create_port:device_owner',
86100
check_str=neutron_policy.policy_or(
@@ -460,6 +474,20 @@
460474
deprecated_reason=DEPRECATED_REASON,
461475
deprecated_since=versionutils.deprecated.WALLABY)
462476
),
477+
policy.DocumentedRuleDefault(
478+
name='update_port:device_id',
479+
check_str=neutron_policy.policy_or(
480+
base.ADMIN_OR_PROJECT_MEMBER,
481+
base.SERVICE),
482+
scope_types=['project'],
483+
description='Update ``device_id`` attribute of a port',
484+
operations=ACTION_PUT,
485+
deprecated_rule=policy.DeprecatedRule(
486+
name='update_port:device_id',
487+
check_str=neutron_policy.RULE_ANY,
488+
deprecated_reason=DEPRECATED_REASON,
489+
deprecated_since=versionutils.deprecated.WALLABY)
490+
),
463491
policy.DocumentedRuleDefault(
464492
name='update_port:device_owner',
465493
check_str=neutron_policy.policy_or(

‎neutron/tests/unit/conf/policies/test_port.py‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,16 @@ def test_create_port(self):
7575
base_policy.InvalidScope,
7676
policy.enforce, self.context, 'create_port', self.alt_target)
7777

78+
def test_create_port_with_device_id(self):
79+
self.assertRaises(
80+
base_policy.InvalidScope,
81+
policy.enforce, self.context, 'create_port:device_id',
82+
self.target)
83+
self.assertRaises(
84+
base_policy.InvalidScope,
85+
policy.enforce, self.context, 'create_port:device_id',
86+
self.alt_target)
87+
7888
def test_create_port_with_device_owner(self):
7989
self.assertRaises(
8090
base_policy.InvalidScope,
@@ -283,6 +293,16 @@ def test_update_port(self):
283293
base_policy.InvalidScope,
284294
policy.enforce, self.context, 'update_port', self.alt_target)
285295

296+
def test_update_port_with_device_id(self):
297+
self.assertRaises(
298+
base_policy.InvalidScope,
299+
policy.enforce, self.context, 'update_port:device_id',
300+
self.target)
301+
self.assertRaises(
302+
base_policy.InvalidScope,
303+
policy.enforce, self.context, 'update_port:device_id',
304+
self.alt_target)
305+
286306
def test_update_port_with_device_owner(self):
287307
self.assertRaises(
288308
base_policy.InvalidScope,
@@ -454,6 +474,14 @@ def test_create_port(self):
454474
self.assertTrue(
455475
policy.enforce(self.context, 'create_port', self.alt_target))
456476

477+
def test_create_port_with_device_id(self):
478+
self.assertTrue(
479+
policy.enforce(self.context, 'create_port:device_id',
480+
self.target))
481+
self.assertTrue(
482+
policy.enforce(self.context, 'create_port:device_id',
483+
self.alt_target))
484+
457485
def test_create_port_with_device_owner(self):
458486
target = self.target.copy()
459487
target['device_owner'] = 'network:test'
@@ -663,6 +691,14 @@ def test_update_port(self):
663691
self.assertTrue(
664692
policy.enforce(self.context, 'update_port', self.alt_target))
665693

694+
def test_update_port_with_device_id(self):
695+
self.assertTrue(
696+
policy.enforce(self.context, 'update_port:device_id',
697+
self.target))
698+
self.assertTrue(
699+
policy.enforce(self.context, 'update_port:device_id',
700+
self.alt_target))
701+
666702
def test_update_port_with_device_owner(self):
667703
target = self.target.copy()
668704
target['device_owner'] = 'network:test'
@@ -822,6 +858,15 @@ def test_create_port(self):
822858
base_policy.PolicyNotAuthorized,
823859
policy.enforce, self.context, 'create_port', self.alt_target)
824860

861+
def test_create_port_with_device_id(self):
862+
self.assertTrue(
863+
policy.enforce(self.context, 'create_port:device_id',
864+
self.target))
865+
self.assertRaises(
866+
base_policy.PolicyNotAuthorized,
867+
policy.enforce, self.context, 'create_port:device_id',
868+
self.alt_target)
869+
825870
def test_create_port_with_device_owner(self):
826871
target = self.target.copy()
827872
target['device_owner'] = 'network:test'
@@ -1062,6 +1107,14 @@ def test_update_port(self):
10621107
base_policy.PolicyNotAuthorized,
10631108
policy.enforce, self.context, 'update_port', self.alt_target)
10641109

1110+
def test_update_port_with_device_id(self):
1111+
self.assertTrue(
1112+
policy.enforce(self.context, 'update_port:device_id', self.target))
1113+
self.assertRaises(
1114+
base_policy.PolicyNotAuthorized,
1115+
policy.enforce, self.context, 'update_port:device_id',
1116+
self.alt_target)
1117+
10651118
def test_update_port_with_device_owner(self):
10661119
target = self.target.copy()
10671120
target['device_owner'] = 'network:test'
@@ -1438,6 +1491,16 @@ def test_create_port_with_device_owner(self):
14381491
policy.enforce, self.context, 'create_port:device_owner',
14391492
alt_target)
14401493

1494+
def test_create_port_with_device_id(self):
1495+
self.assertRaises(
1496+
base_policy.PolicyNotAuthorized,
1497+
policy.enforce, self.context, 'create_port:device_id',
1498+
self.target)
1499+
self.assertRaises(
1500+
base_policy.PolicyNotAuthorized,
1501+
policy.enforce, self.context, 'create_port:device_id',
1502+
self.alt_target)
1503+
14411504
def test_create_port_with_mac_address(self):
14421505
self.assertRaises(
14431506
base_policy.PolicyNotAuthorized,
@@ -1646,6 +1709,16 @@ def test_update_port_with_fixed_ips_and_subnet_id(self):
16461709
self.context, 'update_port:fixed_ips:subnet_id',
16471710
self.alt_target)
16481711

1712+
def test_update_port_with_device_id(self):
1713+
self.assertRaises(
1714+
base_policy.PolicyNotAuthorized,
1715+
policy.enforce, self.context, 'update_port:device_id',
1716+
self.target)
1717+
self.assertRaises(
1718+
base_policy.PolicyNotAuthorized,
1719+
policy.enforce, self.context, 'update_port:device_id',
1720+
self.alt_target)
1721+
16491722
def test_update_port_with_binding_vnic_type(self):
16501723
self.assertRaises(
16511724
base_policy.PolicyNotAuthorized,
@@ -1683,6 +1756,14 @@ def test_create_port(self):
16831756
self.assertTrue(
16841757
policy.enforce(self.context, 'create_port', self.target))
16851758

1759+
def test_create_port_with_device_id(self):
1760+
self.assertTrue(
1761+
policy.enforce(self.context, 'create_port:device_id',
1762+
self.target))
1763+
self.assertTrue(
1764+
policy.enforce(self.context, 'create_port:device_id',
1765+
self.alt_target))
1766+
16861767
def test_create_port_with_device_owner(self):
16871768
self.assertTrue(
16881769
policy.enforce(
@@ -1791,6 +1872,14 @@ def test_update_port(self):
17911872
self.assertTrue(
17921873
policy.enforce(self.context, 'update_port', self.target))
17931874

1875+
def test_update_port_with_device_id(self):
1876+
self.assertTrue(
1877+
policy.enforce(self.context, 'update_port:device_id',
1878+
self.target))
1879+
self.assertTrue(
1880+
policy.enforce(self.context, 'update_port:device_id',
1881+
self.alt_target))
1882+
17941883
def test_update_port_with_device_owner(self):
17951884
self.assertTrue(
17961885
policy.enforce(

‎releasenotes/notes/service-role-port-device-id-61eb7b781b3b01ca.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
features:
3+
- |
4+
Added ``service`` role to the ``create_port:device_id`` and
5+
``update_port:device_id`` policies to allow service users
6+
for other OpenStack projects to complete Secure RBAC.

0 commit comments

Comments
 (0)