Skip to content

Commit d2b4404

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Allow service role more RBAC access for Octavia" into stable/2025.1
2 parents 827124d + 67f9d4d commit d2b4404

7 files changed

Lines changed: 77 additions & 45 deletions

File tree

‎neutron/conf/policies/network_ip_availability.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
rules = [
2525
policy.DocumentedRuleDefault(
2626
name='get_network_ip_availability',
27-
check_str=base.ADMIN,
27+
check_str=base.ADMIN_OR_SERVICE,
2828
scope_types=['project'],
2929
description='Get network IP availability',
3030
operations=[

‎neutron/conf/policies/port.py‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,8 @@
258258
name='create_port:allowed_address_pairs',
259259
check_str=neutron_policy.policy_or(
260260
base.ADMIN_OR_NET_OWNER_MEMBER,
261-
base.PROJECT_MANAGER),
261+
base.PROJECT_MANAGER,
262+
base.SERVICE),
262263
scope_types=['project'],
263264
description=(
264265
'Specify ``allowed_address_pairs`` '
@@ -275,7 +276,8 @@
275276
name='create_port:allowed_address_pairs:mac_address',
276277
check_str=neutron_policy.policy_or(
277278
base.ADMIN_OR_NET_OWNER_MEMBER,
278-
base.PROJECT_MANAGER),
279+
base.PROJECT_MANAGER,
280+
base.SERVICE),
279281
scope_types=['project'],
280282
description=(
281283
'Specify ``mac_address` of `allowed_address_pairs`` '
@@ -292,7 +294,8 @@
292294
name='create_port:allowed_address_pairs:ip_address',
293295
check_str=neutron_policy.policy_or(
294296
base.ADMIN_OR_NET_OWNER_MEMBER,
295-
base.PROJECT_MANAGER),
297+
base.PROJECT_MANAGER,
298+
base.SERVICE),
296299
scope_types=['project'],
297300
description=(
298301
'Specify ``ip_address`` of ``allowed_address_pairs`` '
@@ -650,7 +653,8 @@
650653
name='update_port:allowed_address_pairs',
651654
check_str=neutron_policy.policy_or(
652655
base.ADMIN_OR_NET_OWNER_MEMBER,
653-
base.PROJECT_MANAGER),
656+
base.PROJECT_MANAGER,
657+
base.SERVICE),
654658
scope_types=['project'],
655659
description='Update ``allowed_address_pairs`` attribute of a port',
656660
operations=ACTION_PUT,
@@ -664,7 +668,8 @@
664668
name='update_port:allowed_address_pairs:mac_address',
665669
check_str=neutron_policy.policy_or(
666670
base.ADMIN_OR_NET_OWNER_MEMBER,
667-
base.PROJECT_MANAGER),
671+
base.PROJECT_MANAGER,
672+
base.SERVICE),
668673
scope_types=['project'],
669674
description=(
670675
'Update ``mac_address`` of ``allowed_address_pairs`` '
@@ -681,7 +686,8 @@
681686
name='update_port:allowed_address_pairs:ip_address',
682687
check_str=neutron_policy.policy_or(
683688
base.ADMIN_OR_NET_OWNER_MEMBER,
684-
base.PROJECT_MANAGER),
689+
base.PROJECT_MANAGER,
690+
base.SERVICE),
685691
scope_types=['project'],
686692
description=(
687693
'Update ``ip_address`` of ``allowed_address_pairs`` '

‎neutron/conf/policies/subnet.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@
126126
'rule:shared',
127127
'rule:external_network',
128128
base.ADMIN_OR_NET_OWNER_READER,
129+
base.SERVICE,
129130
),
130131
scope_types=['project'],
131132
description='Get a subnet',

‎neutron/tests/unit/conf/policies/test_network_ip_availability.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ def setUp(self):
9999
self.context = self.service_ctx
100100

101101
def test_get_network_ip_availability(self):
102-
self.assertRaises(
103-
base_policy.PolicyNotAuthorized,
104-
policy.enforce,
105-
self.context, 'get_network_ip_availability', self.target)
102+
self.assertTrue(
103+
policy.enforce(
104+
self.context, 'get_network_ip_availability',
105+
self.target))

‎neutron/tests/unit/conf/policies/test_port.py‎

Lines changed: 24 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1811,25 +1811,22 @@ def test_create_port_with_binding_vnic_type(self):
18111811
'create_port:binding:vnic_type', self.target))
18121812

18131813
def test_create_port_with_allowed_address_pairs(self):
1814-
self.assertRaises(
1815-
base_policy.PolicyNotAuthorized,
1816-
policy.enforce,
1817-
self.context, 'create_port:allowed_address_pairs',
1818-
self.target)
1814+
self.assertTrue(
1815+
policy.enforce(
1816+
self.context, 'create_port:allowed_address_pairs',
1817+
self.target))
18191818

18201819
def test_create_port_with_allowed_address_pairs_and_mac_address(self):
1821-
self.assertRaises(
1822-
base_policy.PolicyNotAuthorized,
1823-
policy.enforce,
1824-
self.context, 'create_port:allowed_address_pairs:mac_address',
1825-
self.alt_target)
1820+
self.assertTrue(
1821+
policy.enforce(
1822+
self.context, 'create_port:allowed_address_pairs:mac_address',
1823+
self.alt_target))
18261824

18271825
def test_create_port_with_allowed_address_pairs_and_ip_address(self):
1828-
self.assertRaises(
1829-
base_policy.PolicyNotAuthorized,
1830-
policy.enforce,
1831-
self.context, 'create_port:allowed_address_pairs:ip_address',
1832-
self.target)
1826+
self.assertTrue(
1827+
policy.enforce(
1828+
self.context, 'create_port:allowed_address_pairs:ip_address',
1829+
self.target))
18331830

18341831
def test_create_port_tags(self):
18351832
self.assertRaises(
@@ -1927,25 +1924,22 @@ def test_update_port_with_binding_vnic_type(self):
19271924
self.context, 'update_port:binding:vnic_type', self.target))
19281925

19291926
def test_update_port_with_allowed_address_pairs(self):
1930-
self.assertRaises(
1931-
base_policy.PolicyNotAuthorized,
1932-
policy.enforce,
1933-
self.context, 'update_port:allowed_address_pairs',
1934-
self.target)
1927+
self.assertTrue(
1928+
policy.enforce(
1929+
self.context, 'update_port:allowed_address_pairs',
1930+
self.target))
19351931

19361932
def test_update_port_with_allowed_address_pairs_and_mac_address(self):
1937-
self.assertRaises(
1938-
base_policy.PolicyNotAuthorized,
1939-
policy.enforce,
1940-
self.context, 'update_port:allowed_address_pairs:mac_address',
1941-
self.target)
1933+
self.assertTrue(
1934+
policy.enforce(
1935+
self.context, 'update_port:allowed_address_pairs:mac_address',
1936+
self.target))
19421937

19431938
def test_update_port_with_allowed_address_pairs_and_ip_address(self):
1944-
self.assertRaises(
1945-
base_policy.PolicyNotAuthorized,
1946-
policy.enforce,
1947-
self.context, 'update_port:allowed_address_pairs:ip_address',
1948-
self.target)
1939+
self.assertTrue(
1940+
policy.enforce(
1941+
self.context, 'update_port:allowed_address_pairs:ip_address',
1942+
self.target))
19491943

19501944
def test_update_port_data_plane_status(self):
19511945
self.assertRaises(

‎neutron/tests/unit/conf/policies/test_subnet.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -927,10 +927,8 @@ def test_create_subnet_tags(self):
927927
self.context, 'create_subnet:tags', self.target)
928928

929929
def test_get_subnet(self):
930-
self.assertRaises(
931-
base_policy.PolicyNotAuthorized,
932-
policy.enforce,
933-
self.context, 'get_subnet', self.target)
930+
self.assertTrue(
931+
policy.enforce(self.context, 'get_subnet', self.target))
934932

935933
def test_get_subnet_segment_id(self):
936934
self.assertRaises(

‎releasenotes/notes/octavia-service-role-b8ee74e5cb52ea30.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
features:
3+
- |
4+
Updated RBAC rules so that they allow the ``service`` role to pass the
5+
following policies by default:
6+
7+
- ``get_subnet``
8+
9+
- ``get_network_ip_availability``
10+
11+
- ``create_port:allowed_address_pairs``
12+
13+
- ``create_port:allowed_address_pairs:mac_address``
14+
15+
- ``create_port:allowed_address_pairs:ip_address``
16+
17+
- ``update_port:allowed_address_pairs``
18+
19+
- ``update_port:allowed_address_pairs:mac_address``
20+
21+
- ``update_port:allowed_address_pairs:ip_address``
22+
23+
This allows for integration with the Octavia project using the
24+
``service`` role instead of the ``admin`` role for integration
25+
with Neutron.
26+
upgrade:
27+
- |
28+
Default RBAC policies for ``get_subnet``, ``get_network_ip_availability``,
29+
``create_port:allowed_address_pairs``, ``create_port:allowed_address_pairs:mac_address``,
30+
``create_port:allowed_address_pairs:ip_address``, ``update_port:allowed_address_pairs``,
31+
``update_port:allowed_address_pairs:mac_address`` and
32+
``update_port:allowed_address_pairs:ip_address`` have been updated to allow the
33+
``service`` role.

0 commit comments

Comments
 (0)