Skip to content

Commit f1bcb03

Browse files
priteaupriteau
authored
Merge pull request #291 from stackhpc/upstream/2025.1-2026-06-08
Synchronise 2025.1 with upstream
2 parents 9070166 + 8bf7b1c commit f1bcb03

15 files changed

Lines changed: 316 additions & 540 deletions

‎neutron/conf/policies/network_ip_availability.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
rules = [
2525
policy.DocumentedRuleDefault(
2626
name='get_network_ip_availability',
27-
check_str=base.ADMIN,
27+
check_str=base.ADMIN_OR_SERVICE,
2828
scope_types=['project'],
2929
description='Get network IP availability',
3030
operations=[

‎neutron/conf/policies/port.py‎

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,20 @@
8181
deprecated_reason=DEPRECATED_REASON,
8282
deprecated_since=versionutils.deprecated.WALLABY)
8383
),
84+
policy.DocumentedRuleDefault(
85+
name='create_port:device_id',
86+
check_str=neutron_policy.policy_or(
87+
base.ADMIN_OR_PROJECT_MEMBER,
88+
base.SERVICE),
89+
scope_types=['project'],
90+
description='Specify ``device_id`` attribute when creating a port',
91+
operations=ACTION_POST,
92+
deprecated_rule=policy.DeprecatedRule(
93+
name='create_port:device_id',
94+
check_str=neutron_policy.RULE_ANY,
95+
deprecated_reason=DEPRECATED_REASON,
96+
deprecated_since=versionutils.deprecated.WALLABY)
97+
),
8498
policy.DocumentedRuleDefault(
8599
name='create_port:device_owner',
86100
check_str=neutron_policy.policy_or(
@@ -244,7 +258,8 @@
244258
name='create_port:allowed_address_pairs',
245259
check_str=neutron_policy.policy_or(
246260
base.ADMIN_OR_NET_OWNER_MEMBER,
247-
base.PROJECT_MANAGER),
261+
base.PROJECT_MANAGER,
262+
base.SERVICE),
248263
scope_types=['project'],
249264
description=(
250265
'Specify ``allowed_address_pairs`` '
@@ -261,7 +276,8 @@
261276
name='create_port:allowed_address_pairs:mac_address',
262277
check_str=neutron_policy.policy_or(
263278
base.ADMIN_OR_NET_OWNER_MEMBER,
264-
base.PROJECT_MANAGER),
279+
base.PROJECT_MANAGER,
280+
base.SERVICE),
265281
scope_types=['project'],
266282
description=(
267283
'Specify ``mac_address` of `allowed_address_pairs`` '
@@ -278,7 +294,8 @@
278294
name='create_port:allowed_address_pairs:ip_address',
279295
check_str=neutron_policy.policy_or(
280296
base.ADMIN_OR_NET_OWNER_MEMBER,
281-
base.PROJECT_MANAGER),
297+
base.PROJECT_MANAGER,
298+
base.SERVICE),
282299
scope_types=['project'],
283300
description=(
284301
'Specify ``ip_address`` of ``allowed_address_pairs`` '
@@ -460,6 +477,20 @@
460477
deprecated_reason=DEPRECATED_REASON,
461478
deprecated_since=versionutils.deprecated.WALLABY)
462479
),
480+
policy.DocumentedRuleDefault(
481+
name='update_port:device_id',
482+
check_str=neutron_policy.policy_or(
483+
base.ADMIN_OR_PROJECT_MEMBER,
484+
base.SERVICE),
485+
scope_types=['project'],
486+
description='Update ``device_id`` attribute of a port',
487+
operations=ACTION_PUT,
488+
deprecated_rule=policy.DeprecatedRule(
489+
name='update_port:device_id',
490+
check_str=neutron_policy.RULE_ANY,
491+
deprecated_reason=DEPRECATED_REASON,
492+
deprecated_since=versionutils.deprecated.WALLABY)
493+
),
463494
policy.DocumentedRuleDefault(
464495
name='update_port:device_owner',
465496
check_str=neutron_policy.policy_or(
@@ -622,7 +653,8 @@
622653
name='update_port:allowed_address_pairs',
623654
check_str=neutron_policy.policy_or(
624655
base.ADMIN_OR_NET_OWNER_MEMBER,
625-
base.PROJECT_MANAGER),
656+
base.PROJECT_MANAGER,
657+
base.SERVICE),
626658
scope_types=['project'],
627659
description='Update ``allowed_address_pairs`` attribute of a port',
628660
operations=ACTION_PUT,
@@ -636,7 +668,8 @@
636668
name='update_port:allowed_address_pairs:mac_address',
637669
check_str=neutron_policy.policy_or(
638670
base.ADMIN_OR_NET_OWNER_MEMBER,
639-
base.PROJECT_MANAGER),
671+
base.PROJECT_MANAGER,
672+
base.SERVICE),
640673
scope_types=['project'],
641674
description=(
642675
'Update ``mac_address`` of ``allowed_address_pairs`` '
@@ -653,7 +686,8 @@
653686
name='update_port:allowed_address_pairs:ip_address',
654687
check_str=neutron_policy.policy_or(
655688
base.ADMIN_OR_NET_OWNER_MEMBER,
656-
base.PROJECT_MANAGER),
689+
base.PROJECT_MANAGER,
690+
base.SERVICE),
657691
scope_types=['project'],
658692
description=(
659693
'Update ``ip_address`` of ``allowed_address_pairs`` '

‎neutron/conf/policies/subnet.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@
126126
'rule:shared',
127127
'rule:external_network',
128128
base.ADMIN_OR_NET_OWNER_READER,
129+
base.SERVICE,
129130
),
130131
scope_types=['project'],
131132
description='Get a subnet',

‎neutron/plugins/ml2/extensions/dns_integration.py‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -351,35 +351,42 @@ class DNSExtensionDriverML2(DNSExtensionDriver):
351351
def __init__(self):
352352
super().__init__()
353353
self._vlan_driver = None
354+
self._tunnel_drivers = {}
354355
self._plugin = None
355356

356357
def initialize(self):
357358
LOG.info("DNSExtensionDriverML2 initialization complete")
358359

360+
@property
361+
def plugin(self):
362+
if not self._plugin:
363+
self._plugin = directory.get_plugin()
364+
return self._plugin
365+
359366
@property
360367
def vlan_driver(self):
361368
if not self._vlan_driver:
362-
if not self._plugin:
363-
self._plugin = directory.get_plugin()
364-
self._vlan_driver = self._plugin.type_manager.drivers.get(
369+
self._vlan_driver = self.plugin.type_manager.drivers.get(
365370
lib_const.TYPE_VLAN)
366371
return self._vlan_driver
367372

368-
def _is_tunnel_tenant_network(self, provider_net):
369-
if provider_net['network_type'] == lib_const.TYPE_GENEVE:
370-
tunnel_ranges = cfg.CONF.ml2_type_geneve.vni_ranges
371-
elif provider_net['network_type'] == lib_const.TYPE_VXLAN:
372-
tunnel_ranges = cfg.CONF.ml2_type_vxlan.vni_ranges
373-
else:
374-
tunnel_ranges = cfg.CONF.ml2_type_gre.tunnel_id_ranges
373+
def get_tunnel_driver(self, network_type):
374+
if network_type not in self._tunnel_drivers:
375+
self._tunnel_drivers[network_type] = (
376+
self.plugin.type_manager.drivers.get(network_type))
377+
return self._tunnel_drivers[network_type]
375378

379+
def _is_tunnel_project_network(self, provider_net):
380+
network_type = provider_net['network_type']
381+
tunnel_driver = self.get_tunnel_driver(network_type)
382+
if not tunnel_driver:
383+
return False
384+
tunnel_ranges = tunnel_driver.obj.get_network_segment_ranges()
385+
if not tunnel_ranges:
386+
return False
376387
segmentation_id = int(provider_net['segmentation_id'])
377-
for entry in tunnel_ranges:
378-
entry = entry.strip()
379-
tun_min, tun_max = entry.split(':')
380-
tun_min = tun_min.strip()
381-
tun_max = tun_max.strip()
382-
return int(tun_min) <= segmentation_id <= int(tun_max)
388+
return any(tun_min <= segmentation_id <= tun_max
389+
for tun_min, tun_max in tunnel_ranges)
383390

384391
def _is_vlan_tenant_network(self, provider_net):
385392
if not self.vlan_driver:
@@ -414,7 +421,7 @@ def external_dns_not_needed(self, context, network, subnets):
414421
if provider_net['network_type'] in [
415422
lib_const.TYPE_GRE, lib_const.TYPE_VXLAN,
416423
lib_const.TYPE_GENEVE]:
417-
return self._is_tunnel_tenant_network(provider_net)
424+
return self._is_tunnel_project_network(provider_net)
418425
return True
419426

420427

‎neutron/tests/unit/conf/policies/test_network_ip_availability.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ def setUp(self):
9999
self.context = self.service_ctx
100100

101101
def test_get_network_ip_availability(self):
102-
self.assertRaises(
103-
base_policy.PolicyNotAuthorized,
104-
policy.enforce,
105-
self.context, 'get_network_ip_availability', self.target)
102+
self.assertTrue(
103+
policy.enforce(
104+
self.context, 'get_network_ip_availability',
105+
self.target))

0 commit comments

Comments
 (0)