From 674830c4ea76c7b1389f37ab90835176fdda9db0 Mon Sep 17 00:00:00 2001
From: Bence Romsics <bence.romsics@ericsson.com>
Date: Thu, 17 Aug 2017 15:07:29 +0200
Subject: [PATCH] Update neutron policy file

The neutron policy file is out of date. This patch updates it to match
neutron 11.0.0.0rc1. My motivation is to bring in trunk policies. But it
seems to me that if I start editing neutron_policy.json I better
synchronize the whole file from the neutron repo.

Change-Id: I976a0517559dd44f865de0528c4cf96e29340647
Partially-Implements: blueprint neutron-trunk-ui
Related-Change: Ie866f140fd4e5537ff0d757304ab5279f0cf0a79
---
 openstack_dashboard/conf/neutron_policy.json | 37 +++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/openstack_dashboard/conf/neutron_policy.json b/openstack_dashboard/conf/neutron_policy.json
index 7e81ec5111..c59e075001 100644
--- a/openstack_dashboard/conf/neutron_policy.json
+++ b/openstack_dashboard/conf/neutron_policy.json
@@ -7,6 +7,7 @@
     "admin_owner_or_network_owner": "rule:owner or rule:admin_or_network_owner",
     "admin_only": "rule:context_is_admin",
     "regular_user": "",
+    "admin_or_data_plane_int": "rule:context_is_admin or role:data_plane_integrator",
     "shared": "field:networks:shared=True",
     "shared_subnetpools": "field:subnetpools:shared=True",
     "shared_address_scopes": "field:address_scopes:shared=True",
@@ -15,9 +16,11 @@
 
     "create_subnet": "rule:admin_or_network_owner",
     "create_subnet:segment_id": "rule:admin_only",
+    "create_subnet:service_types": "rule:admin_only",
     "get_subnet": "rule:admin_or_owner or rule:shared",
     "get_subnet:segment_id": "rule:admin_only",
     "update_subnet": "rule:admin_or_network_owner",
+    "update_subnet:service_types": "rule:admin_only",
     "delete_subnet": "rule:admin_or_network_owner",
 
     "create_subnetpool": "",
@@ -91,6 +94,7 @@
     "update_port:binding:profile": "rule:admin_only",
     "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner",
     "update_port:allowed_address_pairs": "rule:admin_or_network_owner",
+    "update_port:data_plane_status": "rule:admin_or_data_plane_int",
     "delete_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner",
 
     "get_router:ha": "rule:admin_only",
@@ -100,6 +104,9 @@
     "create_router:ha": "rule:admin_only",
     "get_router": "rule:admin_or_owner",
     "get_router:distributed": "rule:admin_only",
+    "update_router": "rule:admin_or_owner",
+    "update_router:external_gateway_info": "rule:admin_or_owner",
+    "update_router:external_gateway_info:network_id": "rule:admin_or_owner",
     "update_router:external_gateway_info:enable_snat": "rule:admin_only",
     "update_router:distributed": "rule:admin_only",
     "update_router:ha": "rule:admin_only",
@@ -182,6 +189,10 @@
     "delete_policy_dscp_marking_rule": "rule:admin_only",
     "update_policy_dscp_marking_rule": "rule:admin_only",
     "get_rule_type": "rule:regular_user",
+    "get_policy_minimum_bandwidth_rule": "rule:regular_user",
+    "create_policy_minimum_bandwidth_rule": "rule:admin_only",
+    "delete_policy_minimum_bandwidth_rule": "rule:admin_only",
+    "update_policy_minimum_bandwidth_rule": "rule:admin_only",
 
     "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin_only",
     "create_rbac_policy": "",
@@ -194,5 +205,29 @@
     "create_flavor_service_profile": "rule:admin_only",
     "delete_flavor_service_profile": "rule:admin_only",
     "get_flavor_service_profile": "rule:regular_user",
-    "get_auto_allocated_topology": "rule:admin_or_owner"
+    "get_auto_allocated_topology": "rule:admin_or_owner",
+
+    "create_trunk": "rule:regular_user",
+    "get_trunk": "rule:admin_or_owner",
+    "delete_trunk": "rule:admin_or_owner",
+    "get_subports": "",
+    "add_subports": "rule:admin_or_owner",
+    "remove_subports": "rule:admin_or_owner",
+
+    "get_security_groups": "rule:admin_or_owner",
+    "get_security_group": "rule:admin_or_owner",
+    "create_security_group": "rule:admin_or_owner",
+    "update_security_group": "rule:admin_or_owner",
+    "delete_security_group": "rule:admin_or_owner",
+    "get_security_group_rules": "rule:admin_or_owner",
+    "get_security_group_rule": "rule:admin_or_owner",
+    "create_security_group_rule": "rule:admin_or_owner",
+    "delete_security_group_rule": "rule:admin_or_owner",
+
+    "get_loggable_resources": "rule:admin_only",
+    "create_log": "rule:admin_only",
+    "update_log": "rule:admin_only",
+    "delete_log": "rule:admin_only",
+    "get_logs": "rule:admin_only",
+    "get_log": "rule:admin_only"
 }