openstack/horizon
Code Issues Proposed changes

Keep new RBAC disable by default

Browse Source 
oslo.policy has enabled the new RBAC config options
enforce_scope and enforce_new_defaults by default[1][2].

There are more changes (test fixes also) needed to make
Horizon work with new RBAC. Some of the required changes
can be seen in the below changes:
- https://zuul.opendev.org/t/openstack/build/dad4aacd73ae4eee8dc58fced1730732
- https://review.opendev.org/c/openstack/horizon/+/927341
- https://review.opendev.org/c/openstack/horizon/+/927342

NOTE: Horizon has not enabled the new BRAC yet so there is
no change in behaviour in this release.

Needed-By: https://review.opendev.org/c/openstack/requirements/+/925464

[1] https://review.opendev.org/c/openstack/oslo.policy/+/924283
[2] https://review.opendev.org/c/openstack/releases/+/925032

Change-Id: Idfe9336df9f98badc1773a07c848b521a1323f3e
This commit is contained in:
Ghanshyam Mann 2024-08-30 00:43:24 -07:00 committed by Ghanshyam
parent bc17d90ad8
commit ab5e01a0da
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
openstack_auth/policy.py
View File

@ -35,7 +35,12 @@ def _get_policy_conf(policy_file, policy_dirs=None):
conf = cfg.ConfigOpts() conf = cfg.ConfigOpts()
# Passing [] is required. Otherwise oslo.config looks up sys.argv. # Passing [] is required. Otherwise oslo.config looks up sys.argv.
conf([]) conf([])
policy_opts.set_defaults(conf) # TODO(gmann): Remove setting the default value of 'enforce_scope'
# and 'enforce_new_defaults' once Horizon is ready with the
# new RBAC (oslo_policy enabled them by default).
policy_opts.set_defaults(conf,
enforce_scope=False,
enforce_new_defaults=False)
conf.set_default('policy_file', policy_file, 'oslo_policy') conf.set_default('policy_file', policy_file, 'oslo_policy')
# Policy Enforcer has been updated to take in a policy directory # Policy Enforcer has been updated to take in a policy directory
# as a config option. However, the default value in is set to # as a config option. However, the default value in is set to