Remove mapping policies from policy.v3cloudsample.json

By incorporating system-scope and default roles, we've effectively
made these policies obsolete. We can simplify what we maintain and
provide a more consistent, unified view of default mapping
behavior by removing them.

Change-Id: Ie01b5a79aaf363b3783c92578f56654b993b5e76
Closes-Bug: 1804519
This commit is contained in:
Lance Bragstad 2018-11-22 16:34:40 +00:00
parent e4e258a5dc
commit 65f76c1722
3 changed files with 20 additions and 7 deletions

View File

@ -195,12 +195,6 @@
"identity:list_protocols": "rule:cloud_admin",
"identity:delete_protocol": "rule:cloud_admin",
"identity:create_mapping": "rule:cloud_admin",
"identity:get_mapping": "rule:cloud_admin",
"identity:list_mappings": "rule:cloud_admin",
"identity:delete_mapping": "rule:cloud_admin",
"identity:update_mapping": "rule:cloud_admin",
"identity:get_auth_catalog": "",
"identity:get_auth_projects": "",
"identity:get_auth_domains": "",

View File

@ -200,7 +200,12 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:get_region',
'identity:list_regions',
'identity:update_region',
'identity:delete_region'
'identity:delete_region',
'identity:create_mapping',
'identity:get_mapping',
'identity:list_mappings',
'identity:update_mapping',
'identity:delete_mapping'
]
policy_keys = self._get_default_policy_rules()
for p in removed_policies:

View File

@ -0,0 +1,14 @@
---
upgrade:
- |
[`bug 1804519 <https://bugs.launchpad.net/keystone/+bug/1804519>`_]
The federated mapping policies defined in ``policy.v3cloudsample.json``
have been removed. These policies are now obsolete after incorporating
system-scope into the mapping API and implementing default roles.
fixes:
- |
[`bug 1804519 <https://bugs.launchpad.net/keystone/+bug/1804519>`_]
The federated mapping policies in ``policy.v3cloudsample.json`` policy file
have been removed in favor of better defaults in code. These policies
weren't tested exhaustively and were misleading to users and operators.