openstack/keystone
Code Issues Proposed changes

Merge "Remove limit policies from policy.v3cloudsample.json"

Browse Source
This commit is contained in:
Zuul 2019-09-27 00:07:41 +00:00 committed by Gerrit Code Review
commit f0dd69463a
3 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/policy.v3cloudsample.json
View File

@ -8,11 +8,6 @@
"default": "rule:admin_required", "default": "rule:admin_required",
"identity:get_limit": "",
"identity:create_limits": "rule:admin_required",
"identity:update_limit": "rule:admin_required",
"identity:delete_limit": "rule:admin_required",
"domain_admin_matches_domain_role": "rule:admin_required and domain_id:%(role.domain_id)s", "domain_admin_matches_domain_role": "rule:admin_required and domain_id:%(role.domain_id)s",
"get_domain_roles": "rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role", "get_domain_roles": "rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role",
"domain_admin_matches_target_domain_role": "rule:admin_required and domain_id:%(target.role.domain_id)s", "domain_admin_matches_target_domain_role": "rule:admin_required and domain_id:%(target.role.domain_id)s",

4
keystone/tests/unit/test_policy.py
View File

@ -206,6 +206,7 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:create_group', 'identity:create_group',
'identity:create_identity_provider', 'identity:create_identity_provider',
'identity:create_implied_role', 'identity:create_implied_role',
'identity:create_limits',
'identity:create_mapping', 'identity:create_mapping',
'identity:create_policy', 'identity:create_policy',
'identity:create_policy_association_for_endpoint', 'identity:create_policy_association_for_endpoint',
@ -237,6 +238,7 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:delete_identity_provider', 'identity:delete_identity_provider',
'identity:delete_implied_role', 'identity:delete_implied_role',
'identity:delete_mapping', 'identity:delete_mapping',
'identity:delete_limit',
'identity:delete_policy', 'identity:delete_policy',
'identity:delete_policy_association_for_endpoint', 'identity:delete_policy_association_for_endpoint',
'identity:delete_policy_association_for_region_and_service', 'identity:delete_policy_association_for_region_and_service',
@ -276,6 +278,7 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:get_group', 'identity:get_group',
'identity:get_identity_provider', 'identity:get_identity_provider',
'identity:get_implied_role', 'identity:get_implied_role',
'identity:get_limit',
'identity:get_limit_model', 'identity:get_limit_model',
'identity:get_mapping', 'identity:get_mapping',
'identity:get_policy', 'identity:get_policy',
@ -354,6 +357,7 @@ class PolicyJsonTestCase(unit.TestCase):
'identity:update_endpoint_group', 'identity:update_endpoint_group',
'identity:update_group', 'identity:update_group',
'identity:update_identity_provider', 'identity:update_identity_provider',
'identity:update_limit',
'identity:update_mapping', 'identity:update_mapping',
'identity:update_policy', 'identity:update_policy',
'identity:update_project', 'identity:update_project',

14
releasenotes/notes/bug-1805880-0032024ea6b83563.yaml Normal file
View File

@ -0,0 +1,14 @@
---
upgrade:
- |
[`bug 1805880 <https://bugs.launchpad.net/keystone/+bug/1805880>`_]
The limit policies defined in ``policy.v3cloudsample.json``
have been removed. These policies are now obsolete after incorporating
system-scope into the limit API and implementing default roles.
fixes:
- |
[`bug 1805880 <https://bugs.launchpad.net/keystone/+bug/1805880>`_]
The limit policies in ``policy.v3cloudsample.json`` policy
file have been removed in favor of better defaults in code. These
policies weren't tested exhaustively and were misleading to users
and operators.