From e3e0486de9ccdfbd5c82a31b702b87bd1e7f890f Mon Sep 17 00:00:00 2001 From: Lance Bragstad Date: Thu, 19 Nov 2020 20:44:13 +0000 Subject: [PATCH] Remove deprecated public share policies These policies were deprecated in Stein and flagged for removal in Train. Now that we're in the Wallaby development cycle let's remove them. Depends-On: I2a647fd5871ef6bb7d1ab45db893a44a560bed72 Change-Id: I6e7608be57de8987117f3f4ace018a7eb91c8bd2 Signed-off-by: Goutham Pacha Ravi --- manila/policies/shares.py | 32 ++----------------- ...re-creation-policies-051d59249e556b44.yaml | 11 +++++++ 2 files changed, 13 insertions(+), 30 deletions(-) create mode 100644 releasenotes/notes/remove-deprecated-public-share-creation-policies-051d59249e556b44.yaml diff --git a/manila/policies/shares.py b/manila/policies/shares.py index 427b32fae5..6d48078aac 100644 --- a/manila/policies/shares.py +++ b/manila/policies/shares.py @@ -17,17 +17,6 @@ from manila.policies import base BASE_POLICY_NAME = 'share:%s' -# These deprecated rules can be removed in the 'Train' release. -deprecated_create_public_share_rule = policy.DeprecatedRule( - name=BASE_POLICY_NAME % 'create_public_share', - check_str=base.RULE_DEFAULT, -) - -deprecated_set_public_share_rule = policy.DeprecatedRule( - name=BASE_POLICY_NAME % 'set_public_share', - check_str=base.RULE_DEFAULT, -) - shares_policies = [ policy.DocumentedRuleDefault( @@ -43,16 +32,7 @@ shares_policies = [ policy.DocumentedRuleDefault( name=BASE_POLICY_NAME % 'create_public_share', check_str=base.RULE_ADMIN_API, - description="Create shares visible across all projects in the cloud. " - "This option will default to rule:admin_api in the " - "9.0.0 (Train) release of the OpenStack Shared File " - "Systems (manila) service.", - deprecated_rule=deprecated_create_public_share_rule, - deprecated_reason="Public shares must be accessible across the " - "cloud, irrespective of project namespaces. To " - "avoid unintended consequences, rule:admin_api " - "serves as a better default for this policy.", - deprecated_since='S', + description="Create shares visible across all projects in the cloud.", operations=[ { 'method': 'POST', @@ -97,15 +77,7 @@ shares_policies = [ name=BASE_POLICY_NAME % 'set_public_share', check_str=base.RULE_ADMIN_API, description="Update shares to be visible across all projects in the " - "cloud. This option will default to rule:admin_api in the " - "9.0.0 (Train) release of the OpenStack Shared File " - "Systems (manila) service.", - deprecated_rule=deprecated_set_public_share_rule, - deprecated_reason="Public shares must be accessible across the " - "cloud, irrespective of project namespaces. To " - "avoid unintended consequences, rule:admin_api " - "serves as a better default for this policy.", - deprecated_since='S', + "cloud.", operations=[ { 'method': 'PUT', diff --git a/releasenotes/notes/remove-deprecated-public-share-creation-policies-051d59249e556b44.yaml b/releasenotes/notes/remove-deprecated-public-share-creation-policies-051d59249e556b44.yaml new file mode 100644 index 0000000000..4c0eebc4ff --- /dev/null +++ b/releasenotes/notes/remove-deprecated-public-share-creation-policies-051d59249e556b44.yaml @@ -0,0 +1,11 @@ +--- +upgrade: + - | + The ability to create a public share (RBAC: "share:create_public_share") + and to update a share to become publicly visible + (RBAC: "share:set_public_share") are now restricted to administator + users operating at system scope. Adjust your policy file overrides if + you would like to retain the older behavior of allowing all users to + create public shares or to update private ones to public. If you do + that, be sure that your users are aware of the security implications of + publicly accessible shares.