Merge "[S-RBAC] Add API policies for get and activate port bindings"
This commit is contained in:
commit
0de6a4d620
@ -34,6 +34,7 @@ from neutron.conf.policies import network
|
|||||||
from neutron.conf.policies import network_ip_availability
|
from neutron.conf.policies import network_ip_availability
|
||||||
from neutron.conf.policies import network_segment_range
|
from neutron.conf.policies import network_segment_range
|
||||||
from neutron.conf.policies import port
|
from neutron.conf.policies import port
|
||||||
|
from neutron.conf.policies import port_bindings
|
||||||
from neutron.conf.policies import qos
|
from neutron.conf.policies import qos
|
||||||
from neutron.conf.policies import quotas
|
from neutron.conf.policies import quotas
|
||||||
from neutron.conf.policies import rbac
|
from neutron.conf.policies import rbac
|
||||||
@ -67,6 +68,7 @@ def list_rules():
|
|||||||
network.list_rules(),
|
network.list_rules(),
|
||||||
network_ip_availability.list_rules(),
|
network_ip_availability.list_rules(),
|
||||||
network_segment_range.list_rules(),
|
network_segment_range.list_rules(),
|
||||||
|
port_bindings.list_rules(),
|
||||||
port.list_rules(),
|
port.list_rules(),
|
||||||
qos.list_rules(),
|
qos.list_rules(),
|
||||||
quotas.list_rules(),
|
quotas.list_rules(),
|
||||||
|
51
neutron/conf/policies/port_bindings.py
Normal file
51
neutron/conf/policies/port_bindings.py
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
from oslo_policy import policy
|
||||||
|
|
||||||
|
from neutron.conf.policies import base
|
||||||
|
|
||||||
|
|
||||||
|
GET_BINDING_PATH = '/ports/{port_id}/bindings/'
|
||||||
|
ACTIVATE_BINDING_PATH = '/ports/{port_id}/bindings/{host}'
|
||||||
|
|
||||||
|
|
||||||
|
rules = [
|
||||||
|
policy.DocumentedRuleDefault(
|
||||||
|
name='get_port_binding',
|
||||||
|
check_str=base.ADMIN,
|
||||||
|
scope_types=['project'],
|
||||||
|
description='Get port binding information',
|
||||||
|
operations=[
|
||||||
|
{
|
||||||
|
'method': 'GET',
|
||||||
|
'path': GET_BINDING_PATH,
|
||||||
|
},
|
||||||
|
],
|
||||||
|
),
|
||||||
|
policy.DocumentedRuleDefault(
|
||||||
|
name='activate',
|
||||||
|
check_str=base.ADMIN,
|
||||||
|
scope_types=['project'],
|
||||||
|
description='Activate port binding on the host',
|
||||||
|
operations=[
|
||||||
|
{
|
||||||
|
'method': 'GET',
|
||||||
|
'path': ACTIVATE_BINDING_PATH,
|
||||||
|
},
|
||||||
|
],
|
||||||
|
),
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
def list_rules():
|
||||||
|
return rules
|
100
neutron/tests/unit/conf/policies/test_port_bindings.py
Normal file
100
neutron/tests/unit/conf/policies/test_port_bindings.py
Normal file
@ -0,0 +1,100 @@
|
|||||||
|
# Copyright (c) 2021 Red Hat Inc.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
# implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
from oslo_policy import policy as base_policy
|
||||||
|
|
||||||
|
from neutron import policy
|
||||||
|
from neutron.tests.unit.conf.policies import test_base as base
|
||||||
|
|
||||||
|
|
||||||
|
class PortBindingsAPITestCase(base.PolicyBaseTestCase):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(PortBindingsAPITestCase, self).setUp()
|
||||||
|
self.target = {}
|
||||||
|
|
||||||
|
|
||||||
|
class SystemAdminTests(PortBindingsAPITestCase):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(SystemAdminTests, self).setUp()
|
||||||
|
self.context = self.system_admin_ctx
|
||||||
|
|
||||||
|
def test_get_port_binding(self):
|
||||||
|
self.assertRaises(
|
||||||
|
base_policy.InvalidScope,
|
||||||
|
policy.enforce,
|
||||||
|
self.context, "get_port_binding", self.target)
|
||||||
|
|
||||||
|
def test_activate_port_binding(self):
|
||||||
|
self.assertRaises(
|
||||||
|
base_policy.InvalidScope,
|
||||||
|
policy.enforce,
|
||||||
|
self.context, "activate", self.target)
|
||||||
|
|
||||||
|
|
||||||
|
class SystemMemberTests(SystemAdminTests):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(SystemMemberTests, self).setUp()
|
||||||
|
self.context = self.system_member_ctx
|
||||||
|
|
||||||
|
|
||||||
|
class SystemReaderTests(SystemMemberTests):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(SystemReaderTests, self).setUp()
|
||||||
|
self.context = self.system_reader_ctx
|
||||||
|
|
||||||
|
|
||||||
|
class AdminTests(PortBindingsAPITestCase):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(AdminTests, self).setUp()
|
||||||
|
self.context = self.project_admin_ctx
|
||||||
|
|
||||||
|
def test_get_port_binding(self):
|
||||||
|
self.assertTrue(
|
||||||
|
policy.enforce(self.context, "get_port_binding", self.target))
|
||||||
|
|
||||||
|
def test_activate_port_binding(self):
|
||||||
|
self.assertTrue(
|
||||||
|
policy.enforce(self.context, "activate", self.target))
|
||||||
|
|
||||||
|
|
||||||
|
class ProjectMemberTests(AdminTests):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(ProjectMemberTests, self).setUp()
|
||||||
|
self.context = self.project_member_ctx
|
||||||
|
|
||||||
|
def test_get_port_binding(self):
|
||||||
|
self.assertRaises(
|
||||||
|
base_policy.PolicyNotAuthorized,
|
||||||
|
policy.enforce,
|
||||||
|
self.context, "get_port_binding", self.target)
|
||||||
|
|
||||||
|
def test_activate_port_binding(self):
|
||||||
|
self.assertRaises(
|
||||||
|
base_policy.PolicyNotAuthorized,
|
||||||
|
policy.enforce,
|
||||||
|
self.context, "activate", self.target)
|
||||||
|
|
||||||
|
|
||||||
|
class ProjectReaderTests(ProjectMemberTests):
|
||||||
|
|
||||||
|
def setUp(self):
|
||||||
|
super(ProjectReaderTests, self).setUp()
|
||||||
|
self.context = self.project_reader_ctx
|
Loading…
Reference in New Issue
Block a user