openstack/neutron
Code Issues Proposed changes

Merge "[S-RBAC] Fix policies for the local_ip association APIs" into stable/2024.2

Browse Source
This commit is contained in:
Zuul
2025-10-03 00:01:03 +00:00
committed by Gerrit Code Review
parent 61cf97bd0a 82699960ba
commit f2597561b2
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
neutron/conf/policies/local_ip_association.py
View File

@@ -29,7 +29,7 @@ rules = [
name='create_local_ip_port_association', name='create_local_ip_port_association',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER, base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_MEMBER),
scope_types=['project'], scope_types=['project'],
description='Create a Local IP port association', description='Create a Local IP port association',
operations=[ operations=[
@@ -48,7 +48,7 @@ rules = [
name='get_local_ip_port_association', name='get_local_ip_port_association',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_READER, base.ADMIN_OR_PROJECT_READER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_READER),
scope_types=['project'], scope_types=['project'],
description='Get a Local IP port association', description='Get a Local IP port association',
operations=[ operations=[
@@ -71,7 +71,7 @@ rules = [
name='delete_local_ip_port_association', name='delete_local_ip_port_association',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER, base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_MEMBER),
scope_types=['project'], scope_types=['project'],
description='Delete a Local IP port association', description='Delete a Local IP port association',
operations=[ operations=[

17
neutron/tests/unit/conf/policies/test_local_ip_association.py
View File

@@ -29,6 +29,9 @@ class LocalIPAssociationAPITestCase(base.PolicyBaseTestCase):
self.local_ip = { self.local_ip = {
'id': uuidutils.generate_uuid(), 'id': uuidutils.generate_uuid(),
'project_id': self.project_id} 'project_id': self.project_id}
self.alt_local_ip = {
'id': uuidutils.generate_uuid(),
'project_id': self.alt_project_id}
self.target = { self.target = {
'project_id': self.project_id, 'project_id': self.project_id,
@@ -36,11 +39,19 @@ class LocalIPAssociationAPITestCase(base.PolicyBaseTestCase):
'ext_parent_local_ip_id': self.local_ip['id']} 'ext_parent_local_ip_id': self.local_ip['id']}
self.alt_target = { self.alt_target = {
'project_id': self.alt_project_id, 'project_id': self.alt_project_id,
'local_ip_id': self.local_ip['id'], 'local_ip_id': self.alt_local_ip['id'],
'ext_parent_local_ip_id': self.local_ip['id']} 'ext_parent_local_ip_id': self.alt_local_ip['id']}
local_ips = {
self.local_ip['id']: self.local_ip,
self.alt_local_ip['id']: self.alt_local_ip,
}
def get_local_ip(context, lip_id, fields=None):
return local_ips[lip_id]
self.plugin_mock = mock.Mock() self.plugin_mock = mock.Mock()
self.plugin_mock.get_local_ip.return_value = self.local_ip self.plugin_mock.get_local_ip.side_effect = get_local_ip
mock.patch( mock.patch(
'neutron_lib.plugins.directory.get_plugin', 'neutron_lib.plugins.directory.get_plugin',
return_value=self.plugin_mock).start() return_value=self.plugin_mock).start()