From 5396c627f4183259f9a2a6c4962fda591571795c Mon Sep 17 00:00:00 2001
From: Gregory Thiemonge <gthiemon@redhat.com>
Date: Tue, 21 May 2024 10:30:59 +0200
Subject: [PATCH] Added RBAC for vip_sg_ids

Change-Id: I4a15c1a19c5bb0b39494381763f68c056861b003
---
 octavia/api/v2/controllers/load_balancer.py |  7 +++++++
 octavia/policies/loadbalancer.py            | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/octavia/api/v2/controllers/load_balancer.py b/octavia/api/v2/controllers/load_balancer.py
index c5019a32c6..3fe593532e 100644
--- a/octavia/api/v2/controllers/load_balancer.py
+++ b/octavia/api/v2/controllers/load_balancer.py
@@ -462,6 +462,10 @@ class LoadBalancersController(base.BaseController):
 
         self._auth_validate_action(context, load_balancer.project_id,
                                    constants.RBAC_POST)
+        if not isinstance(load_balancer.vip_sg_ids, wtypes.UnsetType):
+            self._auth_validate_action(
+                context, load_balancer.project_id,
+                f"{constants.RBAC_POST}:vip_sg_ids")
 
         self._validate_vip_request_object(load_balancer, context=context)
 
@@ -732,6 +736,9 @@ class LoadBalancersController(base.BaseController):
 
         self._auth_validate_action(context, db_lb.project_id,
                                    constants.RBAC_PUT)
+        if not isinstance(load_balancer.vip_sg_ids, wtypes.UnsetType):
+            self._auth_validate_action(context, db_lb.project_id,
+                                       f"{constants.RBAC_PUT}:vip_sg_ids")
 
         if not isinstance(load_balancer.vip_qos_policy_id, wtypes.UnsetType):
             network_driver = utils.get_network_driver()
diff --git a/octavia/policies/loadbalancer.py b/octavia/policies/loadbalancer.py
index 8c0af4e6e1..10943aebd7 100644
--- a/octavia/policies/loadbalancer.py
+++ b/octavia/policies/loadbalancer.py
@@ -34,6 +34,12 @@ rules = [
         "Create a Load Balancer",
         [{'method': 'POST', 'path': '/v2/lbaas/loadbalancers'}]
     ),
+    policy.DocumentedRuleDefault(
+        f'{constants.RBAC_LOADBALANCER}{constants.RBAC_POST}:vip_sg_ids',
+        constants.RULE_API_WRITE,
+        "Create a Load Balancer with VIP Security Groups",
+        [{'method': 'POST', 'path': '/v2/lbaas/loadbalancers'}]
+    ),
     policy.DocumentedRuleDefault(
         f'{constants.RBAC_LOADBALANCER}{constants.RBAC_GET_ONE}',
         constants.RULE_API_READ,
@@ -48,6 +54,13 @@ rules = [
         [{'method': 'PUT',
           'path': '/v2/lbaas/loadbalancers/{loadbalancer_id}'}]
     ),
+    policy.DocumentedRuleDefault(
+        f'{constants.RBAC_LOADBALANCER}{constants.RBAC_PUT}:vip_sg_ids',
+        constants.RULE_API_WRITE,
+        "Update the VIP Security Groups of a Load Balancer",
+        [{'method': 'PUT',
+          'path': '/v2/lbaas/loadbalancers/{loadbalancer_id}'}]
+    ),
     policy.DocumentedRuleDefault(
         f'{constants.RBAC_LOADBALANCER}{constants.RBAC_DELETE}',
         constants.RULE_API_WRITE,