Adds policy in code to Tap-as-a-Service

Adding oslo.policy allows operators to use and customize RBAC for tap-as-a-service instead of
relying on Neutron's default policy.

Change-Id: I6132054ef3bd8423990f91fae6329dfd089660b4

etc/policy-generator.conf

@@ -0,0 +1,3 @@
+[DEFAULT]
+output_file = etc/neutron/policy.yaml.sample
+namespace = tap-as-a-service

neutron_taas/policies/__init__.py

@@ -0,0 +1,23 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import itertools
+
+from neutron_taas.policies import tap_flow
+from neutron_taas.policies import tap_service
+
+
+def list_rules():
+    return itertools.chain(
+        tap_flow.list_rules(),
+        tap_service.list_rules(),
+    )

neutron_taas/policies/tap_flow.py

@@ -0,0 +1,66 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+from oslo_policy import policy
+
+from neutron_lib.policy import RULE_ADMIN_OR_OWNER
+
+rules = [
+    policy.DocumentedRuleDefault(
+        'create_tap_flow',
+        RULE_ADMIN_OR_OWNER,
+        'Create a tap flow',
+        [
+            {
+                'method': 'POST',
+                'path': '/taas/tap_flows',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'update_tap_flow',
+        RULE_ADMIN_OR_OWNER,
+        'Update a tap flow',
+        [
+            {
+                'method': 'PUT',
+                'path': '/taas/tap_flows/{id}',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'get_tap_flow',
+        RULE_ADMIN_OR_OWNER,
+        'Show a tap flow',
+        [
+            {
+                'method': 'GET',
+                'path': '/taas/tap_flows/{id}',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'delete_tap_flow',
+        RULE_ADMIN_OR_OWNER,
+        'Delete a tap flow',
+        [
+            {
+                'method': 'DELETE',
+                'path': '/taas/tap_flows/{id}',
+            }
+        ]
+    ),
+]
+
+
+def list_rules():
+    return rules

neutron_taas/policies/tap_service.py

@@ -0,0 +1,66 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+from oslo_policy import policy
+
+from neutron_lib.policy import RULE_ADMIN_OR_OWNER
+
+rules = [
+    policy.DocumentedRuleDefault(
+        'create_tap_service',
+        RULE_ADMIN_OR_OWNER,
+        'Create a tap service',
+        [
+            {
+                'method': 'POST',
+                'path': '/taas/tap_services',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'update_tap_service',
+        RULE_ADMIN_OR_OWNER,
+        'Updates a tap service',
+        [
+            {
+                'method': 'PUT',
+                'path': '/taas/tap_services/{id}',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'get_tap_service',
+        RULE_ADMIN_OR_OWNER,
+        'Show a tap service',
+        [
+            {
+                'method': 'GET',
+                'path': '/taas/tap_services/{id}',
+            }
+        ]
+    ),
+    policy.DocumentedRuleDefault(
+        'delete_tap_service',
+        RULE_ADMIN_OR_OWNER,
+        'Delete a tap service',
+        [
+            {
+                'method': 'DELETE',
+                'path': '/taas/tap_services/{id}',
+            }
+        ]
+    ),
+]
+
+
+def list_rules():
+    return rules

setup.cfg

@@ -71,6 +71,11 @@ tempest.test_plugins =
 neutronclient.extension =
     tap_service = neutron_taas.taas_client.tapservice
     tap_flow = neutron_taas.taas_client.tapflow
+oslo.policy.policies =
+    tap-as-a-service = neutron_taas.policies:list_rules
+neutron.policies =
+    tap-as-a-service = neutron_taas.policies:list_rules
+
 
 [pbr]
 autodoc_index_modules = True

tox.ini

@@ -27,6 +27,7 @@ setenv = OS_FAIL_ON_MISSING_DEPS=1
 commands =
   flake8
   neutron-db-manage --subproject tap-as-a-service --database-connection sqlite:// check_migration
+  {[testenv:genpolicy]commands}
 
 [testenv:venv]
 commands = {posargs}
@@ -49,6 +50,9 @@ commands = python setup.py build_sphinx
 [testenv:releasenotes]
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
+[testenv:genpolicy]
+commands = oslopolicy-sample-generator --config-file etc/policy-generator.conf
+
 [testenv:debug]
 commands = oslo_debug_helper {posargs}