Adds policy in code to Tap-as-a-Service

Adding oslo.policy allows operators to use and customize RBAC for tap-as-a-service instead of
relying on Neutron's default policy.

Change-Id: I6132054ef3bd8423990f91fae6329dfd089660b4
This commit is contained in:
jessegler 2019-03-21 17:18:30 -05:00 committed by Lajos Katona
parent 21aa47cbfa
commit b2b225e967
6 changed files with 167 additions and 0 deletions

View File

@ -0,0 +1,3 @@
[DEFAULT]
output_file = etc/neutron/policy.yaml.sample
namespace = tap-as-a-service

View File

@ -0,0 +1,23 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
import itertools
from neutron_taas.policies import tap_flow
from neutron_taas.policies import tap_service
def list_rules():
return itertools.chain(
tap_flow.list_rules(),
tap_service.list_rules(),
)

View File

@ -0,0 +1,66 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from neutron_lib.policy import RULE_ADMIN_OR_OWNER
rules = [
policy.DocumentedRuleDefault(
'create_tap_flow',
RULE_ADMIN_OR_OWNER,
'Create a tap flow',
[
{
'method': 'POST',
'path': '/taas/tap_flows',
}
]
),
policy.DocumentedRuleDefault(
'update_tap_flow',
RULE_ADMIN_OR_OWNER,
'Update a tap flow',
[
{
'method': 'PUT',
'path': '/taas/tap_flows/{id}',
}
]
),
policy.DocumentedRuleDefault(
'get_tap_flow',
RULE_ADMIN_OR_OWNER,
'Show a tap flow',
[
{
'method': 'GET',
'path': '/taas/tap_flows/{id}',
}
]
),
policy.DocumentedRuleDefault(
'delete_tap_flow',
RULE_ADMIN_OR_OWNER,
'Delete a tap flow',
[
{
'method': 'DELETE',
'path': '/taas/tap_flows/{id}',
}
]
),
]
def list_rules():
return rules

View File

@ -0,0 +1,66 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from neutron_lib.policy import RULE_ADMIN_OR_OWNER
rules = [
policy.DocumentedRuleDefault(
'create_tap_service',
RULE_ADMIN_OR_OWNER,
'Create a tap service',
[
{
'method': 'POST',
'path': '/taas/tap_services',
}
]
),
policy.DocumentedRuleDefault(
'update_tap_service',
RULE_ADMIN_OR_OWNER,
'Updates a tap service',
[
{
'method': 'PUT',
'path': '/taas/tap_services/{id}',
}
]
),
policy.DocumentedRuleDefault(
'get_tap_service',
RULE_ADMIN_OR_OWNER,
'Show a tap service',
[
{
'method': 'GET',
'path': '/taas/tap_services/{id}',
}
]
),
policy.DocumentedRuleDefault(
'delete_tap_service',
RULE_ADMIN_OR_OWNER,
'Delete a tap service',
[
{
'method': 'DELETE',
'path': '/taas/tap_services/{id}',
}
]
),
]
def list_rules():
return rules

View File

@ -71,6 +71,11 @@ tempest.test_plugins =
neutronclient.extension =
tap_service = neutron_taas.taas_client.tapservice
tap_flow = neutron_taas.taas_client.tapflow
oslo.policy.policies =
tap-as-a-service = neutron_taas.policies:list_rules
neutron.policies =
tap-as-a-service = neutron_taas.policies:list_rules
[pbr]
autodoc_index_modules = True

View File

@ -27,6 +27,7 @@ setenv = OS_FAIL_ON_MISSING_DEPS=1
commands =
flake8
neutron-db-manage --subproject tap-as-a-service --database-connection sqlite:// check_migration
{[testenv:genpolicy]commands}
[testenv:venv]
commands = {posargs}
@ -49,6 +50,9 @@ commands = python setup.py build_sphinx
[testenv:releasenotes]
commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
[testenv:genpolicy]
commands = oslopolicy-sample-generator --config-file etc/policy-generator.conf
[testenv:debug]
commands = oslo_debug_helper {posargs}