fccf95de00
This commit adds support for reader role for sw-manager
patch-strategy commands. The policy engine (policy.py) is an
openstack based policy engine taken from sysinv, with minor
adjustments. The behavior is that "get" commands like
"patch-strategy show" requires reader role in the admin project.
Other commands requires admin role in the admin project. This commit
only does role checks for the patch-strategy commands.
Test Cases:
PASS: Existing admin user can execute all commands (patch-strategy
show, create, delete, apply, abort)
PASS: New admin user with admin role in admin project behaves like
existing admin
PASS: New user with reader role can only run patch-strategy show.
patch-strategy create and delete denies the request
PASS: New admin user of a different project but has no roles, admin
or reader in the admin project is denied all access
PASS: sw-manager kube-upgrade-strategy's old behavior is preserved.
only admin can run commands, even get commands
PASS: dcmanager user behaves the same way as admin
PASS: patch strategy can be created through horizon
Change-Id: I7edd0937ede1ebc315e2185f45ba113f6f6cc9d8
Story: 2010149
Task: 46015
Signed-off-by: Jerry Sun <jerry.sun@windriver.com>
nfv
StarlingX NFVI Orchestration