Recently, we updated the default check strings
for all API RBAC policies in manila. These policy
changes cause a lot of deprecation warnings in
the logs. In case a deployer never modified their
defaults and accepted service defaults, these
warnings aren't really helpful. If the deployer
did modify the default, these warnings are not
emitted. So we're in a bit of a pickle whether
these are helpful.
Other services [1][2][3] have made the decision
that these deprecated default check string
warnings aren't really helpful and actionable.
Further, any kind of oslo_policy deprecation
warnings aren't helpful during unit tests.
They fill up the logs and cause unnecessary
noise.
[1] openstack/nova: Iaa6baf6877890babb6205bdb3ee2e1a2b28ebd9c
[2] openstack/neutron: Iab3966bad81b469eccf1050f0e0e48b9e2573750
[3] openstack/placement: I2853c7bd7c0afdeeed89ef412fc8830f04381d7b
Change-Id: I08de69312016389f2b4c88f2adbd749dbe4d3261
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
oslo policy handles the mapping of
credentials from a context object to values
that oslo policy cares about. This mapping
includes some deprecations and compatibility
handling code that we must take advantage of [1].
So, stop mapping context to policy values
on our end, and rely on oslo.policy handling
this for us.
enforce and authorize methods in policy.py
do the same thing, but with a subtle
difference. The "enforce" method doesn't
raise errors when unregistered policies are
invoked - this shouldn't ever be the case
for any policies written/maintained within
manila - however, we support API extensions
and don't dictate what must be done there. So
add docstrings to clarify that we shouldn't
invoke enforce, ever.
Also handle InvalidPolicyScope exceptions
and raise the oslo.policy library version
since some test enhancements have been
committed in the latest version.
[1] d3185debdb/oslo_policy/policy.py (L1077-L1096)
Change-Id: I069bf7143d6ff66b3dcdc34c9b52d48f5808481b
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
This is the basic patch which consits of the framework
code for default policy in code feature as well as
share instance export location resource.
Partial-Implements: blueprint policy-in-code
Change-Id: Iedde7a4a674a60e760b47d5eb2973f42d79226d8
oslo.config has deprecated the enforce_type parameter to
set_override() and set its default value to True [1],
so remove this usage from our codebase. Also remove
explict str() cast of mock.sentinel_password in
Windows driver since it should no longer be expected.
[1] Ifa552de0a994e40388cbc9f7dbaa55700ca276b0
Change-Id: Ic02cbb37c6dbf30cacb1e6e290bfb0986f54d5f3
Each config option has limitation for type and value. If we use
method CONF.set_override without parameter enforce_type=True, we
may pass wrong type to config option.
This commit makes sure calling method CONF.set_override with
enforce_type=True.
Change-Id: I700dcd21941c6399c51e11bef2282e1e4565e85a
Closes-Bug: #1517839
Manila is broken is threee places, so fix them:
1) test 'test_misc' with WebOb 1.5
WebOb 1.5 was released at 2015-10-11. With this new version,
webob.exc.WSGIHTTPException() constructor now fails with a KeyError
when the HTTP status code is 0.
test_exceptions_raise() of test_misc tries to instantiate all
exceptions of manila.exception. The problem is that
ConvertedException uses a default HTTP status code of 0.
Modify the default HTTP status code of ConvertedException to 400 to
fix the unit tests.
2) Add dependency for 'testresources' that is required by migration
tests.
3) Remove 2 unit tests related to testing of oslo.policy lib
functionality that should not be tested in Manila. It started failing
because under-the-hood behaviour was changed in new realese 0.12.0
Closes-Bug: #1505153
Closes-Bug: #1505374
Change-Id: I0f28f3c3fb2c7eec1bafc3a617344990f86810cf
Code from manila/openstack/common/policy.py duplicates code
from oslo_policy, so we remove this module and use oslo_policy instead.
Implements bp use-oslo-policy-lib
Change-Id: I289221a1e96f6c705deef4070be113d69c57f6e0
New style policy language is much more human readable and the prefered
way to describe policies.
Change-Id: Ib741e2222ad36fa481ca8003387ecc1d9e8231e6
Implements: blueprint switch-to-new-style-policy-lang
The oslo team is recommending everyone to switch to the
non-namespaced versions of libraries. Updating the hacking
rule to include a check to prevent oslo.* import from
creeping back in.
oslo.messaging is the only exception because this package doesn't
currently support non-namespaced imports.
Change-Id: I3987e651bc880c8ffa7c0105df0298679dcd3a43
Rewrote 'init' and 'reset' functions for using same
functionality from common code of policy enforcer.
Changed path to test policy file, because policy enforcer
uses method of oslo.config 'find_file', that was not used before,
and does not know about test policy file.
Partially-implements blueprint use-common-code
Change-Id: I26ed170d39ed183899ee4420dc04d512cf3172e2
Moving file flags.py to manila/common/config.py,
replacing FLAGS by CONF. Rename modules fake_flags to conf_fixture,
test_flags to test_conf, declare_flags to declare_conf,
runtime_flags to runtime_conf like it was done in cinder, nova, glance etc.
Implement bp: use-oslo-conf
Change-Id: I38d869123e5e706d3b06f1844b97ead05e22668f
Goutham Pacha Ravi