openstack
/
nova
Code Issues Proposed changes

Merge "Add new default roles in pause server policies"

This commit is contained in:
Zuul 2020-04-01 17:10:06 +00:00 committed by Gerrit Code Review
parent 3683942da1 ad554bb951
commit a314504d9c
2 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nova/policies/pause_server.py
View File

@ -24,7 +24,7 @@ POLICY_ROOT = 'os_compute_api:os-pause-server:%s'
pause_server_policies = [
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'pause',
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
description="Pause a server",
operations=[
{
@ -36,7 +36,7 @@ pause_server_policies = [
),
policy.DocumentedRuleDefault(
name=POLICY_ROOT % 'unpause',
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
description="Unpause a paused server",
operations=[
{

24
nova/tests/unit/policies/test_pause_server.py
View File

@ -117,3 +117,27 @@ class PauseServerScopeTypePolicyTest(PauseServerPolicyTest):
def setUp(self):
super(PauseServerScopeTypePolicyTest, self).setUp()
self.flags(enforce_scope=True, group="oslo_policy")
class PauseServerNoLegacyPolicyTest(PauseServerScopeTypePolicyTest):
"""Test Pause Server APIs policies with system scope enabled,
and no more deprecated rules that allow the legacy admin API to
access system APIs.
"""
without_deprecated_rules = True
def setUp(self):
super(PauseServerNoLegacyPolicyTest, self).setUp()
# Check that system admin or server owner is able to pause/unpause
# the sevrer
self.admin_or_owner_authorized_contexts = [
self.system_admin_context,
self.project_admin_context, self.project_member_context]
# Check that non-system/admin/owner is not able to pause/unpause
# the server
self.admin_or_owner_unauthorized_contexts = [
self.legacy_admin_context, self.system_member_context,
self.system_reader_context, self.system_foo_context,
self.other_project_member_context, self.project_reader_context,
self.project_foo_context
]