openstack/ironic
Code Issues Proposed changes

Merge "trivial: Fix policy scope restriction for automated cleaning"

Browse Source
This commit is contained in:
Zuul 2024-11-09 00:56:31 +00:00 committed by Gerrit Code Review
commit b2f47d4428
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ironic/common/policy.py
View File

@ -1002,7 +1002,7 @@ node_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name='baremetal:node:disable_cleaning', name='baremetal:node:disable_cleaning',
check_str=SYSTEM_ADMIN, check_str=SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system', 'project'],
description='Disable Node disk cleaning', description='Disable Node disk cleaning',
operations=[ operations=[
{'path': '/nodes/{node_ident}', 'method': 'PATCH'} {'path': '/nodes/{node_ident}', 'method': 'PATCH'}

8
releasenotes/notes/change-scope-restriction-automated-clean-2f9f82058b5bad87.yaml Normal file
View File

@ -0,0 +1,8 @@
---
fixes:
- |
Fixes the policy scope checking for the RBAC Policy
``baremetal:node:disable_cleaning``, which previously
restricted to ``system`` user scope. The scope restriction
has been revised to permit ``project`` scoped matching,
but the default RBAC policy has not been revised.