Merge pull request #163 from stackhpc/upstream/2024.1-2024-07-08

Synchronise 2024.1 with upstream

Author: markgoddard

neutron/common/ovn/utils.py

@@ -368,7 +368,7 @@ def validate_and_get_data_from_binding_profile(port):
     if (constants.OVN_PORT_BINDING_PROFILE not in port or
             not validators.is_attr_set(
                 port[constants.OVN_PORT_BINDING_PROFILE])):
-        BPInfo({}, None, [])
+        return BPInfo({}, None, [])
     param_set = {}
     param_dict = {}
     vnic_type = port.get(portbindings.VNIC_TYPE, portbindings.VNIC_NORMAL)

neutron/conf/policies/subnet.py

@@ -95,17 +95,19 @@
     policy.DocumentedRuleDefault(
         name='get_subnet',
         check_str=neutron_policy.policy_or(
-            base.ADMIN_OR_NET_OWNER_MEMBER,
             base.PROJECT_READER,
-            'rule:shared'),
+            'rule:shared',
+            base.ADMIN_OR_NET_OWNER_MEMBER,
+        ),
         scope_types=['project'],
         description='Get a subnet',
         operations=ACTION_GET,
         deprecated_rule=policy.DeprecatedRule(
             name='get_subnet',
             check_str=neutron_policy.policy_or(
+                'rule:shared',
                 neutron_policy.RULE_ADMIN_OR_OWNER,
-                'rule:shared'),
+            ),
             deprecated_reason=DEPRECATED_REASON,
             deprecated_since=versionutils.deprecated.WALLABY)
     ),
@@ -124,18 +126,19 @@
     policy.DocumentedRuleDefault(
         name='get_subnets_tags',
         check_str=neutron_policy.policy_or(
-            base.ADMIN_OR_NET_OWNER_MEMBER,
             base.PROJECT_READER,
-            'rule:shared'),
+            'rule:shared',
+            base.ADMIN_OR_NET_OWNER_MEMBER,
+        ),
         scope_types=['project'],
         description='Get the subnet tags',
         operations=ACTION_GET_TAGS,
     ),
     policy.DocumentedRuleDefault(
         name='update_subnet',
         check_str=neutron_policy.policy_or(
-            base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MEMBER),
+            base.PROJECT_MEMBER,
+            base.ADMIN_OR_NET_OWNER_MEMBER),
         scope_types=['project'],
         description='Update a subnet',
         operations=ACTION_PUT,
@@ -172,17 +175,19 @@
     policy.DocumentedRuleDefault(
         name='update_subnets_tags',
         check_str=neutron_policy.policy_or(
+            base.PROJECT_MEMBER,
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MEMBER),
+        ),
         scope_types=['project'],
         description='Update the subnet tags',
         operations=ACTION_PUT_TAGS,
     ),
     policy.DocumentedRuleDefault(
         name='delete_subnet',
         check_str=neutron_policy.policy_or(
+            base.PROJECT_MEMBER,
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MEMBER),
+        ),
         scope_types=['project'],
         description='Delete a subnet',
         operations=ACTION_DELETE,
@@ -195,8 +200,9 @@
     policy.DocumentedRuleDefault(
         name='delete_subnets_tags',
         check_str=neutron_policy.policy_or(
+            base.PROJECT_MEMBER,
             base.ADMIN_OR_NET_OWNER_MEMBER,
-            base.PROJECT_MEMBER),
+        ),
         scope_types=['project'],
         description='Delete the subnet tags',
         operations=ACTION_DELETE_TAGS,

neutron/tests/unit/common/ovn/test_utils.py

@@ -756,6 +756,11 @@ def test_valid_input_surplus_keys(self):
                 {portbindings.VNIC_TYPE: portbindings.VNIC_DIRECT,
                  constants.OVN_PORT_BINDING_PROFILE: binding_profile}))
 
+    def test_valid_input_no_binding_profile(self):
+        # Confirm that we treat a port without binding:profile as valid
+        self.assertEqual(utils.BPInfo({}, None, []),
+                         utils.validate_and_get_data_from_binding_profile({}))
+
     def test_unknown_profile_items_pruned(self):
         # Confirm that unknown profile items are pruned
         self.assertEqual(