Bug 2196291

Summary:	[Neutron][SRBAC] API policies for get_policy_*_rule are wrong
Product:	Red Hat OpenStack	Reporter:	Candido Campos <ccamposr>
Component:	python-neutron-lib	Assignee:	Slawek Kaplonski <skaplons>
Status:	MODIFIED ---	QA Contact:	Candido Campos <ccamposr>
Severity:	high	Docs Contact:
Priority:	high
Version:	17.1 (Wallaby)	CC:	apevec, averdagu, chrisw, ekuris, jamsmith, jelynch, jjoyce, jschluet, lhh, pgrist, rheslop, scohen, skaplons, vkhitrin
Target Milestone:	z1	Keywords:	Automation, TestOnly, Triaged
Target Release:	17.1	Flags:	jelynch: needinfo? (skaplons)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-14.3.1-1.20230527001002.06e39a0.el9osttrunk python-neutron-lib-2.10.2-1.20230510080958.el9ost python-neutron-tests-tempest-2.1.0-17.1.20230621150830.021ce91.el9osttrunk	Doc Type:	Known Issue
Doc Text:	Currently, custom SRBAC rules do not permit list policy rules to non-admin users. As a consequence, non-admin users can not list or manage these rules. Current workarounds include either disabling SRBAC, or modifying the SRBAC custom rule to permit this action.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Candido Campos 2023-05-08 16:00:43 UTC

With new defaults policies for get QoS rules are set to ADMIN_OR_PROJECT_READER but that's wrong as rules don't have owner. Those API rules should be based on the parent owner (qos_policy) always.

Those tests are skipped currently in our CI job neutron-tempest-plugin-openvswitch-enforce-scope-new-defaults due to other bug 

 https://bugzilla.redhat.com/show_bug.cgi?id=2193344    
Bug 2193344 - [Neutron][SRBAC]New policies change the behavior for check rule type

Comment 1 Slawek Kaplonski 2023-05-10 08:49:52 UTC

neutron-lib's fix is available in python-neutron-lib-2.10.2-1.20230510080957.6bbae46.el9osttrunk

Comment 23 Lon Hohberger 2023-08-16 10:34:51 UTC

According to our records, this should be resolved by python-neutron-lib-2.10.2-1.20230510080958.el9ost.  This build is available now.