Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1875820

Summary: Network RBAC policies don't work as expected in RHOSP13z11
Product: Red Hat OpenStack Reporter: Shailesh Chhabdiya <schhabdi>
Component: openstack-neutronAssignee: Bernard Cafarelli <bcafarel>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Eran Kuris <ekuris>
Severity: medium Docs Contact:
Priority: medium    
Version: 13.0 (Queens)CC: amuller, bcafarel, chrisw, scohen
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-26 15:43:09 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Shailesh Chhabdiya 2020-09-04 13:05:49 UTC 
Description of problem:
After upgrading from RHOSP13z5 -> RHOSP13z11 rbac policies do not work as expected.

Version-Release number of selected component (if applicable):
Red Hat Openstack 13


Actual results:
Port creation by other project admin user does not work if rbac policy is shared

Expected results:
Port creation by other project admin user should work if rbac policy is shared

Additional info:
```
HttpException: 403: Client Error for url: https://x.x.x.x:13696/v2.0/ports, (rule:create_port and (rule:create_port:fixed_ips and (rule:create_port:fixed_ips:subnet_id and rule:create_port:fixed_ips:ip_address))) is disallowed by policy

 ```
Comment 2 Bernard Cafarelli 2020-09-07 13:26:31 UTC 
*** Bug 1875819 has been marked as a duplicate of this bug. ***
Comment 4 Bernard Cafarelli 2020-09-25 13:16:14 UTC 
RBAC can be tricky, but here is my understanding of the change: this is most probably bug #1657546 (which is included in z11) and the relevant upstream changes:
https://bugs.launchpad.net/neutron/+bug/1808112
https://review.opendev.org/#/c/648532/
https://review.opendev.org/#/c/652636/

policy.json interesting rules are the same indeed (create_port:fixed_ips:ip_address,create_port:fixed_ips,create_port:fixed_ips:subnet_id) but this now properly follows logic and prevents users to to create ports with fixed ip addresses on an RBAC shared network