Update rbac_rule_validation for multi-policy support
Introduces foundational logic needed for multi-policy support
to rbac_rule_validation module. Patrole now offers support for
multiple policies. The ``rules`` argument has been added to the
``rbac_rule_validation.action`` decorator, which takes a list of
policy names which Patrole will use to determine the expected test
result. This allows Patrole to more accurately determine
whether RBAC is configured correctly, since some API endpoints
enforce multiple policies.
The new ``rules`` argument is implemented for
test_unlock_server_override test which corresponds to [0]
which enforces:
rules=["os_compute_api:os-lock-server:unlock:unlock",
"os_compute_api:os-lock-server:unlock:unlock_override"]
which is set for this test.
The ``rule`` argument in the ``rbac_rule_validation.action``
decorator has been deprecated in favor of ``rules``.
The following will be carried out in additional follow up patches:
* Renaming rule to rules
* Adding multi-policy support carefully for selected APIs
to be tracked via an etherpad
* Updating Patrole documentation with multi-policy support
details
[0] https://github.com/openstack/nova/blob/0ab78890c155f0b6ffc7c4148b26642f47aa7070/nova/api/openstack/compute/lock_server.py#L42
Partially Implements: bp rbac-testing-multiple-policies
Change-Id: Iec651aff1c1ef6acda19bcad2f57720f1dd3f8a0
5 files changed