Correct policy action for attach/detach volume actions
This PS corrects the policy action for attach and detach
volume actions. There are a few policy actions that currently
have the wrong name. This PS is a pre-requsite for removing
strict_policy_enforce Patrole configuration option in order
to avoid false positives (e.g. a non-existent policy action
being validated against an API).
The os-attach volume actions actually enforces
"volume_extension:volume_actions:attach" and os-detach
actually enforces "volume_extension:volume_actions:detach" [0].
[0] https://github.com/openstack/cinder/blob/ae7355c1f8d5d137bfb8bdf7b521ff5519cc20f8/cinder/policies/volume_actions.py#L224
Change-Id: I7d0c99ffb197832182e8f7b2af952f94acd29b0d
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
index 466fb0c..6ce3beb 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
@@ -69,7 +69,9 @@
self.admin_volumes_client, volume_id, 'available')
@utils.services('compute')
- @rbac_rule_validation.action(service="cinder", rule="volume:attach")
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_actions:attach")
@decorators.idempotent_id('f97b10e4-2eed-4f8b-8632-71c02cb9fe42')
def test_attach_volume_to_instance(self):
server = self._create_server()
@@ -78,7 +80,9 @@
@utils.services('compute')
@decorators.attr(type='slow')
- @rbac_rule_validation.action(service="cinder", rule="volume:detach")
+ @rbac_rule_validation.action(
+ service="cinder",
+ rule="volume_extension:volume_actions:detach")
@decorators.idempotent_id('5a042f6a-688b-42e6-a02e-fe5c47b89b07')
def test_detach_volume_from_instance(self):
server = self._create_server()