summaryrefslogtreecommitdiff
path: root/neutron/conf
diff options
context:
space:
mode:
Diffstat (limited to 'neutron/conf')
-rw-r--r--neutron/conf/agent/database/agentschedulers_db.py4
-rw-r--r--neutron/conf/common.py7
-rw-r--r--neutron/conf/experimental.py5
-rw-r--r--neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py11
-rw-r--r--neutron/conf/plugins/ml2/drivers/ovs_conf.py2
-rw-r--r--neutron/conf/policies/availability_zone.py8
-rw-r--r--neutron/conf/policies/base.py14
-rw-r--r--neutron/conf/policies/floatingip_port_forwarding.py16
-rw-r--r--neutron/conf/policies/port.py23
-rw-r--r--neutron/conf/policies/qos.py22
10 files changed, 86 insertions, 26 deletions
diff --git a/neutron/conf/agent/database/agentschedulers_db.py b/neutron/conf/agent/database/agentschedulers_db.py
index f58e0b2771..a46a18a262 100644
--- a/neutron/conf/agent/database/agentschedulers_db.py
+++ b/neutron/conf/agent/database/agentschedulers_db.py
@@ -33,7 +33,9 @@ AGENTS_SCHEDULER_OPTS = [
'network. If this number is greater than 1, the '
'scheduler automatically assigns multiple DHCP agents '
'for a given tenant network, providing high '
- 'availability for the DHCP service.')),
+ 'availability for the DHCP service. However this does '
+ 'not provide high availability for the IPv6 metadata '
+ 'service in isolated networks.')),
cfg.BoolOpt('enable_services_on_agents_with_admin_state_down',
default=False,
help=_('Enable services on an agent with admin_state_up '
diff --git a/neutron/conf/common.py b/neutron/conf/common.py
index c820b3c5d7..30b09a14aa 100644
--- a/neutron/conf/common.py
+++ b/neutron/conf/common.py
@@ -77,7 +77,12 @@ core_opts = [
"without providing a CIDR or subnetpool ID will be "
"given a CIDR via the Prefix Delegation mechanism. "
"Note that enabling PD will override the behavior of "
- "the default IPv6 subnetpool.")),
+ "the default IPv6 subnetpool."),
+ deprecated_for_removal=True,
+ deprecated_since='2023.2',
+ deprecated_reason=("The Dibbler client used for this feature "
+ "is no longer maintained. See LP#1916428"),
+ ),
cfg.IntOpt('dhcp_lease_duration', default=86400,
help=_("DHCP lease duration (in seconds). Use -1 to tell "
"dnsmasq to use infinite lease times.")),
diff --git a/neutron/conf/experimental.py b/neutron/conf/experimental.py
index 463ab4a88b..dbb13ec820 100644
--- a/neutron/conf/experimental.py
+++ b/neutron/conf/experimental.py
@@ -17,11 +17,16 @@ from neutron._i18n import _
EXPERIMENTAL_CFG_GROUP = 'experimental'
EXPERIMENTAL_LINUXBRIDGE = 'linuxbridge'
+EXPERIMENTAL_IPV6_PD = 'ipv6_pd_enabled'
experimental_opts = [
cfg.BoolOpt(EXPERIMENTAL_LINUXBRIDGE,
default=False,
help=_('Enable execution of the experimental Linuxbridge '
'agent.')),
+ cfg.BoolOpt(EXPERIMENTAL_IPV6_PD,
+ default=False,
+ help=_('Enable execution of the experimental IPv6 Prefix '
+ 'Delegation functionality in the L3 agent.')),
]
diff --git a/neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py b/neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py
index be75c405a8..0706477c4f 100644
--- a/neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py
+++ b/neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py
@@ -217,6 +217,13 @@ ovn_opts = [
'order to disable the ``stateful-security-group`` API '
'extension as ``allow-stateless`` keyword is only '
'supported by OVN >= 21.06.')),
+ cfg.BoolOpt('localnet_learn_fdb',
+ default=False,
+ help=_('If enabled it will allow localnet ports to learn MAC '
+ 'addresses and store them in FDB SB table. This avoids '
+ 'flooding for traffic towards unknown IPs when port '
+ 'security is disabled. It requires OVN 22.09 or '
+ 'newer.')),
]
@@ -330,3 +337,7 @@ def is_igmp_snooping_enabled():
def is_ovn_dhcp_disabled_for_baremetal():
return cfg.CONF.ovn.disable_ovn_dhcp_for_baremetal_ports
+
+
+def is_learn_fdb_enabled():
+ return cfg.CONF.ovn.localnet_learn_fdb
diff --git a/neutron/conf/plugins/ml2/drivers/ovs_conf.py b/neutron/conf/plugins/ml2/drivers/ovs_conf.py
index 7bd43dc52d..e895e0098b 100644
--- a/neutron/conf/plugins/ml2/drivers/ovs_conf.py
+++ b/neutron/conf/plugins/ml2/drivers/ovs_conf.py
@@ -18,6 +18,7 @@ from oslo_config import cfg
from neutron._i18n import _
from neutron.conf.agent import common
+from neutron.conf.agent.metadata import config as meta_conf
DEFAULT_BRIDGE_MAPPINGS = []
@@ -260,6 +261,7 @@ def register_ovs_agent_opts(cfg=cfg.CONF):
cfg.register_opts(dhcp_opts, "DHCP")
cfg.register_opts(common.DHCP_PROTOCOL_OPTS, "DHCP")
cfg.register_opts(local_ip_opts, "LOCAL_IP")
+ cfg.register_opts(meta_conf.METADATA_PROXY_HANDLER_OPTS, "METADATA")
def register_ovs_opts(cfg=cfg.CONF):
diff --git a/neutron/conf/policies/availability_zone.py b/neutron/conf/policies/availability_zone.py
index 9f265dfab4..bb94f17f64 100644
--- a/neutron/conf/policies/availability_zone.py
+++ b/neutron/conf/policies/availability_zone.py
@@ -14,8 +14,6 @@ from neutron_lib import policy as neutron_policy
from oslo_log import versionutils
from oslo_policy import policy
-from neutron.conf.policies import base
-
DEPRECATION_REASON = (
"The Availability Zone API now supports project scope and default roles.")
@@ -23,7 +21,11 @@ DEPRECATION_REASON = (
rules = [
policy.DocumentedRuleDefault(
name='get_availability_zone',
- check_str=base.ADMIN,
+ # NOTE: it can't be ADMIN_OR_PROJECT_READER constant from the base
+ # module because that is using "project_id" in the check string and the
+ # availability_zone resource don't belongs to any project thus such
+ # check string would fail enforcement.
+ check_str='role:reader',
description='List availability zones',
operations=[
{
diff --git a/neutron/conf/policies/base.py b/neutron/conf/policies/base.py
index 14e419e7d1..395e4fd7f5 100644
--- a/neutron/conf/policies/base.py
+++ b/neutron/conf/policies/base.py
@@ -43,6 +43,20 @@ RULE_NET_OWNER = 'rule:network_owner'
RULE_PARENT_OWNER = 'rule:ext_parent_owner'
RULE_SG_OWNER = 'rule:sg_owner'
+# In some cases we need to check owner of the parent resource, it's like that
+# for example for QoS rules (check owner of QoS policy rule belongs to) or
+# Floating IP port forwarding (check owner of FIP which PF is using). It's like
+# that becasue those resources (QOS rules, FIP PFs) don't have project_id
+# attribute at all and they belongs to the same project as parent resource (QoS
+# policy, FIP).
+PARENT_OWNER_MEMBER = 'role:member and ' + RULE_PARENT_OWNER
+PARENT_OWNER_READER = 'role:reader and ' + RULE_PARENT_OWNER
+ADMIN_OR_PARENT_OWNER_MEMBER = (
+ '(' + ADMIN + ') or (' + PARENT_OWNER_MEMBER + ')')
+ADMIN_OR_PARENT_OWNER_READER = (
+ '(' + ADMIN + ') or (' + PARENT_OWNER_READER + ')')
+
+
rules = [
policy.RuleDefault(
'context_is_admin',
diff --git a/neutron/conf/policies/floatingip_port_forwarding.py b/neutron/conf/policies/floatingip_port_forwarding.py
index 2ca8c5ce91..685cb45174 100644
--- a/neutron/conf/policies/floatingip_port_forwarding.py
+++ b/neutron/conf/policies/floatingip_port_forwarding.py
@@ -30,9 +30,7 @@ RESOURCE_PATH = ('/floatingips/{floatingip_id}'
rules = [
policy.DocumentedRuleDefault(
name='create_floatingip_port_forwarding',
- check_str=neutron_policy.policy_or(
- base.ADMIN_OR_PROJECT_MEMBER,
- base.RULE_PARENT_OWNER),
+ check_str=base.ADMIN_OR_PARENT_OWNER_MEMBER,
scope_types=['project'],
description='Create a floating IP port forwarding',
operations=[
@@ -49,9 +47,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='get_floatingip_port_forwarding',
- check_str=neutron_policy.policy_or(
- base.ADMIN_OR_PROJECT_READER,
- base.RULE_PARENT_OWNER),
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a floating IP port forwarding',
operations=[
@@ -72,9 +68,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='update_floatingip_port_forwarding',
- check_str=neutron_policy.policy_or(
- base.ADMIN_OR_PROJECT_MEMBER,
- base.RULE_PARENT_OWNER),
+ check_str=base.ADMIN_OR_PARENT_OWNER_MEMBER,
scope_types=['project'],
description='Update a floating IP port forwarding',
operations=[
@@ -91,9 +85,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='delete_floatingip_port_forwarding',
- check_str=neutron_policy.policy_or(
- base.ADMIN_OR_PROJECT_MEMBER,
- base.RULE_PARENT_OWNER),
+ check_str=base.ADMIN_OR_PARENT_OWNER_MEMBER,
scope_types=['project'],
description='Delete a floating IP port forwarding',
operations=[
diff --git a/neutron/conf/policies/port.py b/neutron/conf/policies/port.py
index 5783f080bb..bce04da941 100644
--- a/neutron/conf/policies/port.py
+++ b/neutron/conf/policies/port.py
@@ -270,6 +270,15 @@ rules = [
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY)
),
+ policy.DocumentedRuleDefault(
+ name='create_port:hints',
+ check_str=base.ADMIN,
+ scope_types=['project'],
+ description=(
+ 'Specify ``hints`` attribute when creating a port'
+ ),
+ operations=ACTION_POST,
+ ),
policy.DocumentedRuleDefault(
name='get_port',
@@ -350,6 +359,13 @@ rules = [
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY)
),
+ policy.DocumentedRuleDefault(
+ name='get_port:hints',
+ check_str=base.ADMIN,
+ scope_types=['project'],
+ description='Get ``hints`` attribute of a port',
+ operations=ACTION_GET,
+ ),
# TODO(amotoki): Add get_port:binding:vnic_type
# TODO(amotoki): Add get_port:binding:data_plane_status
@@ -592,6 +608,13 @@ rules = [
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY)
),
+ policy.DocumentedRuleDefault(
+ name='update_port:hints',
+ check_str=base.ADMIN,
+ scope_types=['project'],
+ description='Update ``hints`` attribute of a port',
+ operations=ACTION_PUT,
+ ),
policy.DocumentedRuleDefault(
name='delete_port',
diff --git a/neutron/conf/policies/qos.py b/neutron/conf/policies/qos.py
index c9381bab23..c507a7bdb9 100644
--- a/neutron/conf/policies/qos.py
+++ b/neutron/conf/policies/qos.py
@@ -104,7 +104,11 @@ rules = [
policy.DocumentedRuleDefault(
name='get_rule_type',
- check_str=base.ADMIN,
+ # NOTE(ralonsoh): it can't be ADMIN_OR_PROJECT_READER constant from the
+ # base module because that is using "project_id" in the check string
+ # and the rule type resource don't belongs to any project thus such
+ # check string would fail enforcement.
+ check_str='role:reader',
scope_types=['project'],
description='Get available QoS rule types',
operations=[
@@ -126,7 +130,7 @@ rules = [
policy.DocumentedRuleDefault(
name='get_policy_bandwidth_limit_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS bandwidth limit rule',
operations=[
@@ -202,7 +206,7 @@ rules = [
policy.DocumentedRuleDefault(
name='get_policy_packet_rate_limit_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS packet rate limit rule',
operations=[
@@ -258,7 +262,7 @@ rules = [
policy.DocumentedRuleDefault(
name='get_policy_dscp_marking_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS DSCP marking rule',
operations=[
@@ -334,7 +338,7 @@ rules = [
policy.DocumentedRuleDefault(
name='get_policy_minimum_bandwidth_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS minimum bandwidth rule',
operations=[
@@ -409,7 +413,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='get_policy_minimum_packet_rate_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS minimum packet rate rule',
operations=[
@@ -464,7 +468,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='get_alias_bandwidth_limit_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS bandwidth limit rule through alias',
operations=[
@@ -515,7 +519,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='get_alias_dscp_marking_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS DSCP marking rule through alias',
operations=[
@@ -566,7 +570,7 @@ rules = [
),
policy.DocumentedRuleDefault(
name='get_alias_minimum_bandwidth_rule',
- check_str=base.ADMIN_OR_PROJECT_READER,
+ check_str=base.ADMIN_OR_PARENT_OWNER_READER,
scope_types=['project'],
description='Get a QoS minimum bandwidth rule through alias',
operations=[
View Lorry Controller Status