heat engine Add admin flag to dbapi stack_get

Add a flag to the stack_get dbapi call, defaulted to False,
which allows us to specify that the admin context is being used
hence we don't want tenant-scoping condition applied.
This is needed to allow the admin context to retrieve stored
credentials per-stack (e.g for the periodic per-stack tasks)

Change-Id: I55e307b7940f7da13bd169271744e80d95ea0bd9
Signed-off-by: Steven Hardy <shardy@redhat.com>

diff --git a/heat/db/api.py b/heat/db/api.py
index 14ca76c29d6e9397cf5cb3556a14fbc910030408..22664e5662b5b5d253e242beedb36e8257563c0b 100644 (file)
--- a/heat/db/api.py
+++ b/heat/db/api.py
@@ -86,8 +86,8 @@ def resource_get_by_physical_resource_id(context, physical_resource_id):
                                                      physical_resource_id)
 
 
-def stack_get(context, stack_id):
-    return IMPL.stack_get(context, stack_id)
+def stack_get(context, stack_id, admin=False):
+    return IMPL.stack_get(context, stack_id, admin)
 
 
 def stack_get_by_name(context, stack_name):

diff --git a/heat/db/sqlalchemy/api.py b/heat/db/sqlalchemy/api.py
index 57680b22a2bc1cccf84e69c10a96d18fcedcd4f6..b0cede53543defb8c0ee8b1dfc273e81af7b710d 100644 (file)
--- a/heat/db/sqlalchemy/api.py
+++ b/heat/db/sqlalchemy/api.py
@@ -121,9 +121,14 @@ def stack_get_by_name(context, stack_name, owner_id=None):
     return query.first()
 
 
-def stack_get(context, stack_id):
+def stack_get(context, stack_id, admin=False):
     result = model_query(context, models.Stack).get(stack_id)
 
+    # If the admin flag is True, we allow retrieval of a specific
+    # stack without the tenant scoping
+    if admin:
+        return result
+
     if (result is not None and context is not None and
         result.tenant != context.tenant_id):
         return None