The policy engine is currently being called for every attribute
of every resource to be returned by a list response. This is
harming the API performance; moreover such a high number of checks
is also unnecessary.
This patch therefore slightly changes the API logic so that list
response first determine the list of attributes which should be
returned querying the policy engine and then use this list for
all resource items to be returned.
To this aim a few methods in base.py needed to be refactored.
This patch also removes the routine check_if_exists from policy.py
and the related PolicyNotFound exception.
Finally, this patch also removes unnecessary admin_or_owner rules
when applied to attributes. This kind of rule indeed has no effect
anyway because of Neutron's ownership checks. The rules were removed
because this change won't allow anymore for having attribute-level
policies whose evaluation result depends on the resource value.
Jakub Libosvar [Fri, 18 Apr 2014 13:29:49 +0000 (15:29 +0200)]
Fix H302 violations in plugins package
H302 violation is reported by flake8 when importing separated objects from
modules instead of importing the whole module.
e.g. from package.module import function
function()
is changed to
from package import module
module.function()
Jakub Libosvar [Fri, 18 Apr 2014 13:30:32 +0000 (15:30 +0200)]
Fix H302 violations in unit tests
H302 violation is reported by flake8 when importing separated objects from
modules instead of importing the whole module.
e.g. from package.module import function
function()
is changed to
from package import module
module.function()
In the check for all security groups on port belong to tenant,
add a filter to get security groups for the tenant which are in
common with the security groups of the port.
Abhishek Raut [Fri, 2 May 2014 01:16:33 +0000 (18:16 -0700)]
Fix network profile subtype validation in N1kv plugin
Network profile of type Trunk expects a subtype field for
creation. If a subtype is missing in the request body, plugin
should raise an exception. This patch fixes the validation logic
to detect missing subtype field.
Isaku Yamahata [Wed, 26 Feb 2014 02:36:56 +0000 (11:36 +0900)]
tests/unit: refactor reading neutron.conf.test
neutron.conf.test includes rpc_backend whose value is stashed.
Thus it is required to reset when tearing down, otherwise the stale status
will be used by succeeding tests causing random error.
This patch refactors reading neutron.conf.test and resets the status of
rpc_backend properly.
Joe Gordon [Tue, 29 Apr 2014 22:22:20 +0000 (15:22 -0700)]
Don't print duplicate messages on SystemExit
Don't log the error using LOG.error or LOG.exception and then
passing the same string to SystemExit since this will result in the
error being logged twice. Instead log the error and raise SystemExit(1).
Paul Michali [Fri, 4 Apr 2014 19:14:36 +0000 (19:14 +0000)]
Cisco VPN device driver - support IPSec connection updates
Provides support for IPSec connection updates and state changes. To do
this, the configuration of the connection is maintained, when the
connection is created. This is checked against the current settings, at
sync time, to determine whether a configuration change (as opposed to a
state change) has occurred.
If there is a change to the configuration detected, then the simple
approach is taken of deleting and then re-creating the connection, with
the new settings.
In addition, if the admin state of the connection changes, the tunnel
will be taken admin down/up, as needed. Admin down will occur if the
IPSec connection or the associated VPN service is set to admin down.
Admin up will occur, if both the IPSec connection and the VPN service
are in admin up state.
Added REST client method to allow changing the IPSec connection tunnel
to admin up/down (effectively doing a no-shut/shut on the tunnel I/F),
based on the above mentioned state.
Modified UTs for the support of IPSec connection update requests (used to
throw an "unsupported" exception), and to check that the configuration
and state changing are processed correctly.
Updated so that tunnel_ip is set in device driver, rather than hard
coding, and then overriding in REST client. Since device driver has the
same info, this will fit into future plans to obtain the info from
router, vs reading an .ini file. Revised UTs as well.
In case the network is without a subnet, calling the validation
logic during the report phase leads to an error because the LSN
would have been already allocated during the migration phase.
Bypass the issue by calling the plugin directly, which is what
the validation logic does in the first place.
Henry Gessau [Fri, 25 Apr 2014 19:46:58 +0000 (15:46 -0400)]
Allow ML2 plugin test cases to be run independently
Some test cases in neutron.tests.unit.ml2.test_ml2_plugin override the
network_vlan_ranges option in the ml2_type_vlan config group. However,
the test module does not import the ML2 type driver module where this
config group's options are registered. When unit tests are run by
tox/testr the module is imported during test discovery. Running the
tests independently via nose or testtools requires the option to be
explicitly imported.
Henry Gessau [Thu, 13 Feb 2014 16:58:47 +0000 (11:58 -0500)]
Cisco APIC ML2 mechanism driver, part 1
This set of changes introduces a mechanism driver for the
Cisco APIC. Please see the blueprint for more information.
The review is submitted in two parts:
- Part 1 (this one)
o APIC REST Client
o APIC data model and migration script
o APIC configurations
- Part 2 (dependent on part 1)
o APIC mechanism driver
o APIC manager
Ann Kamyshnikova [Thu, 24 Apr 2014 11:34:45 +0000 (15:34 +0400)]
Fix incorrect usage of sa.String() type
In downgrade of 4eca4a84f08a_remove_ml2_cisco_cred_db migartion
there is a mistake in usage SQLAlchemy String type.
Used sa.string() instead of sa.String()
Jakub Libosvar [Fri, 18 Apr 2014 13:31:55 +0000 (15:31 +0200)]
Fix H302 violations in extensions package
H302 violation is reported by flake8 when importing separated objects from
modules instead of importing the whole module.
e.g. from package.module import function
function()
is changed to
from package import module
module.function()
5b7e61c Dispose db connections pool on disconnect d1988b9 Set sql_mode callback on connect instead of checkout a1a8280 Fix excessive logging from db.sqlalchemy.session 9933bdd Get mysql_sql_mode parameter from config 96a2217 Prevent incorrect usage of _wrap_db_error() 20a7510 Add from_config() method to EngineFacade fea119e Drop special case for MySQL traditional mode, update unit tests dda24eb Introduce mysql_sql_mode option, remove old warning 0b5af67 Introduce a method to set any MySQL session SQL mode 8dccc7b Handle ibm_db_sa DBDuplicateEntry integrity errors 5b9e9f4 Fix doc build errors in db.sqlalchemy ac84a40 Update log translation domains 86707cd Remove None for dict.get() 0545121 Fix duplicating of SQL queries in logs fcf517d Update oslo log messages with translation domains 630d395 Don't use cfg.CONF in oslo.db ce69e7f Don't store engine instances in oslo.db
Earlier Cisco N1kv plugin was using list events api to
poll policies from VSM.
It was inefficient and caused delay in processing.
So, now Cisco N1kv plugin switched to list profiles to
poll policies from VSM.
If one quries NSX doing GET /ws.v1/lswitch/LS_UUID/lport and LS_UUID
is a UUID that does not exist in NSX. NSX raises a 404. If LS_UUID is *
NSX returns an empty result string. This patch fixes the fake_api_client
so that it's behavior is correct.
Code Review / openstack-build / neutron-build.git / log