Open Stack

Hi,

I'm adding Akihiro to the thread as maybe he will have some more knowledge about
why it is like that in Neutron.

On Mon, Sep 07, 2020 at 07:52:54AM +0000, Zhi CZ Chang wrote:
>    Hi, all
>     
>    I have a question about Neutron Policy.
>     
>    I create some neutron policies in the file /etc/neutron/policy.json, plus
>    in this policy file, I don't want to anyone to create address scope and
>    set " "create_address_scope": "!" ". 
>     
>    After that, I execute the command line " openstack address scope create
>    test " by the admin user and it works fine.
>     
>    This is not my expected. 
>     
>    After some investigation, I find that in this pr[1], it will return True
>    directly even if the admin user. 
>     
>    Could someone tell me why the admin user can do anything without the
>    control of policies? Or maybe I make some mistakes?
>     
>     
>    Thanks
>     
>    1. https://review.opendev.org/#/c/175238/11/neutron/policy.py

-- 
Slawek Kaplonski
Principal software engineer
Red Hat