diff options
| author | melanie witt <melwittt@gmail.com> | 2023-05-09 03:11:25 +0000 |
|---|---|---|
| committer | melanie witt <melwittt@gmail.com> | 2023-05-10 14:52:59 +0000 |
| commit | 41c64b94b0af333845e998f6cc195e72ca5ab6bc (patch) | |
| tree | c34fe5f4cb10c814ae0120ff1935660df8870284 /nova/tests/unit/volume/test_cinder.py | |
| parent | db455548a12beac1153ce04eca5e728d7b773901 (diff) | |
| download | nova-41c64b94b0af333845e998f6cc195e72ca5ab6bc.tar.gz | |
Enable use of service user token with admin context
When the [service_user] section is configured in nova.conf, nova will
have the ability to send a service user token alongside the user's
token. The service user token is sent when nova calls other services'
REST APIs to authenticate as a service, and service calls can sometimes
have elevated privileges.
Currently, nova does not however have the ability to send a service user
token with an admin context. This means that when nova makes REST API
calls to other services with an anonymous admin RequestContext (such as
in nova-manage or periodic tasks), it will not be authenticated as a
service.
This adds a keyword argument to service_auth.get_auth_plugin() to
enable callers to provide a user_auth object instead of attempting to
extract the user_auth from the RequestContext.
The cinder and neutron client modules are also adjusted to make use of
the new user_auth keyword argument so that nova calls made with
anonymous admin request contexts can authenticate as a service when
configured.
Related-Bug: #2004555
Change-Id: I14df2d55f4b2f0be58f1a6ad3f19e48f7a6bfcb4
Diffstat (limited to 'nova/tests/unit/volume/test_cinder.py')
| -rw-r--r-- | nova/tests/unit/volume/test_cinder.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/nova/tests/unit/volume/test_cinder.py b/nova/tests/unit/volume/test_cinder.py index e53ebe3cb8..f9080726fb 100644 --- a/nova/tests/unit/volume/test_cinder.py +++ b/nova/tests/unit/volume/test_cinder.py @@ -1276,3 +1276,14 @@ class CinderClientTestCase(test.NoDBTestCase): admin_ctx = context.get_admin_context() params = cinder._get_cinderclient_parameters(admin_ctx) self.assertEqual(params[0], mock_admin_auth) + + @mock.patch('nova.service_auth._SERVICE_AUTH') + @mock.patch('nova.volume.cinder._ADMIN_AUTH') + def test_admin_context_without_user_token_but_with_service_token( + self, mock_admin_auth, mock_service_auth + ): + self.flags(send_service_user_token=True, group='service_user') + admin_ctx = context.get_admin_context() + params = cinder._get_cinderclient_parameters(admin_ctx) + self.assertEqual(mock_admin_auth, params[0].user_auth) + self.assertEqual(mock_service_auth, params[0].service_auth) |