diff --git a/ironic/drivers/modules/network/neutron.py b/ironic/drivers/modules/network/neutron.py index 26cfd23c74..9bcd2c5937 100644 --- a/ironic/drivers/modules/network/neutron.py +++ b/ironic/drivers/modules/network/neutron.py @@ -43,8 +43,11 @@ class NeutronNetwork(common.NeutronVIFPortIDMixin, """ # NOTE(TheJulia): These are the minimal networks needed for # the neutron network interface to function. - self.get_cleaning_network_uuid(task) - self.get_provisioning_network_uuid(task) + if 'admin' in task.context.roles: + # NOTE(TheJulia): In a fully integrated environment, the user + # must be an admin to fully resolve networking details. + self.get_cleaning_network_uuid(task) + self.get_provisioning_network_uuid(task) if (task.node.disable_power_off and not CONF.neutron.allow_disabling_power_off): raise exception.InvalidParameterValue( diff --git a/ironic/tests/unit/drivers/modules/network/test_neutron.py b/ironic/tests/unit/drivers/modules/network/test_neutron.py index d98c76eb59..b7a352d63d 100644 --- a/ironic/tests/unit/drivers/modules/network/test_neutron.py +++ b/ironic/tests/unit/drivers/modules/network/test_neutron.py @@ -87,6 +87,7 @@ class NeutronInterfaceTestCase(db_base.DbTestCase): @mock.patch.object(neutron_common, 'validate_network', autospec=True) def test_validate(self, validate_mock): + self.context.roles = ['admin', 'member', 'reader'] with task_manager.acquire(self.context, self.node.id) as task: self.interface.validate(task) # NOTE(TheJulia): This tests validates the calls are made. diff --git a/releasenotes/notes/fix-member-user-access-around-port-update-86118701989d8a61.yaml b/releasenotes/notes/fix-member-user-access-around-port-update-86118701989d8a61.yaml new file mode 100644 index 0000000000..9d63f9af49 --- /dev/null +++ b/releasenotes/notes/fix-member-user-access-around-port-update-86118701989d8a61.yaml @@ -0,0 +1,8 @@ +--- +fixes: + - | + Fixes an issue with the ``neutron`` ``network_interface`` driver where + validate calls by ``member`` scoped API users, triggered through a port + update or explicit node interface validation action would fail due to + the user being unable to resolve provisioning or cleaning networks + because the networks are in a different project.