[CI] Fix portbiding tests

mandre · mandre · commit f70a5c1fd677 · 2024-03-13T09:04:50.000+01:00
Since https://review.opendev.org/c/openstack/neutron/+/909075, port-binding operation are restricted to the service role. Update the policies so that we can continue exercising these tests in CI. Fixes #2983
diff --git a/.github/workflows/functional-networking.yaml b/.github/workflows/functional-networking.yaml
@@ -28,6 +28,14 @@ jobs:
     steps:
       - name: Checkout Gophercloud
         uses: actions/checkout@v4
+      - name: Create additional neutron policies
+        run: |
+          mkdir /tmp/neutron-policies
+          cat << EOF >> /tmp/neutron-policies/port_binding.yaml
+          ---
+          "create_port:binding:profile": "rule:admin_only or rule:service_api"
+          "update_port:binding:profile": "rule:admin_only or rule:service_api"
+          EOF
       - name: Deploy devstack
         uses: EmilienM/devstack-action@c41f86d8df58b53c55f070207b6dfce656788cfd
         with:
@@ -36,6 +44,10 @@ jobs:
             enable_plugin neutron-dynamic-routing https://github.com/openstack/neutron-dynamic-routing ${{ matrix.openstack_version }}
             enable_plugin neutron-vpnaas https://github.com/openstack/neutron-vpnaas ${{ matrix.openstack_version }}
             Q_ML2_PLUGIN_EXT_DRIVERS=qos,port_security,dns_domain_keywords
+
+            [[post-config|\$NEUTRON_CONF]]
+            [oslo_policy]
+            policy_dirs = /tmp/neutron-policies
           enabled_services: 'neutron-dns,neutron-qos,neutron-segments,neutron-trunk,neutron-uplink-status-propagation,neutron-network-segment-range,neutron-port-forwarding'
       - name: Checkout go
         uses: actions/setup-go@v5
