tests: Configure policy in fwaas functional workflow

stephenfin · stephenfin · commit df9032a3eded · 2025-05-14T10:22:05.000+01:00
We already do this for the networking workflow. Now do it for the
fwaas-specific workflow.

Signed-off-by: Stephen Finucane &lt;stephenfin@redhat.com&gt;
diff --git a/.github/workflows/functional-fwaas_v2.yaml b/.github/workflows/functional-fwaas_v2.yaml
@@ -1,3 +1,7 @@
+# TODO(stephenfin): neutron-fwaas may support OVN now. If so, we can combine
+# this job with the functional-networking job. See [1]
+#
+# [1] https://bugs.launchpad.net/neutron/+bug/1971958
 name: functional-fwaas_v2
 on:
   pull_request:
@@ -29,6 +33,14 @@ jobs:
     steps:
       - name: Checkout Gophercloud
         uses: actions/checkout@v4
+      - name: Create additional neutron policies
+        run: |
+          mkdir /tmp/neutron-policies
+          cat << EOF >> /tmp/neutron-policies/port_binding.yaml
+          ---
+          "create_port:binding:profile": "rule:admin_only or rule:service_api"
+          "update_port:binding:profile": "rule:admin_only or rule:service_api"
+          EOF
       - name: Deploy devstack
         uses: gophercloud/devstack-action@v0.17
         with:
@@ -40,6 +52,10 @@ jobs:
             Q_ML2_PLUGIN_TYPE_DRIVERS=flat,gre,vlan,vxlan
             Q_ML2_TENANT_NETWORK_TYPE=vxlan
             Q_TUNNEL_TYPES=vxlan,gre
+
+            [[post-config|\$NEUTRON_CONF]]
+            [oslo_policy]
+            policy_dirs = /tmp/neutron-policies
           enabled_services: 'q-svc,q-agt,q-dhcp,q-l3,q-meta,q-fwaas-v2,-cinder,-horizon,-tempest,-swift,-c-sch,-c-api,-c-vol,-c-bak,-ovn,-ovn-controller,-ovn-northd,-q-ovn-metadata-agent,${{ matrix.additional_services }}'
       - name: Checkout go
         uses: actions/setup-go@v5
