Remove 'require_admin_context' from sqlalchemy api

[Qin Zhao]

There are still many 'require_admin_context' defined for db operation, which prevent rbac definition in policy.json. For example, a user defined non-admin role to manage quota will not be able to modify quota size. Plan to remove 'require_admin_context' from sqlalchemy module, so that we only use policy to do those permission checking.

[Christopher Yeoh (cyeoh-0)]

This would be great - need to do a very good audit of all paths where the method is called though to ensure that on upgrade existing systems are not made any less secure (eg might need some updating of policies)

[Alex Xu (xuhj)]

There is bp I proposed for this. https://review.openstack.org/127863

[jichenjc (jichenjc)]

I remember we did some clean in Icehouse

maybe we need wait for Alex's bp to proceed

[Joe Gordon (jogo)]

This is being addressed by https://blueprints.launchpad.net/nova/+spec/v3-api-policy

[jichenjc (jichenjc)]

https://review.openstack.org/#/q/status:merged+project:openstack/nova+branch:master+topic:bp/nova-api-policy-final-part,n,z

with this , I think we can close this bug