Changing policy.json is invalid for creating an aggregate

[wingwj]

In default, Aggregate actions require the admin-user to operate.

In order to give rights to normal-user, I change it in the policy.json , like this:

    from
        "compute_extension:aggregates": "rule:admin_api",
    to
        "compute_extension:aggregates": "",

But the operation result is also rejected.

----------------

I check the codes in Nova, the fault dues to def require_admin_context() in /nova/db/sqlalchemy/api.py.

That means Nova has checked the policy of one API twice.
So why twice? The policy has already checked in the api-layer.

That cause the problem happens~

[wingwj (wingwj)]

P.S. I checked the similar codes in Cinder/Neutron, they're the same..
If you want to change an admin_api to a regular one, this problem is also existed.

Can we wipe off the def require_admin_context() in db-layer, or use def require_context() instead?

[Christopher Yeoh (cyeoh-0)]

wingwj - this is on our list of things to do, see https://blueprints.launchpad.net/nova/+spec/v3-api-policy
For each case we do need to do an audit for wherever the db call is also called from and ensure that there are policy checks
for those cases as well

[Christopher Yeoh (cyeoh-0)]

Since this is being handled by the v3-api-policy blueprint and being tracked by that blueprint, I'm closing this bug report