airship/deckhand
Code Issues Proposed changes

DECKHAND-61: oslo.policy integration

Browse Source 
This PS implements oslo.policy integration in Deckhand.
The policy.py file implements 2 types of functions for
performing policy enforcement in Deckhand: authorize,
which is a decorator that is used directly around
falcon on_HTTP_VERB methods that raises a 403 immediately
if policy enforcement fails; and conditional_authorize,
to be used inside controller code conditionally.

For example, since Deckhand has two types of documents
with respect to security -- encrypted and cleartext
documents -- policy enforcement is conditioned on the
type of the documents' metadata.storagePolicy.

Included in this PS:
  - policy framework implementation
  - policy in code and policy documentation for all
    Deckhand policies
  - modification of functional test script to override
    default admin-only policies with custom policy file
    dynamically created using lax permissions
  - bug fix for filtering out deleted documents (and
    its predecessors in previous revisions) for
    PUT /revisions/{revision_id}/documents
  - policy documentation
  - basic unit tests for policy enforcement framework
  - allow functional tests to be filtered via regex

Due to the size of this PS, functional tests related to
policy enforcement will be done in a follow up.

Change-Id: If418129f9b401091e098c0bd6c7336b8a5cd2359
This commit is contained in:
Felipe Monteiro
2017-09-21 18:22:03 +01:00
parent 3e62ace8ed
commit 582dee6fb9
37 changed files with 1038 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
releasenotes/notes/oslo.policy-integration-f03ac6a7a2ccef5a.yaml Normal file
View File

@@ -0,0 +1,7 @@
---
features:
- |
The ``oslo.policy`` framework has been integrated into Deckhand. All
currently supported endpoints are covered by RBAC enforcement. All
default policy rules are admin-only by default. The defaults can be
overriden via a custom ``policy.yaml`` file.