270d12e9a8
Cyborg Policy Default Refresh is one of the planned blueprints for victoria
release, the specification[0] has been merged in ussuri. To be brief, we need
to do the followings to incorporate authorization scopes into cyborg:
1. Add protection test for all APIs.
A protection test is similar to an API test, but purely focused on the
authoritative outcome.In other words, protection testing is sufficient when
we can assert that a user is or isn’t allowed to do or see something. For
example, users with a reader role on the system or a project shouldn’t be
able to make writable changes.
2. Add the following applicable seven personas to cyborg and mark old
ones as deprecated roles:
* project reader
* project member
* project admin
* system reader
* system admin
* system admin or owner
* system or project reader
3. Rewrite check string(authorization rules) using new personas for all APIs
4. Update policy documentation on cyborg-doc page
This patch refreshed cyborg default RBAC policy to scoped RBAC policy, and
reorganized the policy framework into a more logical way:
1) added seven personas to basic policies and marked legacy roles
as deprecated ones.
2) extract API_policies from policy.py to indenpendent policy files
3) extract authorize_wsgi.py out from policy.py
[0]https://specs.openstack.org/openstack/cyborg-specs/specs/ussuri/approved/policy-defaults-refresh.html
Story: 2007024
Task: 40835
Change-Id: I948d0202ddcd82a532c4de2c1850893cbfaf003d
Cyborg
OpenStack Acceleration as a Service
Cyborg provides a general management framework for accelerators such as FPGA, GPU, SoCs, NVMe SSDs, CCIX caches, DPDK/SPDK, pmem and so forth.
- Free software: Apache license
- Wiki: https://wiki.openstack.org/wiki/Cyborg
- Source: https://opendev.org/openstack/cyborg
- Blueprints and Bugs: https://storyboard.openstack.org/#!/project/openstack/cyborg
- Documentation: https://docs.openstack.org/cyborg/latest/
- Release notes: https://docs.openstack.org/releasenotes/cyborg/
- Design specifications: https://specs.openstack.org/openstack/cyborg-specs/
Features
- REST API for basic accelerator life cycle management
- Generic driver for common accelerator support