openstack
/
designate
Code Issues Proposed changes

Implement secure RBAC for zones 

This commit updates the policies for zones to understand scope
checking and account for a read-only role. This is part of a broader
series of changes across OpenStack to provide a consistent RBAC
experience and improve security.

Change-Id: Ib31cb82cbf62460723f261f1eaeec918633508c0
This commit is contained in:
Lance Bragstad 2020-11-23 22:16:08 +00:00
parent da1c94e47b
commit 0c952e4a74
1 changed files with 131 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

151
designate/common/policies/zone.py
View File

@ -13,29 +13,97 @@
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from designate.common.policies import base
DEPRECATED_REASON = """
The zone API now supports system scope and default roles.
"""
deprecated_create_zone = policy.DeprecatedRule(
name="create_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_get_zones = policy.DeprecatedRule(
name="get_zones",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_get_zone = policy.DeprecatedRule(
name="get_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_get_zone_servers = policy.DeprecatedRule(
name="get_zone_servers",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_find_zones = policy.DeprecatedRule(
name="find_zones",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_update_zone = policy.DeprecatedRule(
name="update_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_delete_zone = policy.DeprecatedRule(
name="delete_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_xfr_zone = policy.DeprecatedRule(
name="xfr_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_abandon_zone = policy.DeprecatedRule(
name="abandon_zone",
check_str=base.RULE_ADMIN
)
deprecated_count_zones = policy.DeprecatedRule(
name="count_zones",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_count_zones_pending_notify = policy.DeprecatedRule(
name="count_zones_pending_notify",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_purge_zones = policy.DeprecatedRule(
name="purge_zones",
check_str=base.RULE_ADMIN
)
deprecated_touch_zone = policy.DeprecatedRule(
name="touch_zone",
check_str=base.RULE_ADMIN_OR_OWNER
)
rules = [
policy.DocumentedRuleDefault(
name="create_zone",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Create Zone",
operations=[
{
'path': '/v2/zones',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_create_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="get_zones",
check_str=base.RULE_ADMIN_OR_OWNER
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_get_zones,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="get_zone",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description="Get Zone",
operations=[
{
@ -48,82 +116,125 @@ rules = [
'path': '/v2/zones/{zone_id}/recordsets/{recordset_id}',
'method': 'PUT'
}
]
],
deprecated_rule=deprecated_get_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="get_zone_servers",
check_str=base.RULE_ADMIN_OR_OWNER
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_get_zone_servers,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="find_zones",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description="List existing zones",
operations=[
{
'path': '/v2/zones',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_get_zone_servers,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="update_zone",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Update Zone",
operations=[
{
'path': '/v2/zones/{zone_id}',
'method': 'PATCH'
}
]
],
deprecated_rule=deprecated_update_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="delete_zone",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Delete Zone",
operations=[
{
'path': '/v2/zones/{zone_id}',
'method': 'DELETE'
}
]
],
deprecated_rule=deprecated_delete_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="xfr_zone",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Manually Trigger an Update of a Secondary Zone",
operations=[
{
'path': '/v2/zones/{zone_id}/tasks/xfr',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_xfr_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="abandon_zone",
check_str=base.RULE_ADMIN,
check_str=base.SYSTEM_ADMIN,
scope_types=['system'],
description="Abandon Zone",
operations=[
{
'path': '/v2/zones/{zone_id}/tasks/abandon',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_abandon_zone,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="count_zones",
check_str=base.RULE_ADMIN_OR_OWNER
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_count_zones,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="count_zones_pending_notify",
check_str=base.RULE_ADMIN_OR_OWNER
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_count_zones_pending_notify,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="purge_zones",
check_str=base.RULE_ADMIN
check_str=base.SYSTEM_ADMIN,
scope_types=['system'],
deprecated_rule=deprecated_purge_zones,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.RuleDefault(
name="touch_zone",
check_str=base.RULE_ADMIN_OR_OWNER
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
deprecated_rule=deprecated_purge_zones,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]