openstack
/
designate
Code Issues Proposed changes

Implement secure RBAC for zone exports 

This commit updates the policies for zone exports to understand scope
checking and account for a read-only role. This is part of a broader
series of changes across OpenStack to provide a consistent RBAC
experience and improve security.

Change-Id: I5dde051a1ce565cd35cedc11cb0ff5afe35a8d72
This commit is contained in:
Lance Bragstad 2020-11-23 22:20:58 +00:00
parent 0c952e4a74
commit d9ee5be3b9
1 changed files with 57 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
designate/common/policies/zone_export.py
View File

@ -13,47 +13,87 @@
# under the License.
from oslo_log import versionutils
from oslo_policy import policy
from designate.common.policies import base
DEPRECATED_REASON = """
The zone export API now supports system scope and default roles.
"""
deprecated_zone_export = policy.DeprecatedRule(
name="zone_export",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_create_zone_export = policy.DeprecatedRule(
name="create_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_find_zone_exports = policy.DeprecatedRule(
name="find_zone_exports",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_get_zone_export = policy.DeprecatedRule(
name="get_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER
)
deprecated_update_zone_export = policy.DeprecatedRule(
name="update_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER
)
rules = [
policy.DocumentedRuleDefault(
name="zone_export",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Retrive a Zone Export from the Designate Datastore",
operations=[
{
'path': '/v2/zones/tasks/exports/{zone_export_id}/export',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_zone_export,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="create_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Create Zone Export",
operations=[
{
'path': '/v2/zones/{zone_id}/tasks/export',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_create_zone_export,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="find_zone_exports",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description="List Zone Exports",
operations=[
{
'path': '/v2/zones/tasks/exports',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_find_zone_exports,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="get_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_OR_PROJECT_READER,
scope_types=['system', 'project'],
description="Get Zone Exports",
operations=[
{
@ -63,18 +103,25 @@ rules = [
'path': '/v2/zones/tasks/exports/{zone_export_id}/export',
'method': 'GET'
}
]
],
deprecated_rule=deprecated_get_zone_export,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
),
policy.DocumentedRuleDefault(
name="update_zone_export",
check_str=base.RULE_ADMIN_OR_OWNER,
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'],
description="Update Zone Exports",
operations=[
{
'path': '/v2/zones/{zone_id}/tasks/export',
'method': 'POST'
}
]
],
deprecated_rule=deprecated_update_zone_export,
deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.WALLABY
)
]