glance/setup.cfg
Zane Bitter 5c17e4c7ef Move policy defaults into code
Instead of a default policy.json file, policy defaults are now defined
in code. An operator need not supply policy.json data except to the
extent they want to override the defaults. Currently an empty
policy.json is still shipped because it is expected by devstack, but
this can be removed later. A sample policy.yaml file can be generated
using the genpolicy tox environment.

This partly fulfils the requirements of the policy in code goal[1].
However, because policies don't map 1:1 with APIs, it will not be
possible to fully document the policies until changes are made in how
policies are applied as proposed in https://review.opendev.org/528021

Due to the fact that existing policy files may rely on a rule named
"default" to specifiy policies not explicitly listed in the policy.json
file, all policies that are not admin-only by default now default to
"rule:default", so that the "default" rule will continue to apply to
those policies that are not listed in policy.json.

To ensure that this yields the expected policy in a standard
policy-in-code config file, the default value of the "default" rule is
now the empty string "". This is a change; between the Queens release
and now the default was set to "role:admin" to match the value specified
in the default policy.json file. An installation relying on both the
"default" rule for some policies and the default value of the default
rule may end up with a more permissive policy after upgrading. It's
likely that no such policies exist in the wild, because prior to the
Queens release the default value for the "default" rule was "@" (allow
all requests), so anybody relying on this rule will surely have
specified it explicitly in their policy.json.

Policies whose default is "role:admin" no longer use the "default" rule.
Therefore existing policy.json files that rely on the "default" rule for
those policies, and who have specified a value for the "default" rule
that is more permissive, will result in a more restrictive policy after
upgrading. It is unlikely that any of these policies exist in the wild
either.

[1] https://governance.openstack.org/tc/goals/selected/queens/policy-in-code.html

Change-Id: I8d1ccf5844078cc0b1652fb1130794daf07cedbc
2020-01-06 12:56:30 -05:00

108 lines
3.5 KiB
INI

[metadata]
name = glance
summary = OpenStack Image Service
description-file =
README.rst
author = OpenStack
author-email = openstack-discuss@lists.openstack.org
home-page = https://docs.openstack.org/glance/latest/
classifier =
Environment :: OpenStack
Intended Audience :: Information Technology
Intended Audience :: System Administrators
License :: OSI Approved :: Apache Software License
Operating System :: POSIX :: Linux
Programming Language :: Python
Programming Language :: Python :: 3
Programming Language :: Python :: 3.6
Programming Language :: Python :: 3.7
[files]
data_files =
etc/glance =
etc/glance-api.conf
etc/glance-cache.conf
etc/glance-manage.conf
etc/glance-registry.conf
etc/glance-scrubber.conf
etc/glance-api-paste.ini
etc/glance-registry-paste.ini
etc/policy.json
etc/glance/metadefs = etc/metadefs/*
packages =
glance
[entry_points]
console_scripts =
glance-api = glance.cmd.api:main
glance-cache-prefetcher = glance.cmd.cache_prefetcher:main
glance-cache-pruner = glance.cmd.cache_pruner:main
glance-cache-manage = glance.cmd.cache_manage:main
glance-cache-cleaner = glance.cmd.cache_cleaner:main
glance-control = glance.cmd.control:main
glance-manage = glance.cmd.manage:main
glance-registry = glance.cmd.registry:main
glance-replicator = glance.cmd.replicator:main
glance-scrubber = glance.cmd.scrubber:main
glance-status = glance.cmd.status:main
wsgi_scripts =
glance-wsgi-api = glance.common.wsgi_app:init_app
glance.common.image_location_strategy.modules =
location_order_strategy = glance.common.location_strategy.location_order
store_type_strategy = glance.common.location_strategy.store_type
oslo.config.opts =
glance.api = glance.opts:list_api_opts
glance.registry = glance.opts:list_registry_opts
glance.scrubber = glance.opts:list_scrubber_opts
glance.cache= glance.opts:list_cache_opts
glance.manage = glance.opts:list_manage_opts
glance = glance.opts:list_image_import_opts
oslo.config.opts.defaults =
glance.api = glance.common.config:set_cors_middleware_defaults
glance.database.migration_backend =
sqlalchemy = oslo_db.sqlalchemy.migration
glance.database.metadata_backend =
sqlalchemy = glance.db.sqlalchemy.metadata
oslo.policy.enforcer =
glance = glance.api.policy:get_enforcer
oslo.policy.policies =
glance = glance.policies:list_rules
glance.flows =
api_image_import = glance.async_.flows.api_image_import:get_flow
import = glance.async_.flows.base_import:get_flow
glance.flows.import =
convert = glance.async_.flows.convert:get_flow
introspect = glance.async_.flows.introspect:get_flow
ovf_process = glance.async_.flows.ovf_process:get_flow
glance.image_import.plugins =
no_op = glance.async_.flows.plugins.no_op:get_flow
inject_image_metadata=glance.async_.flows.plugins.inject_image_metadata:get_flow
image_conversion=glance.async_.flows.plugins.image_conversion:get_flow
glance.image_import.internal_plugins =
web_download = glance.async_.flows._internal_plugins.web_download:get_flow
[egg_info]
tag_build =
tag_date = 0
tag_svn_revision = 0
[compile_catalog]
directory = glance/locale
domain = glance
[update_catalog]
domain = glance
output_dir = glance/locale
input_file = glance/locale/glance.pot
[extract_messages]
keywords = _ gettext ngettext l_ lazy_gettext
mapping_file = babel.cfg
output_file = glance/locale/glance.pot