Hua Wang
ce5b55dd31
Only the user who creates the bay can get the certificate and call the certificate signing request of the bay and create containers in the bay, which is needed by [1]. [1] https://github.com/openstack/magnum/blob/master/specs/ create-trustee-user-for-each-bay.rst Change-Id: Id959b76cb136ffbb0e6bcb8c3b83e02b30de66cf Closes-Bug: #1536883 Partially-Implements: blueprint create-trustee-user-for-each-bay
56 lines
1.7 KiB
JSON
56 lines
1.7 KiB
JSON
{
|
|
"context_is_admin": "role:admin",
|
|
"admin_or_owner": "is_admin:True or project_id:%(project_id)s",
|
|
"default": "rule:admin_or_owner",
|
|
"admin_api": "rule:context_is_admin",
|
|
"admin_or_user": "is_admin:True or user_id:%(user_id)s",
|
|
|
|
"bay:create": "rule:default",
|
|
"bay:delete": "rule:default",
|
|
"bay:detail": "rule:default",
|
|
"bay:get": "rule:default",
|
|
"bay:get_all": "rule:default",
|
|
"bay:update": "rule:default",
|
|
|
|
"baymodel:create": "rule:default",
|
|
"baymodel:delete": "rule:default",
|
|
"baymodel:detail": "rule:default",
|
|
"baymodel:get": "rule:default",
|
|
"baymodel:get_all": "rule:default",
|
|
"baymodel:update": "rule:default",
|
|
"baymodel:publish": "rule:admin_or_owner",
|
|
|
|
"pod:create": "rule:default",
|
|
"pod:delete": "rule:default",
|
|
"pod:detail": "rule:default",
|
|
"pod:get": "rule:default",
|
|
"pod:get_all": "rule:default",
|
|
"pod:update": "rule:default",
|
|
|
|
"rc:create": "rule:default",
|
|
"rc:delete": "rule:default",
|
|
"rc:detail": "rule:default",
|
|
"rc:get": "rule:default",
|
|
"rc:get_all": "rule:default",
|
|
"rc:update": "rule:default",
|
|
|
|
"service:create": "rule:default",
|
|
"service:delete": "rule:default",
|
|
"service:detail": "rule:default",
|
|
"service:get": "rule:default",
|
|
"service:get_all": "rule:default",
|
|
"service:update": "rule:default",
|
|
|
|
"container:create": "rule:admin_or_user",
|
|
"container:delete": "rule:admin_or_user",
|
|
"container:detail": "rule:default",
|
|
"container:get": "rule:default",
|
|
"container:get_all": "rule:default",
|
|
"container:update": "rule:admin_or_user",
|
|
|
|
"certificate:create": "rule:admin_or_user",
|
|
"certificate:get": "rule:admin_or_user",
|
|
|
|
"magnum-service:get_all": "rule:admin_api"
|
|
}
|