[policy in code] Add support for group resource [6/10]
This patch adds policy in code support for group resources. Change-Id: I9a79b5ececc583e80149cc920950e462e805b142 Partial-Implements: blueprint policy-in-code
This commit is contained in:
parent
ba25aaf543
commit
4f959eeaf7
@ -36,22 +36,6 @@
|
||||
"scheduler_stats:pools:index": "rule:admin_api",
|
||||
"scheduler_stats:pools:detail": "rule:admin_api",
|
||||
|
||||
"share_group:create" : "rule:default",
|
||||
"share_group:delete": "rule:default",
|
||||
"share_group:update": "rule:default",
|
||||
"share_group:get": "rule:default",
|
||||
"share_group:get_all": "rule:default",
|
||||
"share_group:force_delete": "rule:admin_api",
|
||||
"share_group:reset_status": "rule:admin_api",
|
||||
|
||||
"share_group_snapshot:create" : "rule:default",
|
||||
"share_group_snapshot:delete": "rule:default",
|
||||
"share_group_snapshot:update" : "rule:default",
|
||||
"share_group_snapshot:get": "rule:default",
|
||||
"share_group_snapshot:get_all": "rule:default",
|
||||
"share_group_snapshot:force_delete": "rule:admin_api",
|
||||
"share_group_snapshot:reset_status": "rule:admin_api",
|
||||
|
||||
"share_replica:get_all": "rule:default",
|
||||
"share_replica:show": "rule:default",
|
||||
"share_replica:create" : "rule:default",
|
||||
@ -62,21 +46,6 @@
|
||||
"share_replica:force_delete": "rule:admin_api",
|
||||
"share_replica:reset_replica_state": "rule:admin_api",
|
||||
|
||||
"share_group_type:index": "rule:default",
|
||||
"share_group_type:show": "rule:default",
|
||||
"share_group_type:default": "rule:default",
|
||||
"share_group_type:create": "rule:admin_api",
|
||||
"share_group_type:delete": "rule:admin_api",
|
||||
"share_group_type:add_project_access": "rule:admin_api",
|
||||
"share_group_type:list_project_access": "rule:admin_api",
|
||||
"share_group_type:remove_project_access": "rule:admin_api",
|
||||
|
||||
"share_group_types_spec:create": "rule:admin_api",
|
||||
"share_group_types_spec:update": "rule:admin_api",
|
||||
"share_group_types_spec:show": "rule:admin_api",
|
||||
"share_group_types_spec:index": "rule:admin_api",
|
||||
"share_group_types_spec:delete": "rule:admin_api",
|
||||
|
||||
"message:delete": "rule:default",
|
||||
"message:get": "rule:default",
|
||||
"message:get_all": "rule:default"
|
||||
|
@ -20,6 +20,10 @@ from manila.policies import base
|
||||
from manila.policies import quota_class_set
|
||||
from manila.policies import quota_set
|
||||
from manila.policies import service
|
||||
from manila.policies import share_group
|
||||
from manila.policies import share_group_snapshot
|
||||
from manila.policies import share_group_type
|
||||
from manila.policies import share_group_types_spec
|
||||
from manila.policies import share_instance_export_location
|
||||
from manila.policies import share_server
|
||||
from manila.policies import share_snapshot
|
||||
@ -44,4 +48,8 @@ def list_rules():
|
||||
service.list_rules(),
|
||||
quota_set.list_rules(),
|
||||
quota_class_set.list_rules(),
|
||||
share_group_types_spec.list_rules(),
|
||||
share_group_type.list_rules(),
|
||||
share_group_snapshot.list_rules(),
|
||||
share_group.list_rules(),
|
||||
)
|
||||
|
108
manila/policies/share_group.py
Normal file
108
manila/policies/share_group.py
Normal file
@ -0,0 +1,108 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_group:%s'
|
||||
|
||||
|
||||
share_group_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'create',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Create share group.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-groups'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get details of a share group.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-groups/{share_group_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get_all',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get all share groups.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-groups'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-groups/detail'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-groups?{query}'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-groups/detail?{query}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Update share group.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/share-groups/{share_group_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Delete share group.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/share-groups/{share_group_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'force_delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Force delete a share group.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-groups/{share_group_id}/action'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'reset_status',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Reset share group's status.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-groups/{share_group_id}/action'
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_group_policies
|
110
manila/policies/share_group_snapshot.py
Normal file
110
manila/policies/share_group_snapshot.py
Normal file
@ -0,0 +1,110 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_group_snapshot:%s'
|
||||
|
||||
|
||||
share_group_snapshot_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'create',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Create a new share group snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-snapshots'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get details of a share group snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-snapshots/{share_group_snapshot_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get_all',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get all share group snapshots.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-snapshots'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-snapshots/detail'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-snapshots/{query}'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-snapshots/detail?{query}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Update a share group snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/share-group-snapshots/{share_group_snapshot_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Delete a share group snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/share-group-snapshots/{share_group_snapshot_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'force_delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Force delete a share group snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-snapshots/{share_group_snapshot_id}/'
|
||||
'action'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'reset_status',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Reset a share group snapshot's status.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-snapshots/{share_group_snapshot_id}/'
|
||||
'action'
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_group_snapshot_policies
|
110
manila/policies/share_group_type.py
Normal file
110
manila/policies/share_group_type.py
Normal file
@ -0,0 +1,110 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_group_type:%s'
|
||||
|
||||
|
||||
share_group_type_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'create',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Create a new share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-types',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get the list of share group types.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-types',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-types?is_public=all',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get details regarding the specified share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-types/{share_group_type_id}',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'default',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get the default share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-types/default',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Delete an existing group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/share-group-types/{share_group_type_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'list_project_access',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get project access by share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-types/{share_group_type_id}/access',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'add_project_access',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Allow project to use the share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-types/{share_group_type_id}/action',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'remove_project_access',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Deny project access to use the share group type.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-types/{share_group_type_id}/action',
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_group_type_policies
|
79
manila/policies/share_group_types_spec.py
Normal file
79
manila/policies/share_group_types_spec.py
Normal file
@ -0,0 +1,79 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_group_types_spec:%s'
|
||||
|
||||
|
||||
share_group_types_spec_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'create',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Create share group type specs.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/share-group-types/{share_group_type_id}/group-specs'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get share group type specs.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-group-types/{share_group_type_id}/group-specs',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get details of a share group type spec.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': ('/share-group-types/{share_group_type_id}/'
|
||||
'group-specs/{key}'),
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Update a share group type spec.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': ('/share-group-types/{share_group_type_id}'
|
||||
'/group-specs/{key}'),
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Delete a share group type spec.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': ('/share-group-types/{share_group_type_id}/'
|
||||
'group-specs/{key}'),
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_group_types_spec_policies
|
@ -214,7 +214,8 @@ def check_policy(context, resource, action, target_obj=None):
|
||||
'share_snapshot_instance',
|
||||
'share_snapshot_instance_export_location',
|
||||
'quota_set', 'quota_class_set', 'service',
|
||||
'share_server', ):
|
||||
'share_server', 'share_group', 'share_group_snapshot',
|
||||
'share_group_type', 'share_group_types_spec', ):
|
||||
authorize(context, _action, target)
|
||||
else:
|
||||
enforce(context, _action, target)
|
||||
|
Loading…
x
Reference in New Issue
Block a user