From 5ac4310e0e8d97984b6e9b03ec841075e427b686 Mon Sep 17 00:00:00 2001 From: zhongjun Date: Wed, 29 Nov 2017 17:07:38 +0800 Subject: [PATCH] [policy in code] Add support for share and type extra resource [8/10] This patch adds policy in code support for share instance, share export location and share type extra specs resources. Change-Id: I9a89b4ececc583e85249cc925950e462e805b215 Partial-Implements: blueprint policy-in-code --- etc/manila/policy.json | 14 ----- manila/policies/__init__.py | 6 ++ manila/policies/share_export_location.py | 47 ++++++++++++++ manila/policies/share_instance.py | 70 +++++++++++++++++++++ manila/policies/share_types_extra_spec.py | 75 +++++++++++++++++++++++ manila/policy.py | 4 +- 6 files changed, 201 insertions(+), 15 deletions(-) create mode 100644 manila/policies/share_export_location.py create mode 100644 manila/policies/share_instance.py create mode 100644 manila/policies/share_types_extra_spec.py diff --git a/etc/manila/policy.json b/etc/manila/policy.json index 5c61446dab..6062094135 100644 --- a/etc/manila/policy.json +++ b/etc/manila/policy.json @@ -1,20 +1,6 @@ { "availability_zone:index": "rule:default", - "share_export_location:index": "rule:default", - "share_export_location:show": "rule:default", - - "share_instance:index": "rule:admin_api", - "share_instance:show": "rule:admin_api", - "share_instance:force_delete": "rule:admin_api", - "share_instance:reset_status": "rule:admin_api", - - "share_types_extra_spec:create": "rule:admin_api", - "share_types_extra_spec:update": "rule:admin_api", - "share_types_extra_spec:show": "rule:admin_api", - "share_types_extra_spec:index": "rule:admin_api", - "share_types_extra_spec:delete": "rule:admin_api", - "scheduler_stats:pools:index": "rule:admin_api", "scheduler_stats:pools:detail": "rule:admin_api", diff --git a/manila/policies/__init__.py b/manila/policies/__init__.py index 67e5cfddba..ad445840a3 100644 --- a/manila/policies/__init__.py +++ b/manila/policies/__init__.py @@ -21,10 +21,12 @@ from manila.policies import quota_class_set from manila.policies import quota_set from manila.policies import security_service from manila.policies import service +from manila.policies import share_export_location from manila.policies import share_group from manila.policies import share_group_snapshot from manila.policies import share_group_type from manila.policies import share_group_types_spec +from manila.policies import share_instance from manila.policies import share_instance_export_location from manila.policies import share_network from manila.policies import share_replica @@ -34,6 +36,7 @@ from manila.policies import share_snapshot_export_location from manila.policies import share_snapshot_instance from manila.policies import share_snapshot_instance_export_location from manila.policies import share_type +from manila.policies import share_types_extra_spec from manila.policies import shares @@ -43,6 +46,7 @@ def list_rules(): shares.list_rules(), share_instance_export_location.list_rules(), share_type.list_rules(), + share_types_extra_spec.list_rules(), share_snapshot.list_rules(), share_snapshot_export_location.list_rules(), share_snapshot_instance.list_rules(), @@ -58,4 +62,6 @@ def list_rules(): share_replica.list_rules(), share_network.list_rules(), security_service.list_rules(), + share_export_location.list_rules(), + share_instance.list_rules(), ) diff --git a/manila/policies/share_export_location.py b/manila/policies/share_export_location.py new file mode 100644 index 0000000000..af80b9d556 --- /dev/null +++ b/manila/policies/share_export_location.py @@ -0,0 +1,47 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_export_location:%s' + + +share_export_location_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_DEFAULT, + description="Get all export locations of a given share.", + operations=[ + { + 'method': 'GET', + 'path': '/shares/{share_id}/export_locations', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_DEFAULT, + description="Get details about the requested export location.", + operations=[ + { + 'method': 'GET', + 'path': ('/shares/{share_id}/export_locations/' + '{export_location_id}'), + } + ]), +] + + +def list_rules(): + return share_export_location_policies diff --git a/manila/policies/share_instance.py b/manila/policies/share_instance.py new file mode 100644 index 0000000000..fe553b8661 --- /dev/null +++ b/manila/policies/share_instance.py @@ -0,0 +1,70 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_instance:%s' + + +shares_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_ADMIN_API, + description="Get all share instances.", + operations=[ + { + 'method': 'GET', + 'path': '/share_instances', + }, + { + 'method': 'GET', + 'path': '/share_instances?{query}', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_ADMIN_API, + description="Get details of a share instance.", + operations=[ + { + 'method': 'GET', + 'path': '/share_instances/{share_instance_id}' + }, + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'force_delete', + check_str=base.RULE_ADMIN_API, + description="Force delete a share instance.", + operations=[ + { + 'method': 'POST', + 'path': '/share_instances/{share_instance_id}/action', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'reset_status', + check_str=base.RULE_ADMIN_API, + description="Reset share instance's status.", + operations=[ + { + 'method': 'POST', + 'path': '/share_instances/{share_instance_id}/action', + } + ]), +] + + +def list_rules(): + return shares_policies diff --git a/manila/policies/share_types_extra_spec.py b/manila/policies/share_types_extra_spec.py new file mode 100644 index 0000000000..67fc460c1c --- /dev/null +++ b/manila/policies/share_types_extra_spec.py @@ -0,0 +1,75 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from oslo_policy import policy + +from manila.policies import base + + +BASE_POLICY_NAME = 'share_types_extra_spec:%s' + +share_types_extra_spec_policies = [ + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'create', + check_str=base.RULE_ADMIN_API, + description="Create share type extra spec.", + operations=[ + { + 'method': 'POST', + 'path': '/types/{share_type_id}/extra_specs', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'show', + check_str=base.RULE_ADMIN_API, + description="Get share type extra specs of a given share type.", + operations=[ + { + 'method': 'GET', + 'path': '/types/{share_type_id}/extra_specs', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'index', + check_str=base.RULE_ADMIN_API, + description="Get details of a share type extra spec.", + operations=[ + { + 'method': 'GET', + 'path': '/types/{share_type_id}/extra_specs/{extra_spec_id}', + }, + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'update', + check_str=base.RULE_ADMIN_API, + description="Update share type extra spec.", + operations=[ + { + 'method': 'PUT', + 'path': '/types/{share_type_id}/extra_specs', + } + ]), + policy.DocumentedRuleDefault( + name=BASE_POLICY_NAME % 'delete', + check_str=base.RULE_ADMIN_API, + description="Delete share type extra spec.", + operations=[ + { + 'method': 'DELETE', + 'path': '/types/{share_type_id}/extra_specs/{key}', + } + ]), +] + + +def list_rules(): + return share_types_extra_spec_policies diff --git a/manila/policy.py b/manila/policy.py index c9c0c6a162..63904cf1ea 100644 --- a/manila/policy.py +++ b/manila/policy.py @@ -216,7 +216,9 @@ def check_policy(context, resource, action, target_obj=None): 'quota_set', 'quota_class_set', 'service', 'share_server', 'share_group', 'share_group_snapshot', 'share_group_type', 'share_group_types_spec', - 'share_replica', 'share_network', 'security_service', ): + 'share_replica', 'share_network', 'security_service', + 'share_types_extra_spec', 'share_instance', + 'share_export_location', ): authorize(context, _action, target) else: enforce(context, _action, target)