openstack/manila
Code Issues Proposed changes

[RBAC] Retain legacy admin behaviour

Browse Source 
The cross project effort around establishing
secure default RBAC policies has transformed over
the last release reacting to operator feedback.
The intended change to use system scope breaks
established workflows and requires a large effort
to transition deployments:

- https://etherpad.opendev.org/p/BER-2022-OPS-SRBAC
- https://etherpad.opendev.org/p/rbac-operator-feedback

So for now, all services are going to revert to
only supporting project scoped users by default.
This allows a legacy admin behavior to continue
working as intended; and does not prevent operators
overriding these defaults and using system scoped
personas.

https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html

Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
Change-Id: I5d3c1041738214ec8382edfd5494c10ff0be351a
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
This commit is contained in:
Goutham Pacha Ravi 2022-09-07 22:29:18 -07:00
parent 3f431ef9eb
commit 755a150318
30 changed files with 454 additions and 554 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
manila/policies/availability_zone.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'availability_zone:%s' BASE_POLICY_NAME = 'availability_zone:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The availability zone API now supports system scope and default roles. The availability zone API now supports scope and default roles.
""" """
deprecated_get_availability_zone = policy.DeprecatedRule( deprecated_get_availability_zone = policy.DeprecatedRule(
@ -33,9 +33,9 @@ deprecated_get_availability_zone = policy.DeprecatedRule(
availability_zone_policies = [ availability_zone_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Get all storage availability zones."), description="Get all storage availability zones.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',

101
manila/policies/base.py
View File

@ -16,12 +16,39 @@
from oslo_log import versionutils from oslo_log import versionutils
from oslo_policy import policy from oslo_policy import policy
# This check string is reserved for actions that require the highest level of
# authorization across projects to operate the deployment. They're allowed to
# create, read, update, or delete any system-wide resource such as
# share types, share group types, storage pools, etc. They can also operate on
# project-specific resources where applicable (e.g., cleaning up shares or
# snapshots).
ADMIN = 'rule:context_is_admin'
# This check string is the primary use case for typical end-users, who are
# working with resources that belong within a project (e.g., managing shares or
# share replicas). These users don't require all the authorization that
# administrators typically have.
PROJECT_MEMBER = 'rule:project-member'
# This check string should only be used to protect read-only project-specific
# resources. It should not be used to protect APIs that make writable changes
# (e.g., updating a share or snapshot). This persona is useful for someone who
# needs access for auditing or even support.
PROJECT_READER = 'rule:project-reader'
ADMIN_OR_PROJECT_MEMBER = f'({ADMIN}) or ({PROJECT_MEMBER})'
ADMIN_OR_PROJECT_READER = f'({ADMIN}) or ({PROJECT_READER})'
# Old, "unscoped", deprecated check strings to be removed. Do not use these
# in default RBAC any longer. These can be removed after "enforce_scope"
# defaults to True in oslo.policy
RULE_ADMIN_OR_OWNER = 'rule:admin_or_owner' RULE_ADMIN_OR_OWNER = 'rule:admin_or_owner'
RULE_ADMIN_API = 'rule:admin_api' RULE_ADMIN_API = 'rule:admin_api'
RULE_DEFAULT = 'rule:default' RULE_DEFAULT = 'rule:default'
deprecation_msg = ("The `context_is_admin` check is superseded by more " deprecation_msg = ("The `context_is_admin` check is superseded by more "
"specific check strings that consume system and project " "specific check strings that consume project "
"scope attributes from keystone tokens.") "scope attributes from keystone tokens.")
DEPRECATED_CONTEXT_IS_ADMIN = policy.DeprecatedRule( DEPRECATED_CONTEXT_IS_ADMIN = policy.DeprecatedRule(
name='context_is_admin', name='context_is_admin',
@ -30,76 +57,8 @@ DEPRECATED_CONTEXT_IS_ADMIN = policy.DeprecatedRule(
deprecated_since=versionutils.deprecated.WALLABY deprecated_since=versionutils.deprecated.WALLABY
) )
# Generic policy check string for system administrators. These are the people
# who need the highest level of authorization to operate the deployment.
# They're allowed to create, read, update, or delete any system-specific
# resource. They can also operate on project-specific resources where
# applicable (e.g., cleaning up shares or snapshots).
SYSTEM_ADMIN = 'rule:system-admin'
# Generic policy check string for system users who don't require all the
# authorization that system administrators typically have. This persona, or
# check string, typically isn't used by default, but it's existence it useful
# in the event a deployment wants to offload some administrative action from
# system administrator to system members.
SYSTEM_MEMBER = 'rule:system-member'
# Generic policy check string for read-only access to system-level resources.
# This persona is useful for someone who needs access for auditing or even
# support. These uses are also able to view project-specific resources where
# applicable (e.g., listing all shares in the deployment, regardless of the
# project they belong to).
SYSTEM_READER = 'rule:system-reader'
# This check string is reserved for actions that require the highest level of
# authorization on a project or resources within the project (e.g., resyncing a
# share replica).
PROJECT_ADMIN = 'rule:project-admin'
# This check string is the primary use case for typical end-users, who are
# working with resources that belong to a project (e.g., managing shares or
# share replicas).
PROJECT_MEMBER = 'rule:project-member'
# This check string should only be used to protect read-only project-specific
# resources. It should not be used to protect APIs that make writable changes
# (e.g., updating a share or snapshot).
PROJECT_READER = 'rule:project-reader'
# The following are common composite check strings that are useful for
# protecting APIs designed to operate with multiple scopes (e.g., a system
# administrator should be able to delete any share in the deployment, a
# project member should only be able to delete shares in their project).
SYSTEM_ADMIN_OR_PROJECT_ADMIN = (
'(' + SYSTEM_ADMIN + ') or (' + PROJECT_ADMIN + ')'
)
SYSTEM_ADMIN_OR_PROJECT_MEMBER = (
'(' + SYSTEM_ADMIN + ') or (' + PROJECT_MEMBER + ')'
)
SYSTEM_OR_PROJECT_READER = (
'(' + SYSTEM_READER + ') or (' + PROJECT_READER + ')'
)
rules = [ rules = [
# ***Default OpenStack scoped personas*** # # ***Default OpenStack scoped personas*** #
policy.RuleDefault(
name='system-admin',
check_str='role:admin and '
'system_scope:all',
description='System scoped Administrator',
scope_types=['system']),
policy.RuleDefault(
name='system-member',
check_str='role:member and '
'system_scope:all',
description='System scoped Member',
scope_types=['system']),
policy.RuleDefault(
name='system-reader',
check_str='role:reader and '
'system_scope:all',
description='System scoped Reader',
scope_types=['system']),
policy.RuleDefault( policy.RuleDefault(
name='project-admin', name='project-admin',
check_str='role:admin and ' check_str='role:admin and '
@ -122,10 +81,10 @@ rules = [
# ***Special personas for Manila*** # # ***Special personas for Manila*** #
policy.RuleDefault( policy.RuleDefault(
name='context_is_admin', name='context_is_admin',
check_str='rule:system-admin', check_str='role:admin',
description='Privileged users checked via "context.is_admin"', description='Privileged users checked via "context.is_admin"',
deprecated_rule=DEPRECATED_CONTEXT_IS_ADMIN, deprecated_rule=DEPRECATED_CONTEXT_IS_ADMIN,
scope_types=['system']), scope_types=['project']),
# ***Legacy/deprecated unscoped rules*** # # ***Legacy/deprecated unscoped rules*** #
# can be removed after "enforce_scope" defaults to True in oslo.policy # can be removed after "enforce_scope" defaults to True in oslo.policy

14
manila/policies/message.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'message:%s' BASE_POLICY_NAME = 'message:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The messages API now supports system scope and default roles. The messages API now supports scope and default roles.
""" """
deprecated_message_get = policy.DeprecatedRule( deprecated_message_get = policy.DeprecatedRule(
@ -45,8 +45,8 @@ deprecated_message_delete = policy.DeprecatedRule(
message_policies = [ message_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get', name=BASE_POLICY_NAME % 'get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a given message.", description="Get details of a given message.",
operations=[ operations=[
{ {
@ -58,8 +58,8 @@ message_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all', name=BASE_POLICY_NAME % 'get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all messages.", description="Get all messages.",
operations=[ operations=[
{ {
@ -75,8 +75,8 @@ message_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a message.", description="Delete a message.",
operations=[ operations=[
{ {

10
manila/policies/quota_class_set.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'quota_class_set:%s' BASE_POLICY_NAME = 'quota_class_set:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The quota class API now supports system scope and default roles. The quota class API now supports scope and default roles.
""" """
deprecated_quota_class_update = policy.DeprecatedRule( deprecated_quota_class_update = policy.DeprecatedRule(
@ -39,8 +39,8 @@ deprecated_quota_class_show = policy.DeprecatedRule(
quota_class_set_policies = [ quota_class_set_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Update quota class.", description="Update quota class.",
operations=[ operations=[
{ {
@ -56,8 +56,8 @@ quota_class_set_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get quota class.", description="Get quota class.",
operations=[ operations=[
{ {

44
manila/policies/quota_set.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'quota_set:%s' BASE_POLICY_NAME = 'quota_set:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The quota API now supports system scope and default roles. The quota API now supports scope and default roles.
""" """
deprecated_quota_update = policy.DeprecatedRule( deprecated_quota_update = policy.DeprecatedRule(
@ -45,78 +45,78 @@ deprecated_quota_delete = policy.DeprecatedRule(
quota_set_policies = [ quota_set_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description=("Update the quotas for a project/user and/or share " description=("Update the quotas for a project/user and/or share "
"type."), "type."),
operations=[ operations=[
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/quota-sets/{tenant_id}' 'path': '/quota-sets/{project_id}'
}, },
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/quota-sets/{tenant_id}?user_id={user_id}' 'path': '/quota-sets/{project_id}?user_id={user_id}'
}, },
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}' 'path': '/quota-sets/{project_id}?share_type={share_type_id}'
}, },
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/os-quota-sets/{tenant_id}' 'path': '/os-quota-sets/{project_id}'
}, },
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}' 'path': '/os-quota-sets/{project_id}?user_id={user_id}'
}, },
], ],
deprecated_rule=deprecated_quota_update deprecated_rule=deprecated_quota_update
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List the quotas for a tenant/user.", description="List the quotas for a project/user.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/quota-sets/{tenant_id}/defaults' 'path': '/quota-sets/{project_id}/defaults'
}, },
{ {
'method': 'GET', 'method': 'GET',
'path': '/os-quota-sets/{tenant_id}/defaults' 'path': '/os-quota-sets/{project_id}/defaults'
} }
], ],
deprecated_rule=deprecated_quota_show deprecated_rule=deprecated_quota_show
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description=("Delete quota for a tenant/user or " description=("Delete quota for a project/user or "
"tenant/share-type. The quota will revert back to " "project/share-type. The quota will revert back to "
"default (Admin only)."), "default (Admin only)."),
operations=[ operations=[
{ {
'method': 'DELETE', 'method': 'DELETE',
'path': '/quota-sets/{tenant_id}' 'path': '/quota-sets/{project_id}'
}, },
{ {
'method': 'DELETE', 'method': 'DELETE',
'path': '/quota-sets/{tenant_id}?user_id={user_id}' 'path': '/quota-sets/{project_id}?user_id={user_id}'
}, },
{ {
'method': 'DELETE', 'method': 'DELETE',
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}' 'path': '/quota-sets/{project_id}?share_type={share_type_id}'
}, },
{ {
'method': 'DELETE', 'method': 'DELETE',
'path': '/os-quota-sets/{tenant_id}' 'path': '/os-quota-sets/{project_id}'
}, },
{ {
'method': 'DELETE', 'method': 'DELETE',
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}' 'path': '/os-quota-sets/{project_id}?user_id={user_id}'
}, },
], ],
deprecated_rule=deprecated_quota_delete deprecated_rule=deprecated_quota_delete

16
manila/policies/scheduler_stats.py
View File

@ -39,15 +39,11 @@ deprecated_pool_detail = policy.DeprecatedRule(
scheduler_stats_policies = [ scheduler_stats_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get information regarding backends " description="Get information regarding backends "
"(and storage pools) known to the scheduler.", "(and storage pools) known to the scheduler.",
operations=[ operations=[
{
'method': 'GET',
'path': '/scheduler-stats/pools'
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/scheduler-stats/pools?{query}' 'path': '/scheduler-stats/pools?{query}'
@ -57,8 +53,8 @@ scheduler_stats_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail', name=BASE_POLICY_NAME % 'detail',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get detailed information regarding backends " description="Get detailed information regarding backends "
"(and storage pools) known to the scheduler.", "(and storage pools) known to the scheduler.",
operations=[ operations=[
@ -66,10 +62,6 @@ scheduler_stats_policies = [
'method': 'GET', 'method': 'GET',
'path': '/scheduler-stats/pools/detail?{query}' 'path': '/scheduler-stats/pools/detail?{query}'
}, },
{
'method': 'GET',
'path': '/scheduler-stats/pools/detail'
}
], ],
deprecated_rule=deprecated_pool_detail deprecated_rule=deprecated_pool_detail
), ),

40
manila/policies/security_service.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'security_service:%s' BASE_POLICY_NAME = 'security_service:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The security service API now supports system scope and default roles. The security service API now supports scope and default roles.
""" """
deprecated_security_service_create = policy.DeprecatedRule( deprecated_security_service_create = policy.DeprecatedRule(
@ -69,8 +69,8 @@ deprecated_security_service_get_all = policy.DeprecatedRule(
security_service_policies = [ security_service_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create security service.", description="Create security service.",
operations=[ operations=[
{ {
@ -82,8 +82,8 @@ security_service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a security service.", description="Get details of a security service.",
operations=[ operations=[
{ {
@ -95,31 +95,23 @@ security_service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail', name=BASE_POLICY_NAME % 'detail',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of all security services.", description="Get details of all security services.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/security-services/detail?{query}' 'path': '/security-services/detail?{query}'
}, },
{
'method': 'GET',
'path': '/security-services/detail'
}
], ],
deprecated_rule=deprecated_security_service_detail deprecated_rule=deprecated_security_service_detail
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all security services.", description="Get all security services under a project.",
operations=[ operations=[
{
'method': 'GET',
'path': '/security-services'
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/security-services?{query}' 'path': '/security-services?{query}'
@ -129,8 +121,8 @@ security_service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update a security service.", description="Update a security service.",
operations=[ operations=[
{ {
@ -142,8 +134,8 @@ security_service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a security service.", description="Delete a security service.",
operations=[ operations=[
{ {
@ -155,8 +147,8 @@ security_service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all_security_services', name=BASE_POLICY_NAME % 'get_all_security_services',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get security services of all projects.", description="Get security services of all projects.",
operations=[ operations=[
{ {

18
manila/policies/service.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'service:%s' BASE_POLICY_NAME = 'service:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The service API now supports system scope and default roles. The service API now supports scope and default roles.
""" """
deprecated_service_index = policy.DeprecatedRule( deprecated_service_index = policy.DeprecatedRule(
@ -39,22 +39,14 @@ deprecated_service_update = policy.DeprecatedRule(
service_policies = [ service_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Return a list of all running services.", description="Return a list of all running services.",
operations=[ operations=[
{
'method': 'GET',
'path': '/os-services',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/os-services?{query}', 'path': '/os-services?{query}',
}, },
{
'method': 'GET',
'path': '/services',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/services?{query}', 'path': '/services?{query}',
@ -64,8 +56,8 @@ service_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Enable/Disable scheduling for a service.", description="Enable/Disable scheduling for a service.",
operations=[ operations=[
{ {

10
manila/policies/share_access.py
View File

@ -22,7 +22,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_access_rule:%s' BASE_POLICY_NAME = 'share_access_rule:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share access rule API now supports system scope and default roles. The share access rule API now supports scope and default roles.
""" """
deprecated_access_rule_get = policy.DeprecatedRule( deprecated_access_rule_get = policy.DeprecatedRule(
@ -42,8 +42,8 @@ deprecated_access_rule_index = policy.DeprecatedRule(
share_access_rule_policies = [ share_access_rule_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get', name=BASE_POLICY_NAME % 'get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a share access rule.", description="Get details of a share access rule.",
operations=[ operations=[
{ {
@ -55,8 +55,8 @@ share_access_rule_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List access rules of a given share.", description="List access rules of a given share.",
operations=[ operations=[
{ {

8
manila/policies/share_access_metadata.py
View File

@ -42,8 +42,8 @@ deprecated_access_metadata_delete = policy.DeprecatedRule(
share_access_rule_metadata_policies = [ share_access_rule_metadata_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Set metadata for a share access rule.", description="Set metadata for a share access rule.",
operations=[ operations=[
{ {
@ -55,8 +55,8 @@ share_access_rule_metadata_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete metadata for a share access rule.", description="Delete metadata for a share access rule.",
operations=[ operations=[
{ {

8
manila/policies/share_export_location.py
View File

@ -39,8 +39,8 @@ deprecated_export_location_show = policy.DeprecatedRule(
share_export_location_policies = [ share_export_location_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all export locations of a given share.", description="Get all export locations of a given share.",
operations=[ operations=[
{ {
@ -52,8 +52,8 @@ share_export_location_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details about the requested export location.", description="Get details about the requested export location.",
operations=[ operations=[
{ {

38
manila/policies/share_group.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_group:%s' BASE_POLICY_NAME = 'share_group:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share group API now supports system scope and default roles. The share group API now supports scope and default roles.
""" """
deprecated_share_group_create = policy.DeprecatedRule( deprecated_share_group_create = policy.DeprecatedRule(
@ -69,8 +69,8 @@ deprecated_share_group_reset_status = policy.DeprecatedRule(
share_group_policies = [ share_group_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create share group.", description="Create share group.",
operations=[ operations=[
{ {
@ -82,8 +82,8 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get', name=BASE_POLICY_NAME % 'get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a share group.", description="Get details of a share group.",
operations=[ operations=[
{ {
@ -95,18 +95,10 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all', name=BASE_POLICY_NAME % 'get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share groups.", description="Get all share groups.",
operations=[ operations=[
{
'method': 'GET',
'path': '/share-groups'
},
{
'method': 'GET',
'path': '/share-groups/detail'
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-groups?{query}' 'path': '/share-groups?{query}'
@ -120,8 +112,8 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update share group.", description="Update share group.",
operations=[ operations=[
{ {
@ -133,8 +125,8 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete share group.", description="Delete share group.",
operations=[ operations=[
{ {
@ -146,8 +138,8 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force delete a share group.", description="Force delete a share group.",
operations=[ operations=[
{ {
@ -159,8 +151,8 @@ share_group_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset share group's status.", description="Reset share group's status.",
operations=[ operations=[
{ {

40
manila/policies/share_group_snapshot.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_group_snapshot:%s' BASE_POLICY_NAME = 'share_group_snapshot:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share group snapshots API now supports system scope and default roles. The share group snapshots API now supports scope and default roles.
""" """
deprecated_group_snapshot_create = policy.DeprecatedRule( deprecated_group_snapshot_create = policy.DeprecatedRule(
@ -69,8 +69,8 @@ deprecated_group_snapshot_reset_status = policy.DeprecatedRule(
share_group_snapshot_policies = [ share_group_snapshot_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create a new share group snapshot.", description="Create a new share group snapshot.",
operations=[ operations=[
{ {
@ -82,8 +82,8 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get', name=BASE_POLICY_NAME % 'get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a share group snapshot.", description="Get details of a share group snapshot.",
operations=[ operations=[
{ {
@ -95,21 +95,13 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all', name=BASE_POLICY_NAME % 'get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share group snapshots.", description="Get all share group snapshots.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-group-snapshots' 'path': '/share-group-snapshots?{query}'
},
{
'method': 'GET',
'path': '/share-group-snapshots/detail'
},
{
'method': 'GET',
'path': '/share-group-snapshots/{query}'
}, },
{ {
'method': 'GET', 'method': 'GET',
@ -120,8 +112,8 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update a share group snapshot.", description="Update a share group snapshot.",
operations=[ operations=[
{ {
@ -133,8 +125,8 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a share group snapshot.", description="Delete a share group snapshot.",
operations=[ operations=[
{ {
@ -146,8 +138,8 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force delete a share group snapshot.", description="Force delete a share group snapshot.",
operations=[ operations=[
{ {
@ -160,8 +152,8 @@ share_group_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset a share group snapshot's status.", description="Reset a share group snapshot's status.",
operations=[ operations=[
{ {

38
manila/policies/share_group_type.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_group_type:%s' BASE_POLICY_NAME = 'share_group_type:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share group type API now supports system scope and default roles. The share group type API now supports scope and default roles.
""" """
deprecated_share_group_type_create = policy.DeprecatedRule( deprecated_share_group_type_create = policy.DeprecatedRule(
@ -75,8 +75,8 @@ deprecated_share_group_type_remove_project = policy.DeprecatedRule(
share_group_type_policies = [ share_group_type_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Create a new share group type.", description="Create a new share group type.",
operations=[ operations=[
{ {
@ -88,14 +88,10 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get the list of share group types.", description="Get the list of share group types.",
operations=[ operations=[
{
'method': 'GET',
'path': '/share-group-types',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-group-types?is_public=all', 'path': '/share-group-types?is_public=all',
@ -105,8 +101,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details regarding the specified share group type.", description="Get details regarding the specified share group type.",
operations=[ operations=[
{ {
@ -118,8 +114,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'default', name=BASE_POLICY_NAME % 'default',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get the default share group type.", description="Get the default share group type.",
operations=[ operations=[
{ {
@ -131,8 +127,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Delete an existing group type.", description="Delete an existing group type.",
operations=[ operations=[
{ {
@ -144,8 +140,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'list_project_access', name=BASE_POLICY_NAME % 'list_project_access',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get project access by share group type.", description="Get project access by share group type.",
operations=[ operations=[
{ {
@ -157,8 +153,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'add_project_access', name=BASE_POLICY_NAME % 'add_project_access',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Allow project to use the share group type.", description="Allow project to use the share group type.",
operations=[ operations=[
{ {
@ -170,8 +166,8 @@ share_group_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'remove_project_access', name=BASE_POLICY_NAME % 'remove_project_access',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Deny project access to use the share group type.", description="Deny project access to use the share group type.",
operations=[ operations=[
{ {

20
manila/policies/share_group_types_spec.py
View File

@ -57,8 +57,8 @@ deprecated_group_type_spec_delete = policy.DeprecatedRule(
share_group_types_spec_policies = [ share_group_types_spec_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Create share group type specs.", description="Create share group type specs.",
operations=[ operations=[
{ {
@ -70,8 +70,8 @@ share_group_types_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share group type specs.", description="Get share group type specs.",
operations=[ operations=[
{ {
@ -83,8 +83,8 @@ share_group_types_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get details of a share group type spec.", description="Get details of a share group type spec.",
operations=[ operations=[
{ {
@ -97,8 +97,8 @@ share_group_types_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Update a share group type spec.", description="Update a share group type spec.",
operations=[ operations=[
{ {
@ -111,8 +111,8 @@ share_group_types_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Delete a share group type spec.", description="Delete a share group type spec.",
operations=[ operations=[
{ {

18
manila/policies/share_instance.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_instance:%s' BASE_POLICY_NAME = 'share_instance:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share instances API now supports system scope and default roles. The share instances API now supports scope and default roles.
""" """
deprecated_share_instances_index = policy.DeprecatedRule( deprecated_share_instances_index = policy.DeprecatedRule(
@ -51,8 +51,8 @@ deprecated_share_instance_reset_status = policy.DeprecatedRule(
shares_policies = [ shares_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get all share instances.", description="Get all share instances.",
operations=[ operations=[
{ {
@ -68,8 +68,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get details of a share instance.", description="Get details of a share instance.",
operations=[ operations=[
{ {
@ -81,8 +81,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Force delete a share instance.", description="Force delete a share instance.",
operations=[ operations=[
{ {
@ -94,8 +94,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Reset share instance's status.", description="Reset share instance's status.",
operations=[ operations=[
{ {

11
manila/policies/share_instance_export_location.py
View File

@ -22,8 +22,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_instance_export_location:%s' BASE_POLICY_NAME = 'share_instance_export_location:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share instance export location API now supports system scope and default The share instance export location API now supports scope and default roles.
roles.
""" """
deprecated_instance_export_location_index = policy.DeprecatedRule( deprecated_instance_export_location_index = policy.DeprecatedRule(
@ -43,8 +42,8 @@ deprecated_instance_export_location_show = policy.DeprecatedRule(
share_export_location_policies = [ share_export_location_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Return data about the requested export location.', description='Return data about the requested export location.',
operations=[ operations=[
{ {
@ -57,8 +56,8 @@ share_export_location_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Return data about the requested export location.', description='Return data about the requested export location.',
operations=[ operations=[
{ {

68
manila/policies/share_network.py
View File

@ -110,8 +110,8 @@ deprecated_share_network_subnet_create_check = policy.DeprecatedRule(
share_network_policies = [ share_network_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create share network.", description="Create share network.",
operations=[ operations=[
{ {
@ -123,8 +123,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a share network.", description="Get details of a share network.",
operations=[ operations=[
{ {
@ -136,14 +136,10 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share networks.", description="Get all share networks under a project.",
operations=[ operations=[
{
'method': 'GET',
'path': '/share-networks'
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-networks?{query}' 'path': '/share-networks?{query}'
@ -153,25 +149,21 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail', name=BASE_POLICY_NAME % 'detail',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of share networks .", description="Get details of share networks under a project.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-networks/detail?{query}' 'path': '/share-networks/detail?{query}'
}, },
{
'method': 'GET',
'path': '/share-networks/detail'
},
], ],
deprecated_rule=deprecated_share_network_detail deprecated_rule=deprecated_share_network_detail
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update a share network.", description="Update a share network.",
operations=[ operations=[
{ {
@ -183,8 +175,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a share network.", description="Delete a share network.",
operations=[ operations=[
{ {
@ -196,8 +188,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'add_security_service', name=BASE_POLICY_NAME % 'add_security_service',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Add security service to share network.", description="Add security service to share network.",
operations=[ operations=[
{ {
@ -209,8 +201,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'add_security_service_check', name=BASE_POLICY_NAME % 'add_security_service_check',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Check the feasibility of add security service to a share " description="Check the feasibility of add security service to a share "
"network.", "network.",
operations=[ operations=[
@ -223,8 +215,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'remove_security_service', name=BASE_POLICY_NAME % 'remove_security_service',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Remove security service from share network.", description="Remove security service from share network.",
operations=[ operations=[
{ {
@ -236,8 +228,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update_security_service', name=BASE_POLICY_NAME % 'update_security_service',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update security service from share network.", description="Update security service from share network.",
operations=[ operations=[
{ {
@ -249,8 +241,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update_security_service_check', name=BASE_POLICY_NAME % 'update_security_service_check',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Check the feasibility of update a security service from " description="Check the feasibility of update a security service from "
"share network.", "share network.",
operations=[ operations=[
@ -263,8 +255,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset share network`s status.", description="Reset share network`s status.",
operations=[ operations=[
{ {
@ -276,8 +268,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all_share_networks', name=BASE_POLICY_NAME % 'get_all_share_networks',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share networks belonging to all projects.", description="Get share networks belonging to all projects.",
operations=[ operations=[
{ {
@ -293,8 +285,8 @@ share_network_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'subnet_create_check', name=BASE_POLICY_NAME % 'subnet_create_check',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Check the feasibility of create a new share network " description="Check the feasibility of create a new share network "
"subnet for share network.", "subnet for share network.",
operations=[ operations=[

18
manila/policies/share_network_subnet.py
View File

@ -21,7 +21,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_network_subnet:%s' BASE_POLICY_NAME = 'share_network_subnet:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share network subnet API now supports system scope and default roles. The share network subnet API now supports scope and default roles.
""" """
deprecated_subnet_create = policy.DeprecatedRule( deprecated_subnet_create = policy.DeprecatedRule(
@ -53,8 +53,8 @@ deprecated_subnet_index = policy.DeprecatedRule(
share_network_subnet_policies = [ share_network_subnet_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create a new share network subnet.", description="Create a new share network subnet.",
operations=[ operations=[
{ {
@ -66,8 +66,8 @@ share_network_subnet_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a share network subnet.", description="Delete a share network subnet.",
operations=[ operations=[
{ {
@ -80,8 +80,8 @@ share_network_subnet_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Shows a share network subnet.", description="Shows a share network subnet.",
operations=[ operations=[
{ {
@ -94,8 +94,8 @@ share_network_subnet_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share network subnets.", description="Get all share network subnets.",
operations=[ operations=[
{ {

38
manila/policies/share_replica.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_replica:%s' BASE_POLICY_NAME = 'share_replica:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share replica API now supports system scope and default roles. The share replica API now supports scope and default roles.
""" """
deprecated_replica_create = policy.DeprecatedRule( deprecated_replica_create = policy.DeprecatedRule(
@ -81,8 +81,8 @@ deprecated_replica_reset_status = policy.DeprecatedRule(
share_replica_policies = [ share_replica_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create share replica.", description="Create share replica.",
operations=[ operations=[
{ {
@ -94,8 +94,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all', name=BASE_POLICY_NAME % 'get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share replicas.", description="Get all share replicas.",
operations=[ operations=[
{ {
@ -115,8 +115,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a share replica.", description="Get details of a share replica.",
operations=[ operations=[
{ {
@ -128,8 +128,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete a share replica.", description="Delete a share replica.",
operations=[ operations=[
{ {
@ -141,8 +141,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force delete a share replica.", description="Force delete a share replica.",
operations=[ operations=[
{ {
@ -154,8 +154,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'promote', name=BASE_POLICY_NAME % 'promote',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Promote a non-active share replica to active.", description="Promote a non-active share replica to active.",
operations=[ operations=[
{ {
@ -167,8 +167,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'resync', name=BASE_POLICY_NAME % 'resync',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Resync a share replica that is out of sync.", description="Resync a share replica that is out of sync.",
operations=[ operations=[
{ {
@ -180,8 +180,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_replica_state', name=BASE_POLICY_NAME % 'reset_replica_state',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset share replica's replica_state attribute.", description="Reset share replica's replica_state attribute.",
operations=[ operations=[
{ {
@ -193,8 +193,8 @@ share_replica_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset share replica's status.", description="Reset share replica's status.",
operations=[ operations=[
{ {

11
manila/policies/share_replica_export_location.py
View File

@ -19,8 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_replica_export_location:%s' BASE_POLICY_NAME = 'share_replica_export_location:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share replica export location API now supports system scope and default The share replica export location API now supports scope and default roles.
roles.
""" """
deprecated_replica_location_index = policy.DeprecatedRule( deprecated_replica_location_index = policy.DeprecatedRule(
@ -40,8 +39,8 @@ deprecated_replica_location_show = policy.DeprecatedRule(
share_replica_export_location_policies = [ share_replica_export_location_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all export locations of a given share replica.", description="Get all export locations of a given share replica.",
operations=[ operations=[
{ {
@ -53,8 +52,8 @@ share_replica_export_location_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details about the requested share replica export " description="Get details about the requested share replica export "
"location.", "location.",
operations=[ operations=[

60
manila/policies/share_server.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_server:%s' BASE_POLICY_NAME = 'share_server:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share server API now supports system scope and default roles. The share server API now supports scope and default roles.
""" """
deprecated_server_index = policy.DeprecatedRule( deprecated_server_index = policy.DeprecatedRule(
@ -105,14 +105,10 @@ deprecated_server_reset_task_state = policy.DeprecatedRule(
share_server_policies = [ share_server_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share servers.", description="Get share servers.",
operations=[ operations=[
{
'method': 'GET',
'path': '/share-servers',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/share-servers?{query}', 'path': '/share-servers?{query}',
@ -122,8 +118,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Show share server.", description="Show share server.",
operations=[ operations=[
{ {
@ -135,8 +131,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'details', name=BASE_POLICY_NAME % 'details',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share server details.", description="Get share server details.",
operations=[ operations=[
{ {
@ -148,8 +144,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Delete share server.", description="Delete share server.",
operations=[ operations=[
{ {
@ -161,8 +157,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'manage_share_server', name=BASE_POLICY_NAME % 'manage_share_server',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Manage share server.", description="Manage share server.",
operations=[ operations=[
{ {
@ -174,8 +170,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'unmanage_share_server', name=BASE_POLICY_NAME % 'unmanage_share_server',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Unmanage share server.", description="Unmanage share server.",
operations=[ operations=[
{ {
@ -187,8 +183,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Reset the status of a share server.", description="Reset the status of a share server.",
operations=[ operations=[
{ {
@ -200,8 +196,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_migration_start', name=BASE_POLICY_NAME % 'share_server_migration_start',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Migrates a share server to the specified host.", description="Migrates a share server to the specified host.",
operations=[ operations=[
{ {
@ -213,8 +209,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_migration_check', name=BASE_POLICY_NAME % 'share_server_migration_check',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Check if can migrates a share server to the specified " description="Check if can migrates a share server to the specified "
"host.", "host.",
operations=[ operations=[
@ -227,8 +223,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_migration_complete', name=BASE_POLICY_NAME % 'share_server_migration_complete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Invokes the 2nd phase of share server migration.", description="Invokes the 2nd phase of share server migration.",
operations=[ operations=[
{ {
@ -240,8 +236,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_migration_cancel', name=BASE_POLICY_NAME % 'share_server_migration_cancel',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Attempts to cancel share server migration.", description="Attempts to cancel share server migration.",
operations=[ operations=[
{ {
@ -253,8 +249,8 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_migration_get_progress', name=BASE_POLICY_NAME % 'share_server_migration_get_progress',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description=("Retrieves the share server migration progress for a " description=("Retrieves the share server migration progress for a "
"given share server."), "given share server."),
operations=[ operations=[
@ -267,9 +263,9 @@ share_server_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'share_server_reset_task_state', name=BASE_POLICY_NAME % 'share_server_reset_task_state',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description=("Resets task state."), description="Resets task state.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',

58
manila/policies/share_snapshot.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_snapshot:%s' BASE_POLICY_NAME = 'share_snapshot:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share snapshot API now supports system scope and default roles. The share snapshot API now supports scope and default roles.
""" """
deprecated_snapshot_get = policy.DeprecatedRule( deprecated_snapshot_get = policy.DeprecatedRule(
@ -99,8 +99,8 @@ deprecated_get_snapshot_metadata = policy.DeprecatedRule(
share_snapshot_policies = [ share_snapshot_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_snapshot', name=BASE_POLICY_NAME % 'get_snapshot',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get share snapshot.", description="Get share snapshot.",
operations=[ operations=[
{ {
@ -112,18 +112,10 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all_snapshots', name=BASE_POLICY_NAME % 'get_all_snapshots',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get all share snapshots.", description="Get all share snapshots.",
operations=[ operations=[
{
'method': 'GET',
'path': '/snapshots'
},
{
'method': 'GET',
'path': '/snapshots/detail'
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/snapshots?{query}' 'path': '/snapshots?{query}'
@ -137,8 +129,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force Delete a share snapshot.", description="Force Delete a share snapshot.",
operations=[ operations=[
{ {
@ -150,8 +142,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'manage_snapshot', name=BASE_POLICY_NAME % 'manage_snapshot',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Manage share snapshot.", description="Manage share snapshot.",
operations=[ operations=[
{ {
@ -163,8 +155,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'unmanage_snapshot', name=BASE_POLICY_NAME % 'unmanage_snapshot',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Unmanage share snapshot.", description="Unmanage share snapshot.",
operations=[ operations=[
{ {
@ -176,8 +168,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Reset status.", description="Reset status.",
operations=[ operations=[
{ {
@ -189,8 +181,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'access_list', name=BASE_POLICY_NAME % 'access_list',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List access rules of a share snapshot.", description="List access rules of a share snapshot.",
operations=[ operations=[
{ {
@ -202,8 +194,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'allow_access', name=BASE_POLICY_NAME % 'allow_access',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Allow access to a share snapshot.", description="Allow access to a share snapshot.",
operations=[ operations=[
{ {
@ -215,8 +207,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'deny_access', name=BASE_POLICY_NAME % 'deny_access',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Deny access to a share snapshot.", description="Deny access to a share snapshot.",
operations=[ operations=[
{ {
@ -228,8 +220,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update_metadata', name=BASE_POLICY_NAME % 'update_metadata',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update snapshot metadata.", description="Update snapshot metadata.",
operations=[ operations=[
{ {
@ -249,8 +241,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete_metadata', name=BASE_POLICY_NAME % 'delete_metadata',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete snapshot metadata.", description="Delete snapshot metadata.",
operations=[ operations=[
{ {
@ -262,8 +254,8 @@ share_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_metadata', name=BASE_POLICY_NAME % 'get_metadata',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get snapshot metadata.", description="Get snapshot metadata.",
operations=[ operations=[
{ {

10
manila/policies/share_snapshot_export_location.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_snapshot_export_location:%s' BASE_POLICY_NAME = 'share_snapshot_export_location:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share snapshot location API now supports system scope and default roles. The share snapshot location API now supports scope and default roles.
""" """
deprecated_snapshot_location_index = policy.DeprecatedRule( deprecated_snapshot_location_index = policy.DeprecatedRule(
@ -39,8 +39,8 @@ deprecated_snapshot_location_show = policy.DeprecatedRule(
share_snapshot_export_location_policies = [ share_snapshot_export_location_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List export locations of a share snapshot.", description="List export locations of a share snapshot.",
operations=[ operations=[
{ {
@ -52,8 +52,8 @@ share_snapshot_export_location_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get details of a specified export location of a " description="Get details of a specified export location of a "
"share snapshot.", "share snapshot.",
operations=[ operations=[

26
manila/policies/share_snapshot_instance.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_snapshot_instance:%s' BASE_POLICY_NAME = 'share_snapshot_instance:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share snapshot instance API now supports system scope and default roles. The share snapshot instance API now supports scope and default roles.
""" """
deprecated_snapshot_instance_show = policy.DeprecatedRule( deprecated_snapshot_instance_show = policy.DeprecatedRule(
@ -51,8 +51,8 @@ deprecated_snapshot_instance_reset_status = policy.DeprecatedRule(
share_snapshot_instance_policies = [ share_snapshot_instance_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share snapshot instance.", description="Get share snapshot instance.",
operations=[ operations=[
{ {
@ -64,14 +64,10 @@ share_snapshot_instance_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get all share snapshot instances.", description="Get all share snapshot instances.",
operations=[ operations=[
{
'method': 'GET',
'path': '/snapshot-instances',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/snapshot-instances?{query}', 'path': '/snapshot-instances?{query}',
@ -81,14 +77,10 @@ share_snapshot_instance_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail', name=BASE_POLICY_NAME % 'detail',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get details of share snapshot instances.", description="Get details of share snapshot instances.",
operations=[ operations=[
{
'method': 'GET',
'path': '/snapshot-instances/detail',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/snapshot-instances/detail?{query}', 'path': '/snapshot-instances/detail?{query}',
@ -98,8 +90,8 @@ share_snapshot_instance_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Reset share snapshot instance's status.", description="Reset share snapshot instance's status.",
operations=[ operations=[
{ {

10
manila/policies/share_snapshot_instance_export_location.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_snapshot_instance_export_location:%s' BASE_POLICY_NAME = 'share_snapshot_instance_export_location:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share snapshot instance export location API now supports system scope and The share snapshot instance export location API now supports scope and
default roles. default roles.
""" """
@ -40,8 +40,8 @@ deprecated_snapshot_instance_show = policy.DeprecatedRule(
share_snapshot_instance_export_location_policies = [ share_snapshot_instance_export_location_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="List export locations of a share snapshot instance.", description="List export locations of a share snapshot instance.",
operations=[ operations=[
{ {
@ -54,8 +54,8 @@ share_snapshot_instance_export_location_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Show details of a specified export location of a share " description="Show details of a specified export location of a share "
"snapshot instance.", "snapshot instance.",
operations=[ operations=[

42
manila/policies/share_type.py
View File

@ -22,7 +22,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_type:%s' BASE_POLICY_NAME = 'share_type:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share type API now supports system scope and default roles. The share type API now supports scope and default roles.
""" """
deprecated_share_type_create = policy.DeprecatedRule( deprecated_share_type_create = policy.DeprecatedRule(
@ -84,8 +84,8 @@ deprecated_share_type_remove_project_access = policy.DeprecatedRule(
share_type_policies = [ share_type_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Create share type.', description='Create share type.',
operations=[ operations=[
{ {
@ -97,8 +97,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Update share type.', description='Update share type.',
operations=[ operations=[
{ {
@ -110,8 +110,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description='Get share type.', description='Get share type.',
operations=[ operations=[
{ {
@ -123,14 +123,10 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description='List share types.', description='List share types.',
operations=[ operations=[
{
'method': 'GET',
'path': '/types',
},
{ {
'method': 'GET', 'method': 'GET',
'path': '/types?is_public=all', 'path': '/types?is_public=all',
@ -140,8 +136,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'default', name=BASE_POLICY_NAME % 'default',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description='Get default share type.', description='Get default share type.',
operations=[ operations=[
{ {
@ -153,8 +149,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Delete share type.', description='Delete share type.',
operations=[ operations=[
{ {
@ -166,8 +162,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'list_project_access', name=BASE_POLICY_NAME % 'list_project_access',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='List share type project access.', description='List share type project access.',
operations=[ operations=[
{ {
@ -179,8 +175,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'add_project_access', name=BASE_POLICY_NAME % 'add_project_access',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Add share type to project.', description='Add share type to project.',
operations=[ operations=[
{ {
@ -192,8 +188,8 @@ share_type_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'remove_project_access', name=BASE_POLICY_NAME % 'remove_project_access',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description='Remove share type from project.', description='Remove share type from project.',
operations=[ operations=[
{ {

22
manila/policies/share_types_extra_spec.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share_types_extra_spec:%s' BASE_POLICY_NAME = 'share_types_extra_spec:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share types extra specs API now supports system scope and default roles. The share types extra specs API now supports scope and default roles.
""" """
deprecated_extra_spec_create = policy.DeprecatedRule( deprecated_extra_spec_create = policy.DeprecatedRule(
@ -57,8 +57,8 @@ deprecated_extra_spec_delete = policy.DeprecatedRule(
share_types_extra_spec_policies = [ share_types_extra_spec_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Create share type extra spec.", description="Create share type extra spec.",
operations=[ operations=[
{ {
@ -70,8 +70,8 @@ share_types_extra_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show', name=BASE_POLICY_NAME % 'show',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get share type extra specs of a given share type.", description="Get share type extra specs of a given share type.",
operations=[ operations=[
{ {
@ -83,8 +83,8 @@ share_types_extra_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index', name=BASE_POLICY_NAME % 'index',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Get details of a share type extra spec.", description="Get details of a share type extra spec.",
operations=[ operations=[
{ {
@ -96,8 +96,8 @@ share_types_extra_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Update share type extra spec.", description="Update share type extra spec.",
operations=[ operations=[
{ {
@ -109,8 +109,8 @@ share_types_extra_spec_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Delete share type extra spec.", description="Delete share type extra spec.",
operations=[ operations=[
{ {

185
manila/policies/shares.py
View File

@ -19,7 +19,7 @@ from manila.policies import base
BASE_POLICY_NAME = 'share:%s' BASE_POLICY_NAME = 'share:%s'
DEPRECATED_REASON = """ DEPRECATED_REASON = """
The share API now supports system scope and default roles. The share API now supports scope and default roles.
""" """
# Deprecated share policies # Deprecated share policies
@ -222,8 +222,8 @@ deprecated_update_admin_only_metadata = policy.DeprecatedRule(
shares_policies = [ shares_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create', name=BASE_POLICY_NAME % 'create',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create share.", description="Create share.",
operations=[ operations=[
{ {
@ -235,8 +235,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create_public_share', name=BASE_POLICY_NAME % 'create_public_share',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Create shares visible across all projects in the cloud.", description="Create shares visible across all projects in the cloud.",
operations=[ operations=[
{ {
@ -248,8 +248,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get', name=BASE_POLICY_NAME % 'get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get share.", description="Get share.",
operations=[ operations=[
{ {
@ -261,52 +261,52 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all', name=BASE_POLICY_NAME % 'get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List shares.", description="List shares.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares', 'path': '/shares?{query}',
}, },
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares/detail', 'path': '/shares/detail?{query}',
} }
], ],
deprecated_rule=deprecated_share_get_all deprecated_rule=deprecated_share_get_all
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update', name=BASE_POLICY_NAME % 'update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update share.", description="Update a share.",
operations=[ operations=[
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/shares', 'path': '/shares/{share_id}',
} }
], ],
deprecated_rule=deprecated_share_update deprecated_rule=deprecated_share_update
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'set_public_share', name=BASE_POLICY_NAME % 'set_public_share',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Update shares to be visible across all projects in the " description="Update a share to be visible across all projects in the "
"cloud.", "cloud.",
operations=[ operations=[
{ {
'method': 'PUT', 'method': 'PUT',
'path': '/shares', 'path': '/shares/{share_id}',
} }
], ],
deprecated_rule=deprecated_share_set_public deprecated_rule=deprecated_share_set_public
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete', name=BASE_POLICY_NAME % 'delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete share.", description="Delete share.",
operations=[ operations=[
{ {
@ -318,8 +318,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'soft_delete', name=BASE_POLICY_NAME % 'soft_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Soft Delete a share.", description="Soft Delete a share.",
operations=[ operations=[
{ {
@ -330,8 +330,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'restore', name=BASE_POLICY_NAME % 'restore',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Restore a share.", description="Restore a share.",
operations=[ operations=[
{ {
@ -342,8 +342,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete', name=BASE_POLICY_NAME % 'force_delete',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force Delete a share.", description="Force Delete a share.",
operations=[ operations=[
{ {
@ -355,8 +355,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'manage', name=BASE_POLICY_NAME % 'manage',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Manage share.", description="Manage share.",
operations=[ operations=[
{ {
@ -368,8 +368,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'unmanage', name=BASE_POLICY_NAME % 'unmanage',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Unmanage share.", description="Unmanage share.",
operations=[ operations=[
{ {
@ -381,43 +381,43 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'list_by_host', name=BASE_POLICY_NAME % 'list_by_host',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="List share by host.", description="List share by host.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares', 'path': '/shares?host={host}',
}, },
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares/detail', 'path': '/shares/detail?host={host}',
} }
], ],
deprecated_rule=deprecated_share_list_by_host deprecated_rule=deprecated_share_list_by_host
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'list_by_share_server_id', name=BASE_POLICY_NAME % 'list_by_share_server_id',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="List share by server id.", description="List share by server id.",
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares' 'path': '/shares?share_server_id={share_server_id}'
}, },
{ {
'method': 'GET', 'method': 'GET',
'path': '/shares/detail', 'path': '/shares/detail?share_server_id={share_server_id}',
} }
], ],
deprecated_rule=deprecated_share_list_by_server_id deprecated_rule=deprecated_share_list_by_server_id
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'access_get', name=BASE_POLICY_NAME % 'access_get',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get share access rule, it under deny access operation.", description="Get share access rule (deprecated in API version 2.45).",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -428,9 +428,10 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'access_get_all', name=BASE_POLICY_NAME % 'access_get_all',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="List share access rules.", description=("List share access rules (deprecated in API "
"version 2.45)."),
operations=[ operations=[
{ {
'method': 'GET', 'method': 'GET',
@ -441,8 +442,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'extend', name=BASE_POLICY_NAME % 'extend',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Extend share.", description="Extend share.",
operations=[ operations=[
{ {
@ -454,8 +455,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_extend', name=BASE_POLICY_NAME % 'force_extend',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description="Force extend share.", description="Force extend share.",
operations=[ operations=[
{ {
@ -465,8 +466,8 @@ shares_policies = [
]), ]),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'shrink', name=BASE_POLICY_NAME % 'shrink',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Shrink share.", description="Shrink share.",
operations=[ operations=[
{ {
@ -478,8 +479,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'migration_start', name=BASE_POLICY_NAME % 'migration_start',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Migrate a share to the specified host.", description="Migrate a share to the specified host.",
operations=[ operations=[
{ {
@ -491,9 +492,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'migration_complete', name=BASE_POLICY_NAME % 'migration_complete',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Invokes 2nd phase of share migration.", description="Invoke 2nd phase of share migration.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -504,9 +505,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'migration_cancel', name=BASE_POLICY_NAME % 'migration_cancel',
check_str=base.SYSTEM_ADMIN, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description="Attempts to cancel share migration.", description="Attempt to cancel share migration.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -517,8 +518,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'migration_get_progress', name=BASE_POLICY_NAME % 'migration_get_progress',
check_str=base.SYSTEM_READER, check_str=base.ADMIN,
scope_types=['system'], scope_types=['project'],
description=("Retrieve share migration progress for a given " description=("Retrieve share migration progress for a given "
"share."), "share."),
operations=[ operations=[
@ -531,9 +532,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_task_state', name=BASE_POLICY_NAME % 'reset_task_state',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description=("Reset task state."), description="Reset task state.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -544,9 +545,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status', name=BASE_POLICY_NAME % 'reset_status',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description=("Reset status."), description="Reset status.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -557,9 +558,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'revert_to_snapshot', name=BASE_POLICY_NAME % 'revert_to_snapshot',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Revert a share to a snapshot."), description="Revert a share to a snapshot.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -570,9 +571,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'allow_access', name=BASE_POLICY_NAME % 'allow_access',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Add share access rule."), description="Add share access rule.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -583,9 +584,9 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'deny_access', name=BASE_POLICY_NAME % 'deny_access',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Remove share access rule."), description="Remove share access rule.",
operations=[ operations=[
{ {
'method': 'POST', 'method': 'POST',
@ -596,8 +597,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update_share_metadata', name=BASE_POLICY_NAME % 'update_share_metadata',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Update share metadata.", description="Update share metadata.",
operations=[ operations=[
{ {
@ -617,8 +618,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete_share_metadata', name=BASE_POLICY_NAME % 'delete_share_metadata',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Delete share metadata.", description="Delete share metadata.",
operations=[ operations=[
{ {
@ -630,8 +631,8 @@ shares_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_share_metadata', name=BASE_POLICY_NAME % 'get_share_metadata',
check_str=base.SYSTEM_OR_PROJECT_READER, check_str=base.ADMIN_OR_PROJECT_READER,
scope_types=['system', 'project'], scope_types=['project'],
description="Get share metadata.", description="Get share metadata.",
operations=[ operations=[
{ {
@ -653,8 +654,8 @@ shares_policies = [
base_snapshot_policies = [ base_snapshot_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create_snapshot', name=BASE_POLICY_NAME % 'create_snapshot',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description="Create share snapshot.", description="Create share snapshot.",
operations=[ operations=[
{ {
@ -666,9 +667,9 @@ base_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete_snapshot', name=BASE_POLICY_NAME % 'delete_snapshot',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Delete share snapshot."), description="Delete share snapshot.",
operations=[ operations=[
{ {
'method': 'DELETE', 'method': 'DELETE',
@ -679,9 +680,9 @@ base_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'snapshot_update', name=BASE_POLICY_NAME % 'snapshot_update',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER, check_str=base.ADMIN_OR_PROJECT_MEMBER,
scope_types=['system', 'project'], scope_types=['project'],
description=("Update share snapshot."), description="Update share snapshot.",
operations=[ operations=[
{ {
'method': 'PUT', 'method': 'PUT',
@ -692,8 +693,8 @@ base_snapshot_policies = [
), ),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update_admin_only_metadata', name=BASE_POLICY_NAME % 'update_admin_only_metadata',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_ADMIN, check_str=base.ADMIN,
scope_types=['system', 'project'], scope_types=['project'],
description=( description=(
"Update metadata items that are considered \"admin only\" " "Update metadata items that are considered \"admin only\" "
"by the service."), "by the service."),

18
releasenotes/notes/zed-secure-rbac-direction-change-2329bbf442b9a2da.yaml Normal file
View File

@ -0,0 +1,18 @@
---
prelude: >
RBAC defaults of all Shared File System service (manila) APIs have been
updated to remove "system" scope personas. This is being done in concert
with other OpenStack services, and in reaction to operator feedback that
the use of system "scope" introduces backwards incompatibility in existing
workflows. The new defaults support the use of "scope", however, no RBAC
rule by default includes "system" scope. At this time, we do not recommend
the use of system scoped personas to interact with the Shared File
Systems service (manila) APIs since it is largely un-tested. "reader"
role from the OpenStack Identity service (keystone) is fully supported
with this release. Currently, these new "defaults" are available as
"opt-in" only to prevent breaking existing deployments. To enforce default
RBAC rules, set ``[oslo_policy]/enforce_new_defaults`` to True in your
deployment. This option will be set to True by default in a future
release. See `the OpenStack TC Secure RBAC goal <https://governance.openstack
.org/tc/goals/selected/consistent-and-secure-rbac.html>`_ for more
information regarding these changes.