[policy in code] Add support for service and quota resource [5/10]
This patch adds policy in code support for service and quota resources. Change-Id: I9a79b5ececc583e80149cc980930e162e805b143 Partial-Implements: blueprint policy-in-code
This commit is contained in:
parent
dd160df611
commit
9a201768ae
etc/manila
manila
@ -1,16 +1,6 @@
|
||||
{
|
||||
"availability_zone:index": "rule:default",
|
||||
|
||||
"quota_set:update": "rule:admin_api",
|
||||
"quota_set:show": "rule:default",
|
||||
"quota_set:delete": "rule:admin_api",
|
||||
|
||||
"quota_class_set:show": "rule:default",
|
||||
"quota_class_set:update": "rule:admin_api",
|
||||
|
||||
"service:index": "rule:admin_api",
|
||||
"service:update": "rule:admin_api",
|
||||
|
||||
"share_export_location:index": "rule:default",
|
||||
"share_export_location:show": "rule:default",
|
||||
|
||||
@ -33,11 +23,6 @@
|
||||
"security_service:detail": "rule:default",
|
||||
"security_service:get_all_security_services": "rule:admin_api",
|
||||
|
||||
"share_server:index": "rule:admin_api",
|
||||
"share_server:show": "rule:admin_api",
|
||||
"share_server:details": "rule:admin_api",
|
||||
"share_server:delete": "rule:admin_api",
|
||||
|
||||
"share_network:create": "rule:default",
|
||||
"share_network:delete": "rule:default",
|
||||
"share_network:update": "rule:default",
|
||||
|
@ -17,7 +17,11 @@
|
||||
import itertools
|
||||
|
||||
from manila.policies import base
|
||||
from manila.policies import quota_class_set
|
||||
from manila.policies import quota_set
|
||||
from manila.policies import service
|
||||
from manila.policies import share_instance_export_location
|
||||
from manila.policies import share_server
|
||||
from manila.policies import share_snapshot
|
||||
from manila.policies import share_snapshot_export_location
|
||||
from manila.policies import share_snapshot_instance
|
||||
@ -36,4 +40,8 @@ def list_rules():
|
||||
share_snapshot_export_location.list_rules(),
|
||||
share_snapshot_instance.list_rules(),
|
||||
share_snapshot_instance_export_location.list_rules(),
|
||||
share_server.list_rules(),
|
||||
service.list_rules(),
|
||||
quota_set.list_rules(),
|
||||
quota_class_set.list_rules(),
|
||||
)
|
||||
|
54
manila/policies/quota_class_set.py
Normal file
54
manila/policies/quota_class_set.py
Normal file
@ -0,0 +1,54 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'quota_class_set:%s'
|
||||
|
||||
|
||||
quota_class_set_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Update quota class.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/quota-class-sets/{class_name}'
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/os-quota-class-sets/{class_name}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get quota class.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/quota-class-sets/{class_name}'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/os-quota-class-sets/{class_name}'
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return quota_class_set_policies
|
95
manila/policies/quota_set.py
Normal file
95
manila/policies/quota_set.py
Normal file
@ -0,0 +1,95 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'quota_set:%s'
|
||||
|
||||
|
||||
quota_set_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description=("Update the quotas for a project/user and/or share "
|
||||
"type."),
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/quota-sets/{tenant_id}'
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/quota-sets/{tenant_id}?user_id={user_id}'
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}'
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/os-quota-sets/{tenant_id}'
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}'
|
||||
},
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="List the quotas for a tenant/user.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/quota-sets/{tenant_id}/defaults'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/os-quota-sets/{tenant_id}/defaults'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description=("Delete quota for a tenant/user or "
|
||||
"tenant/share-type. The quota will revert back to "
|
||||
"default (Admin only)."),
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/quota-sets/{tenant_id}'
|
||||
},
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/quota-sets/{tenant_id}?user_id={user_id}'
|
||||
},
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}'
|
||||
},
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/os-quota-sets/{tenant_id}'
|
||||
},
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}'
|
||||
},
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return quota_set_policies
|
70
manila/policies/service.py
Normal file
70
manila/policies/service.py
Normal file
@ -0,0 +1,70 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'service:%s'
|
||||
|
||||
|
||||
service_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Return a list of all running services.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/os-services',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/os-services?{query}',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/services',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/services?{query}',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'update',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Enable/Disable scheduling for a service.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/os-services/disable',
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/os-services/enable',
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/services/disable',
|
||||
},
|
||||
{
|
||||
'method': 'PUT',
|
||||
'path': '/services/enable',
|
||||
},
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return service_policies
|
70
manila/policies/share_server.py
Normal file
70
manila/policies/share_server.py
Normal file
@ -0,0 +1,70 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_server:%s'
|
||||
|
||||
|
||||
share_server_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get share servers.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-servers',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-servers?{query}',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Show share server.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-servers/{server_id}',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'details',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get share server details.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/share-servers/{server_id}/details',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Delete share server.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/share-servers/{server_id}',
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_server_policies
|
@ -212,7 +212,9 @@ def check_policy(context, resource, action, target_obj=None):
|
||||
'share', 'share_snapshot',
|
||||
'share_snapshot_export_location',
|
||||
'share_snapshot_instance',
|
||||
'share_snapshot_instance_export_location'):
|
||||
'share_snapshot_instance_export_location',
|
||||
'quota_set', 'quota_class_set', 'service',
|
||||
'share_server', ):
|
||||
authorize(context, _action, target)
|
||||
else:
|
||||
enforce(context, _action, target)
|
||||
|
Loading…
x
Reference in New Issue
Block a user