openstack/manila
Code Issues Proposed changes

[policy in code] Add support for replicas, networks and security services [7/10]

Browse Source 
This patch adds policy in code support for replica, network
and security service resources.

Change-Id: I9a79b5ececc583e85149cc920950e462e805b245
Partial-Implements: blueprint policy-in-code
This commit is contained in:
zhongjun 2017-11-29 11:40:55 +08:00 committed by zhongjun
parent 4f959eeaf7
commit a23d09eb01
6 changed files with 366 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
etc/manila/policy.json
View File

@ -15,37 +15,9 @@
"share_types_extra_spec:index": "rule:admin_api",
"share_types_extra_spec:delete": "rule:admin_api",
"security_service:create": "rule:default",
"security_service:delete": "rule:default",
"security_service:update": "rule:default",
"security_service:show": "rule:default",
"security_service:index": "rule:default",
"security_service:detail": "rule:default",
"security_service:get_all_security_services": "rule:admin_api",
"share_network:create": "rule:default",
"share_network:delete": "rule:default",
"share_network:update": "rule:default",
"share_network:index": "rule:default",
"share_network:detail": "rule:default",
"share_network:show": "rule:default",
"share_network:add_security_service": "rule:default",
"share_network:remove_security_service": "rule:default",
"share_network:get_all_share_networks": "rule:admin_api",
"scheduler_stats:pools:index": "rule:admin_api",
"scheduler_stats:pools:detail": "rule:admin_api",
"share_replica:get_all": "rule:default",
"share_replica:show": "rule:default",
"share_replica:create" : "rule:default",
"share_replica:delete": "rule:default",
"share_replica:promote": "rule:default",
"share_replica:resync": "rule:admin_api",
"share_replica:reset_status": "rule:admin_api",
"share_replica:force_delete": "rule:admin_api",
"share_replica:reset_replica_state": "rule:admin_api",
"message:delete": "rule:default",
"message:get": "rule:default",
"message:get_all": "rule:default"

6
manila/policies/__init__.py
View File

@ -19,12 +19,15 @@ import itertools
from manila.policies import base
from manila.policies import quota_class_set
from manila.policies import quota_set
from manila.policies import security_service
from manila.policies import service
from manila.policies import share_group
from manila.policies import share_group_snapshot
from manila.policies import share_group_type
from manila.policies import share_group_types_spec
from manila.policies import share_instance_export_location
from manila.policies import share_network
from manila.policies import share_replica
from manila.policies import share_server
from manila.policies import share_snapshot
from manila.policies import share_snapshot_export_location
@ -52,4 +55,7 @@ def list_rules():
share_group_type.list_rules(),
share_group_snapshot.list_rules(),
share_group.list_rules(),
share_replica.list_rules(),
share_network.list_rules(),
security_service.list_rules(),
)

108
manila/policies/security_service.py Normal file
View File

@ -0,0 +1,108 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'security_service:%s'
security_service_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create',
check_str=base.RULE_DEFAULT,
description="Create security service.",
operations=[
{
'method': 'POST',
'path': '/security-services'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_DEFAULT,
description="Get details of a security service.",
operations=[
{
'method': 'GET',
'path': '/security-services/{security_service_id}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail',
check_str=base.RULE_DEFAULT,
description="Get details of all security services.",
operations=[
{
'method': 'GET',
'path': '/security-services/detail?{query}'
},
{
'method': 'GET',
'path': '/security-services/detail'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_DEFAULT,
description="Get all security services.",
operations=[
{
'method': 'GET',
'path': '/security-services'
},
{
'method': 'GET',
'path': '/security-services?{query}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update',
check_str=base.RULE_DEFAULT,
description="Update a security service.",
operations=[
{
'method': 'PUT',
'path': '/security-services/{security_service_id}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
check_str=base.RULE_DEFAULT,
description="Delete a security service.",
operations=[
{
'method': 'DELETE',
'path': '/security-services/{security_service_id}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all_security_services',
check_str=base.RULE_ADMIN_API,
description="Get security services of all projects.",
operations=[
{
'method': 'GET',
'path': '/security-services?all_tenants=1'
},
{
'method': 'GET',
'path': '/security-services/detail?all_tenants=1'
}
]),
]
def list_rules():
return security_service_policies

127
manila/policies/share_network.py Normal file
View File

@ -0,0 +1,127 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'share_network:%s'
share_network_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create',
check_str=base.RULE_DEFAULT,
description="Create share network.",
operations=[
{
'method': 'POST',
'path': '/share-networks'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_DEFAULT,
description="Get details of a share network.",
operations=[
{
'method': 'GET',
'path': '/share-networks/{share_network_id}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_DEFAULT,
description="Get all share networks.",
operations=[
{
'method': 'GET',
'path': '/share-networks'
},
{
'method': 'GET',
'path': '/share-networks?{query}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'detail',
check_str=base.RULE_DEFAULT,
description="Get details of share networks .",
operations=[
{
'method': 'GET',
'path': '/share-networks/detail?{query}'
},
{
'method': 'GET',
'path': '/share-networks/detail'
},
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update',
check_str=base.RULE_DEFAULT,
description="Update a share network.",
operations=[
{
'method': 'PUT',
'path': '/share-networks/{share_network_id}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
check_str=base.RULE_DEFAULT,
description="Delete a share network.",
operations=[
{
'method': 'DELETE',
'path': '/share-networks/{share_network_id}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'add_security_service',
check_str=base.RULE_DEFAULT,
description="Add security service to share network.",
operations=[
{
'method': 'POST',
'path': '/share-networks/{share_network_id}/action'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'remove_security_service',
check_str=base.RULE_DEFAULT,
description="Remove security service from share network.",
operations=[
{
'method': 'POST',
'path': '/share-networks/{share_network_id}/action'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all_share_networks',
check_str=base.RULE_ADMIN_API,
description="Get share networks belonging to all projects.",
operations=[
{
'method': 'GET',
'path': '/share-networks?all_tenants=1'
},
{
'method': 'GET',
'path': '/share-networks/detail?all_tenants=1'
}
]),
]
def list_rules():
return share_network_policies

123
manila/policies/share_replica.py Normal file
View File

@ -0,0 +1,123 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'share_replica:%s'
share_replica_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create',
check_str=base.RULE_DEFAULT,
description="Create share replica.",
operations=[
{
'method': 'POST',
'path': '/share-replicas',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'get_all',
check_str=base.RULE_DEFAULT,
description="Get all share replicas.",
operations=[
{
'method': 'GET',
'path': '/share-replicas',
},
{
'method': 'GET',
'path': '/share-replicas/detail',
},
{
'method': 'GET',
'path': '/share-replicas/detail?share_id={share_id}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_DEFAULT,
description="Get details of a share replica.",
operations=[
{
'method': 'GET',
'path': '/share-replicas/{share_replica_id}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
check_str=base.RULE_DEFAULT,
description="Delete a share replica.",
operations=[
{
'method': 'DELETE',
'path': '/share-replicas/{share_replica_id}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'force_delete',
check_str=base.RULE_ADMIN_API,
description="Force delete a share replica.",
operations=[
{
'method': 'POST',
'path': '/share-replicas/{share_replica_id}/action',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'promote',
check_str=base.RULE_DEFAULT,
description="Promote a non-active share replica to active.",
operations=[
{
'method': 'POST',
'path': '/share-replicas/{share_replica_id}/action',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'resync',
check_str=base.RULE_ADMIN_API,
description="Resync a share replica that is out of sync.",
operations=[
{
'method': 'POST',
'path': '/share-replicas/{share_replica_id}/action',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_replica_state',
check_str=base.RULE_ADMIN_API,
description="Reset share replica's replica_state attribute.",
operations=[
{
'method': 'POST',
'path': '/share-replicas/{share_replica_id}/action',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'reset_status',
check_str=base.RULE_ADMIN_API,
description="Reset share replica's status.",
operations=[
{
'method': 'POST',
'path': '/share-replicas/{share_replica_id}/action',
}
]),
]
def list_rules():
return share_replica_policies

3
manila/policy.py
View File

@ -215,7 +215,8 @@ def check_policy(context, resource, action, target_obj=None):
'share_snapshot_instance_export_location',
'quota_set', 'quota_class_set', 'service',
'share_server', 'share_group', 'share_group_snapshot',
'share_group_type', 'share_group_types_spec', ):
'share_group_type', 'share_group_types_spec',
'share_replica', 'share_network', 'security_service', ):
authorize(context, _action, target)
else:
enforce(context, _action, target)