[policy in code] Add support for snapshot resource [4/10]
This patch adds policy in code support for snapshot resources. Change-Id: I8a29b5ececc583e80129cc981930e162e805b246 Partial-Implements: blueprint policy-in-code
This commit is contained in:
parent
6184063a4c
commit
dd160df611
@ -19,25 +19,6 @@
|
||||
"share_instance:force_delete": "rule:admin_api",
|
||||
"share_instance:reset_status": "rule:admin_api",
|
||||
|
||||
"share_snapshot:get_snapshot": "rule:default",
|
||||
"share_snapshot:get_all_snapshots": "rule:default",
|
||||
"share_snapshot:manage_snapshot": "rule:admin_api",
|
||||
"share_snapshot:unmanage_snapshot": "rule:admin_api",
|
||||
"share_snapshot:force_delete": "rule:admin_api",
|
||||
"share_snapshot:reset_status": "rule:admin_api",
|
||||
"share_snapshot:access_list": "rule:default",
|
||||
"share_snapshot:allow_access": "rule:default",
|
||||
"share_snapshot:deny_access": "rule:default",
|
||||
"share_snapshot_export_location:index": "rule:default",
|
||||
"share_snapshot_export_location:show": "rule:default",
|
||||
|
||||
"share_snapshot_instance:detail": "rule:admin_api",
|
||||
"share_snapshot_instance:index": "rule:admin_api",
|
||||
"share_snapshot_instance:show": "rule:admin_api",
|
||||
"share_snapshot_instance:reset_status": "rule:admin_api",
|
||||
"share_snapshot_instance_export_location:index": "rule:admin_api",
|
||||
"share_snapshot_instance_export_location:show": "rule:admin_api",
|
||||
|
||||
"share_types_extra_spec:create": "rule:admin_api",
|
||||
"share_types_extra_spec:update": "rule:admin_api",
|
||||
"share_types_extra_spec:show": "rule:admin_api",
|
||||
|
@ -18,6 +18,10 @@ import itertools
|
||||
|
||||
from manila.policies import base
|
||||
from manila.policies import share_instance_export_location
|
||||
from manila.policies import share_snapshot
|
||||
from manila.policies import share_snapshot_export_location
|
||||
from manila.policies import share_snapshot_instance
|
||||
from manila.policies import share_snapshot_instance_export_location
|
||||
from manila.policies import share_type
|
||||
from manila.policies import shares
|
||||
|
||||
@ -28,4 +32,8 @@ def list_rules():
|
||||
shares.list_rules(),
|
||||
share_instance_export_location.list_rules(),
|
||||
share_type.list_rules(),
|
||||
share_snapshot.list_rules(),
|
||||
share_snapshot_export_location.list_rules(),
|
||||
share_snapshot_instance.list_rules(),
|
||||
share_snapshot_instance_export_location.list_rules(),
|
||||
)
|
||||
|
128
manila/policies/share_snapshot.py
Normal file
128
manila/policies/share_snapshot.py
Normal file
@ -0,0 +1,128 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_snapshot:%s'
|
||||
|
||||
|
||||
share_snapshot_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get_snapshot',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots/{snapshot_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'get_all_snapshots',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get all share snapshots.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots/detail'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots?{query}'
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots/detail?{query}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'force_delete',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Force Delete a share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'DELETE',
|
||||
'path': '/snapshots/{snapshot_id}'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'manage_snapshot',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Manage share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshots/manage'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'unmanage_snapshot',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Unmanage share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshots/{snapshot_id}/action'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'reset_status',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Reset status.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshots/{snapshot_id}/action',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'access_list',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="List access rules of a share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots/{snapshot_id}/access-list'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'allow_access',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Allow access to a share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshots/{snapshot_id}/action'
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'deny_access',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Deny access to a share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshots/{snapshot_id}/action'
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_snapshot_policies
|
48
manila/policies/share_snapshot_export_location.py
Normal file
48
manila/policies/share_snapshot_export_location.py
Normal file
@ -0,0 +1,48 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_snapshot_export_location:%s'
|
||||
|
||||
|
||||
share_snapshot_export_location_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="List export locations of a share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshots/{snapshot_id}/export-locations/',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_DEFAULT,
|
||||
description="Get details of a specified export location of a "
|
||||
"share snapshot.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': ('/snapshots/{snapshot_id}/'
|
||||
'export-locations/{export_location_id}'),
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_snapshot_export_location_policies
|
74
manila/policies/share_snapshot_instance.py
Normal file
74
manila/policies/share_snapshot_instance.py
Normal file
@ -0,0 +1,74 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_snapshot_instance:%s'
|
||||
|
||||
|
||||
share_snapshot_instance_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get share snapshot instance.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshot-instances/{snapshot_instance_id}',
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get all share snapshot instances.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshot-instances',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshot-instances?{query}',
|
||||
},
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'detail',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Get details of share snapshot instances.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshot-instances/detail',
|
||||
},
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': '/snapshot-instances/detail?{query}',
|
||||
},
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'reset_status',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Reset share snapshot instance's status.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'POST',
|
||||
'path': '/snapshot-instances/{snapshot_instance_id}/action',
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_snapshot_instance_policies
|
49
manila/policies/share_snapshot_instance_export_location.py
Normal file
49
manila/policies/share_snapshot_instance_export_location.py
Normal file
@ -0,0 +1,49 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
from oslo_policy import policy
|
||||
|
||||
from manila.policies import base
|
||||
|
||||
|
||||
BASE_POLICY_NAME = 'share_snapshot_instance_export_location:%s'
|
||||
|
||||
|
||||
share_snapshot_instance_export_location_policies = [
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'index',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="List export locations of a share snapshot instance.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': ('/snapshot-instances/{snapshot_instance_id}/'
|
||||
'export-locations'),
|
||||
}
|
||||
]),
|
||||
policy.DocumentedRuleDefault(
|
||||
name=BASE_POLICY_NAME % 'show',
|
||||
check_str=base.RULE_ADMIN_API,
|
||||
description="Show details of a specified export location of a share "
|
||||
"snapshot instance.",
|
||||
operations=[
|
||||
{
|
||||
'method': 'GET',
|
||||
'path': ('/snapshot-instances/{snapshot_instance_id}/'
|
||||
'export-locations/{export_location_id}'),
|
||||
}
|
||||
]),
|
||||
]
|
||||
|
||||
|
||||
def list_rules():
|
||||
return share_snapshot_instance_export_location_policies
|
@ -209,7 +209,10 @@ def check_policy(context, resource, action, target_obj=None):
|
||||
# The else branch will be deleted after all policy in code patches
|
||||
# be merged.
|
||||
if resource in ('share_instance_export_location', 'share_type',
|
||||
'share', ):
|
||||
'share', 'share_snapshot',
|
||||
'share_snapshot_export_location',
|
||||
'share_snapshot_instance',
|
||||
'share_snapshot_instance_export_location'):
|
||||
authorize(context, _action, target)
|
||||
else:
|
||||
enforce(context, _action, target)
|
||||
|
Loading…
x
Reference in New Issue
Block a user