openstack/neutron
Code Issues Proposed changes

Merge "Implement secure RBAC for flavor API"

Browse Source
This commit is contained in:
Zuul 2021-01-27 11:59:06 +00:00 committed by Gerrit Code Review
commit 0fb3382556
1 changed files with 126 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

182
neutron/conf/policies/flavor.py
View File

@ -22,24 +22,33 @@ PROFILE_RESOURCE_PATH = '/service_profiles/{id}'
ASSOC_COLLECTION_PATH = '/flavors/{flavor_id}/service_profiles'
ASSOC_RESOURCE_PATH = '/flavors/{flavor_id}/service_profiles/{profile_id}'
DEPRECATION_REASON = (
"The flavor API now supports system scope and default roles.")
rules = [
policy.DocumentedRuleDefault(
'create_flavor',
base.RULE_ADMIN_ONLY,
'Create a flavor',
[
name='create_flavor',
check_str=base.SYSTEM_ADMIN,
description='Create a flavor',
operations=[
{
'method': 'POST',
'path': FLAVOR_COLLECTION_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='create_flavor',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'get_flavor',
base.RULE_ANY,
'Get a flavor',
[
name='get_flavor',
check_str=base.SYSTEM_OR_PROJECT_READER,
description='Get a flavor',
operations=[
{
'method': 'GET',
'path': FLAVOR_COLLECTION_PATH,
@ -48,47 +57,71 @@ rules = [
'method': 'GET',
'path': FLAVOR_RESOURCE_PATH,
},
]
],
scope_types=['system', 'project'],
deprecated_rule=policy.DeprecatedRule(
name='get_flavor',
check_str=base.RULE_ANY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'update_flavor',
base.RULE_ADMIN_ONLY,
'Update a flavor',
[
name='update_flavor',
check_str=base.SYSTEM_ADMIN,
description='Update a flavor',
operations=[
{
'method': 'PUT',
'path': FLAVOR_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='update_flavor',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'delete_flavor',
base.RULE_ADMIN_ONLY,
'Delete a flavor',
[
name='delete_flavor',
check_str=base.SYSTEM_ADMIN,
description='Delete a flavor',
operations=[
{
'method': 'DELETE',
'path': FLAVOR_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='delete_flavor',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'create_service_profile',
base.RULE_ADMIN_ONLY,
'Create a service profile',
[
name='create_service_profile',
check_str=base.SYSTEM_ADMIN,
description='Create a service profile',
operations=[
{
'method': 'POST',
'path': PROFILE_COLLECTION_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='create_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'get_service_profile',
base.RULE_ADMIN_ONLY,
'Get a service profile',
[
name='get_service_profile',
check_str=base.SYSTEM_READER,
description='Get a service profile',
operations=[
{
'method': 'GET',
'path': PROFILE_COLLECTION_PATH,
@ -97,60 +130,97 @@ rules = [
'method': 'GET',
'path': PROFILE_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='get_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'update_service_profile',
base.RULE_ADMIN_ONLY,
'Update a service profile',
[
name='update_service_profile',
check_str=base.SYSTEM_ADMIN,
description='Update a service profile',
operations=[
{
'method': 'PUT',
'path': PROFILE_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='update_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'delete_service_profile',
base.RULE_ADMIN_ONLY,
'Delete a service profile',
[
name='delete_service_profile',
check_str=base.SYSTEM_ADMIN,
description='Delete a service profile',
operations=[
{
'method': 'DELETE',
'path': PROFILE_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='delete_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.RuleDefault(
'get_flavor_service_profile',
base.RULE_ANY,
('Get a flavor associated with a given service profiles. '
'There is no corresponding GET operations in API currently. '
'This rule is currently referred only in the DELETE '
'of flavor_service_profile.')
name='get_flavor_service_profile',
check_str=base.SYSTEM_OR_PROJECT_READER,
description=(
'Get a flavor associated with a given service profiles. '
'There is no corresponding GET operations in API currently. '
'This rule is currently referred only in the DELETE '
'of flavor_service_profile.'),
scope_types=['system', 'project'],
deprecated_rule=policy.DeprecatedRule(
name='get_flavor_service_profile',
check_str=base.RULE_ANY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'create_flavor_service_profile',
base.RULE_ADMIN_ONLY,
'Associate a flavor with a service profile',
[
name='create_flavor_service_profile',
check_str=base.SYSTEM_ADMIN,
description='Associate a flavor with a service profile',
operations=[
{
'method': 'POST',
'path': ASSOC_COLLECTION_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='create_flavor_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'delete_flavor_service_profile',
base.RULE_ADMIN_ONLY,
'Disassociate a flavor with a service profile',
[
name='delete_flavor_service_profile',
check_str=base.SYSTEM_ADMIN,
description='Disassociate a flavor with a service profile',
operations=[
{
'method': 'DELETE',
'path': ASSOC_RESOURCE_PATH,
},
]
],
scope_types=['system'],
deprecated_rule=policy.DeprecatedRule(
name='delete_flavor_service_profile',
check_str=base.RULE_ADMIN_ONLY),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
]