openstack/neutron
Code Issues Proposed changes

Merge "Implement secure RBAC for auto_allocated_topology API"

Browse Source
This commit is contained in:
Zuul 2021-01-22 03:28:09 +00:00 committed by Gerrit Code Review
commit a6536105d3
1 changed files with 25 additions and 10 deletions

35
neutron/conf/policies/auto_allocated_topology.py

@ -17,29 +17,44 @@ from neutron.conf.policies import base
RESOURCE_PATH = '/auto-allocated-topology/{project_id}'
DEPRECATION_REASON = (
"The Auto allocated topology API now supports system scope "
"and default roles.")
rules = [
policy.DocumentedRuleDefault(
'get_auto_allocated_topology',
base.RULE_ADMIN_OR_OWNER,
"Get a project's auto-allocated topology",
[
name='get_auto_allocated_topology',
check_str=base.SYSTEM_OR_PROJECT_READER,
description="Get a project's auto-allocated topology",
operations=[
{
'method': 'GET',
'path': RESOURCE_PATH,
},
]
],
scope_types=['system', 'project'],
deprecated_rule=policy.DeprecatedRule(
name='get_auto_allocated_topology',
check_str=base.RULE_ADMIN_OR_OWNER),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
policy.DocumentedRuleDefault(
'delete_auto_allocated_topology',
base.RULE_ADMIN_OR_OWNER,
"Delete a project's auto-allocated topology",
[
name='delete_auto_allocated_topology',
check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
description="Delete a project's auto-allocated topology",
operations=[
{
'method': 'DELETE',
'path': RESOURCE_PATH,
},
]
],
scope_types=['system', 'project'],
deprecated_rule=policy.DeprecatedRule(
name='delete_auto_allocated_topology',
check_str=base.RULE_ADMIN_OR_OWNER),
deprecated_reason=DEPRECATION_REASON,
deprecated_since='Wallaby'
),
]