openstack/nova
Code Issues Proposed changes

Merge "update servers policy in code to use formats"

Browse Source
This commit is contained in:
Jenkins 2016-06-23 13:56:49 +00:00 committed by Gerrit Code Review
commit 08780af9ea
2 changed files with 44 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
nova/api/openstack/compute/servers.py
View File

@ -257,7 +257,7 @@ class ServersController(wsgi.Controller):
def index(self, req): def index(self, req):
"""Returns a list of server names and ids for a given user.""" """Returns a list of server names and ids for a given user."""
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('index')) context.can(server_policies.SERVERS % 'index')
try: try:
servers = self._get_servers(req, is_detail=False) servers = self._get_servers(req, is_detail=False)
except exception.Invalid as err: except exception.Invalid as err:
@ -268,7 +268,7 @@ class ServersController(wsgi.Controller):
def detail(self, req): def detail(self, req):
"""Returns a list of server details for a given user.""" """Returns a list of server details for a given user."""
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('detail')) context.can(server_policies.SERVERS % 'detail')
try: try:
servers = self._get_servers(req, is_detail=True) servers = self._get_servers(req, is_detail=True)
except exception.Invalid as err: except exception.Invalid as err:
@ -367,9 +367,9 @@ class ServersController(wsgi.Controller):
elevated = None elevated = None
if all_tenants: if all_tenants:
if is_detail: if is_detail:
context.can(server_policies.get_name('detail:get_all_tenants')) context.can(server_policies.SERVERS % 'detail:get_all_tenants')
else: else:
context.can(server_policies.get_name('index:get_all_tenants')) context.can(server_policies.SERVERS % 'index:get_all_tenants')
elevated = context.elevated() elevated = context.elevated()
else: else:
if context.project_id: if context.project_id:
@ -524,7 +524,7 @@ class ServersController(wsgi.Controller):
def show(self, req, id): def show(self, req, id):
"""Returns server details by server id.""" """Returns server details by server id."""
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('show')) context.can(server_policies.SERVERS % 'show')
instance = self._get_server(context, req, id, is_detail=True) instance = self._get_server(context, req, id, is_detail=True)
return self._view_builder.show(req, instance) return self._view_builder.show(req, instance)
@ -573,7 +573,7 @@ class ServersController(wsgi.Controller):
'project_id': context.project_id, 'project_id': context.project_id,
'user_id': context.user_id, 'user_id': context.user_id,
'availability_zone': availability_zone} 'availability_zone': availability_zone}
context.can(server_policies.get_name('create'), target) context.can(server_policies.SERVERS % 'create', target)
# TODO(Shao He, Feng) move this policy check to os-availability-zone # TODO(Shao He, Feng) move this policy check to os-availability-zone
# extension after refactor it. # extension after refactor it.
@ -584,13 +584,13 @@ class ServersController(wsgi.Controller):
except exception.InvalidInput as err: except exception.InvalidInput as err:
raise exc.HTTPBadRequest(explanation=six.text_type(err)) raise exc.HTTPBadRequest(explanation=six.text_type(err))
if host or node: if host or node:
context.can(server_policies.get_name('create:forced_host'), {}) context.can(server_policies.SERVERS % 'create:forced_host', {})
block_device_mapping = create_kwargs.get("block_device_mapping") block_device_mapping = create_kwargs.get("block_device_mapping")
# TODO(Shao He, Feng) move this policy check to os-block-device-mapping # TODO(Shao He, Feng) move this policy check to os-block-device-mapping
# extension after refactor it. # extension after refactor it.
if block_device_mapping: if block_device_mapping:
context.can(server_policies.get_name('create:attach_volume'), context.can(server_policies.SERVERS % 'create:attach_volume',
target) target)
image_uuid = self._image_from_req_data(server_dict, create_kwargs) image_uuid = self._image_from_req_data(server_dict, create_kwargs)
@ -615,7 +615,7 @@ class ServersController(wsgi.Controller):
requested_networks) requested_networks)
if requested_networks and len(requested_networks): if requested_networks and len(requested_networks):
context.can(server_policies.get_name('create:attach_network'), context.can(server_policies.SERVERS % 'create:attach_network',
target) target)
try: try:
@ -779,7 +779,7 @@ class ServersController(wsgi.Controller):
rebuild_schema['properties']['rebuild']['properties'].update(schema) rebuild_schema['properties']['rebuild']['properties'].update(schema)
def _delete(self, context, req, instance_uuid): def _delete(self, context, req, instance_uuid):
context.can(server_policies.get_name('delete')) context.can(server_policies.SERVERS % 'delete')
instance = self._get_server(context, req, instance_uuid) instance = self._get_server(context, req, instance_uuid)
if CONF.reclaim_instance_interval: if CONF.reclaim_instance_interval:
try: try:
@ -801,7 +801,7 @@ class ServersController(wsgi.Controller):
ctxt = req.environ['nova.context'] ctxt = req.environ['nova.context']
update_dict = {} update_dict = {}
ctxt.can(server_policies.get_name('update')) ctxt.can(server_policies.SERVERS % 'update')
if 'name' in body['server']: if 'name' in body['server']:
update_dict['display_name'] = common.normalize_name( update_dict['display_name'] = common.normalize_name(
@ -837,7 +837,7 @@ class ServersController(wsgi.Controller):
@wsgi.action('confirmResize') @wsgi.action('confirmResize')
def _action_confirm_resize(self, req, id, body): def _action_confirm_resize(self, req, id, body):
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('confirm_resize')) context.can(server_policies.SERVERS % 'confirm_resize')
instance = self._get_server(context, req, id) instance = self._get_server(context, req, id)
try: try:
self.compute_api.confirm_resize(context, instance) self.compute_api.confirm_resize(context, instance)
@ -857,7 +857,7 @@ class ServersController(wsgi.Controller):
@wsgi.action('revertResize') @wsgi.action('revertResize')
def _action_revert_resize(self, req, id, body): def _action_revert_resize(self, req, id, body):
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('revert_resize')) context.can(server_policies.SERVERS % 'revert_resize')
instance = self._get_server(context, req, id) instance = self._get_server(context, req, id)
try: try:
self.compute_api.revert_resize(context, instance) self.compute_api.revert_resize(context, instance)
@ -883,7 +883,7 @@ class ServersController(wsgi.Controller):
reboot_type = body['reboot']['type'].upper() reboot_type = body['reboot']['type'].upper()
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('reboot')) context.can(server_policies.SERVERS % 'reboot')
instance = self._get_server(context, req, id) instance = self._get_server(context, req, id)
try: try:
@ -897,7 +897,7 @@ class ServersController(wsgi.Controller):
def _resize(self, req, instance_id, flavor_id, **kwargs): def _resize(self, req, instance_id, flavor_id, **kwargs):
"""Begin the resize process with given instance/flavor.""" """Begin the resize process with given instance/flavor."""
context = req.environ["nova.context"] context = req.environ["nova.context"]
context.can(server_policies.get_name('resize')) context.can(server_policies.SERVERS % 'resize')
instance = self._get_server(context, req, instance_id) instance = self._get_server(context, req, instance_id)
try: try:
@ -1000,7 +1000,7 @@ class ServersController(wsgi.Controller):
password = self._get_server_admin_password(rebuild_dict) password = self._get_server_admin_password(rebuild_dict)
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('rebuild')) context.can(server_policies.SERVERS % 'rebuild')
instance = self._get_server(context, req, id) instance = self._get_server(context, req, id)
attr_map = { attr_map = {
@ -1077,7 +1077,7 @@ class ServersController(wsgi.Controller):
def _action_create_image(self, req, id, body): def _action_create_image(self, req, id, body):
"""Snapshot a server instance.""" """Snapshot a server instance."""
context = req.environ['nova.context'] context = req.environ['nova.context']
context.can(server_policies.get_name('create_image')) context.can(server_policies.SERVERS % 'create_image')
entity = body["createImage"] entity = body["createImage"]
image_name = common.normalize_name(entity["name"]) image_name = common.normalize_name(entity["name"])
@ -1093,8 +1093,8 @@ class ServersController(wsgi.Controller):
try: try:
if compute_utils.is_volume_backed_instance(context, instance, if compute_utils.is_volume_backed_instance(context, instance,
bdms): bdms):
context.can(server_policies.get_name( context.can(server_policies.SERVERS %
'create_image:allow_volume_backed')) 'create_image:allow_volume_backed')
image = self.compute_api.snapshot_volume_backed( image = self.compute_api.snapshot_volume_backed(
context, context,
instance, instance,
@ -1155,7 +1155,7 @@ class ServersController(wsgi.Controller):
"""Start an instance.""" """Start an instance."""
context = req.environ['nova.context'] context = req.environ['nova.context']
instance = self._get_instance(context, id) instance = self._get_instance(context, id)
context.can(server_policies.get_name('start'), instance) context.can(server_policies.SERVERS % 'start', instance)
LOG.debug('start instance', instance=instance) LOG.debug('start instance', instance=instance)
try: try:
self.compute_api.start(context, instance) self.compute_api.start(context, instance)
@ -1174,7 +1174,7 @@ class ServersController(wsgi.Controller):
"""Stop an instance.""" """Stop an instance."""
context = req.environ['nova.context'] context = req.environ['nova.context']
instance = self._get_instance(context, id) instance = self._get_instance(context, id)
context.can(server_policies.get_name('stop'), instance) context.can(server_policies.SERVERS % 'stop', instance)
LOG.debug('stop instance', instance=instance) LOG.debug('stop instance', instance=instance)
try: try:
self.compute_api.stop(context, instance) self.compute_api.stop(context, instance)
@ -1195,7 +1195,7 @@ class ServersController(wsgi.Controller):
"""Trigger crash dump in an instance""" """Trigger crash dump in an instance"""
context = req.environ['nova.context'] context = req.environ['nova.context']
instance = self._get_instance(context, id) instance = self._get_instance(context, id)
context.can(server_policies.get_name('trigger_crash_dump'), instance) context.can(server_policies.SERVERS % 'trigger_crash_dump', instance)
try: try:
self.compute_api.trigger_crash_dump(context, instance) self.compute_api.trigger_crash_dump(context, instance)
except exception.InstanceInvalidState as state_error: except exception.InstanceInvalidState as state_error:

50
nova/policies/servers.py
View File

@ -15,37 +15,31 @@ from oslo_policy import policy
RULE_AOO = 'rule:admin_or_owner' RULE_AOO = 'rule:admin_or_owner'
SERVERS = 'os_compute_api:servers:%s'
def get_name(action=None):
name = 'os_compute_api:servers'
if action:
name = name + ':%s' % action
return name
rules = [ rules = [
policy.RuleDefault(get_name('index'), RULE_AOO), policy.RuleDefault(SERVERS % 'index', RULE_AOO),
policy.RuleDefault(get_name('detail'), RULE_AOO), policy.RuleDefault(SERVERS % 'detail', RULE_AOO),
policy.RuleDefault(get_name('detail:get_all_tenants'), RULE_AOO), policy.RuleDefault(SERVERS % 'detail:get_all_tenants', RULE_AOO),
policy.RuleDefault(get_name('index:get_all_tenants'), RULE_AOO), policy.RuleDefault(SERVERS % 'index:get_all_tenants', RULE_AOO),
policy.RuleDefault(get_name('show'), RULE_AOO), policy.RuleDefault(SERVERS % 'show', RULE_AOO),
policy.RuleDefault(get_name('create'), RULE_AOO), policy.RuleDefault(SERVERS % 'create', RULE_AOO),
policy.RuleDefault(get_name('create:forced_host'), RULE_AOO), policy.RuleDefault(SERVERS % 'create:forced_host', RULE_AOO),
policy.RuleDefault(get_name('create:attach_volume'), RULE_AOO), policy.RuleDefault(SERVERS % 'create:attach_volume', RULE_AOO),
policy.RuleDefault(get_name('create:attach_network'), RULE_AOO), policy.RuleDefault(SERVERS % 'create:attach_network', RULE_AOO),
policy.RuleDefault(get_name('delete'), RULE_AOO), policy.RuleDefault(SERVERS % 'delete', RULE_AOO),
policy.RuleDefault(get_name('update'), RULE_AOO), policy.RuleDefault(SERVERS % 'update', RULE_AOO),
policy.RuleDefault(get_name('confirm_resize'), RULE_AOO), policy.RuleDefault(SERVERS % 'confirm_resize', RULE_AOO),
policy.RuleDefault(get_name('revert_resize'), RULE_AOO), policy.RuleDefault(SERVERS % 'revert_resize', RULE_AOO),
policy.RuleDefault(get_name('reboot'), RULE_AOO), policy.RuleDefault(SERVERS % 'reboot', RULE_AOO),
policy.RuleDefault(get_name('resize'), RULE_AOO), policy.RuleDefault(SERVERS % 'resize', RULE_AOO),
policy.RuleDefault(get_name('rebuild'), RULE_AOO), policy.RuleDefault(SERVERS % 'rebuild', RULE_AOO),
policy.RuleDefault(get_name('create_image'), RULE_AOO), policy.RuleDefault(SERVERS % 'create_image', RULE_AOO),
policy.RuleDefault(get_name('create_image:allow_volume_backed'), policy.RuleDefault(SERVERS % 'create_image:allow_volume_backed',
RULE_AOO), RULE_AOO),
policy.RuleDefault(get_name('start'), RULE_AOO), policy.RuleDefault(SERVERS % 'start', RULE_AOO),
policy.RuleDefault(get_name('stop'), RULE_AOO), policy.RuleDefault(SERVERS % 'stop', RULE_AOO),
policy.RuleDefault(get_name('trigger_crash_dump'), RULE_AOO), policy.RuleDefault(SERVERS % 'trigger_crash_dump', RULE_AOO),
] ]