openstack
/
nova
Code Issues Proposed changes

Introduce scope_types in shelve server 

oslo.policy introduced the scope_type feature which can
control the access level at system-level and project-level.
 - https://docs.openstack.org/oslo.policy/latest/user/usage.html#setting-scope
 - http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html

Appropriate scope_type for nova case:
- https://specs.openstack.org/openstack/nova-specs/specs/ussuri/approved/policy-defaults-refresh.html#scope

This commit introduce scope_type for shelve server API policies
as 'system' and 'project'.

Also adds the test case with scope_type enabled and verify we
pass and fail the policy check with expected context.

Partial implement blueprint policy-defaults-refresh

Change-Id: I9ef012514c92d73294188340b0eb8cd63e29ef25
This commit is contained in:
Ghanshyam Mann 2020-04-05 03:25:06 -05:00 committed by Stephen Finucane
parent 276775bcb2
commit 9b8da0db15
1 changed files with 18 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
nova/policies/shelve.py
View File

@ -23,35 +23,38 @@ POLICY_ROOT = 'os_compute_api:os-shelve:%s'
shelve_policies = [
policy.DocumentedRuleDefault(
POLICY_ROOT % 'shelve',
base.RULE_ADMIN_OR_OWNER,
"Shelve server",
[
name=POLICY_ROOT % 'shelve',
check_str=base.RULE_ADMIN_OR_OWNER,
description="Shelve server",
operations=[
{
'method': 'POST',
'path': '/servers/{server_id}/action (shelve)'
}
]),
],
scope_types=['system', 'project']),
policy.DocumentedRuleDefault(
POLICY_ROOT % 'unshelve',
base.RULE_ADMIN_OR_OWNER,
"Unshelve (restore) shelved server",
[
name=POLICY_ROOT % 'unshelve',
check_str=base.RULE_ADMIN_OR_OWNER,
description="Unshelve (restore) shelved server",
operations=[
{
'method': 'POST',
'path': '/servers/{server_id}/action (unshelve)'
}
]),
],
scope_types=['system', 'project']),
policy.DocumentedRuleDefault(
POLICY_ROOT % 'shelve_offload',
base.RULE_ADMIN_API,
"Shelf-offload (remove) server",
[
name=POLICY_ROOT % 'shelve_offload',
check_str=base.RULE_ADMIN_API,
description="Shelf-offload (remove) server",
operations=[
{
'method': 'POST',
'path': '/servers/{server_id}/action (shelveOffload)'
}
]),
],
scope_types=['system', 'project']),
]