d7be635fb4
As per the RBAC new direction, we will allow project resources operation to be performed by the project scoped token only and system user will be allowed to perform system level operation only not project resources specific. Details about new direction can be found in community-wide goal - https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html This commit modify more projects level APIs to be scoped to project only. Also modifying and adding tests for four cases: 1. enforce_scope=False + legacy rule (current default policies) 2. enforce_scope=False + No legacy rule 3. enforce_scope=True + legacy rule 4. enforce_scope=True + no legacy rule (end goal of new RBAC) Partial implement blueprint policy-defaults-refresh-2 Change-Id: I6731aa6edd0c6bed5edb9eaaaa98b5e43aaeeb74
51 lines
1.6 KiB
Python
51 lines
1.6 KiB
Python
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from oslo_policy import policy
|
|
|
|
from nova.policies import base
|
|
|
|
|
|
BASE_POLICY_NAME = 'compute:server:topology:%s'
|
|
|
|
server_topology_policies = [
|
|
policy.DocumentedRuleDefault(
|
|
name=BASE_POLICY_NAME % 'index',
|
|
check_str=base.PROJECT_READER,
|
|
description="Show the NUMA topology data for a server",
|
|
operations=[
|
|
{
|
|
'method': 'GET',
|
|
'path': '/servers/{server_id}/topology'
|
|
}
|
|
],
|
|
scope_types=['project']),
|
|
policy.DocumentedRuleDefault(
|
|
# Control host NUMA node and cpu pinning information
|
|
name=BASE_POLICY_NAME % 'host:index',
|
|
check_str=base.PROJECT_ADMIN,
|
|
description="Show the NUMA topology data for a server with host "
|
|
"NUMA ID and CPU pinning information",
|
|
operations=[
|
|
{
|
|
'method': 'GET',
|
|
'path': '/servers/{server_id}/topology'
|
|
}
|
|
],
|
|
scope_types=['project']),
|
|
]
|
|
|
|
|
|
def list_rules():
|
|
return server_topology_policies
|