octavia-dashboard/octavia_dashboard/conf/default_policies/octavia.yaml

680 lines
21 KiB
YAML

- check_str: role:admin and system_scope:all
description: null
name: system-admin
operations: []
scope_types:
- system
- check_str: role:reader and system_scope:all
description: null
name: system-reader
operations: []
scope_types:
- system
- check_str: role:member and project_id:%(project_id)s
description: null
name: project-member
operations: []
scope_types:
- project
- check_str: role:reader and project_id:%(project_id)s
description: null
name: project-reader
operations: []
scope_types:
- project
- check_str: role:load-balancer_admin or rule:system-admin
deprecated_reason: The Octavia API now requires the OpenStack default roles and
scoped tokens. See https://docs.openstack.org/octavia/latest/configuration/policy.html
and https://docs.openstack.org/keystone/latest/contributor/services.html#reusable-default-roles
for more information.
deprecated_rule:
check_str: role:admin or role:load-balancer_admin
name: context_is_admin
deprecated_since: W
description: null
name: context_is_admin
operations: []
scope_types:
- system
- check_str: project_id:%(project_id)s
description: null
name: load-balancer:owner
operations: []
scope_types:
- project
- check_str: role:load-balancer_observer and rule:project-reader
deprecated_reason: The Octavia API now requires the OpenStack default roles and
scoped tokens. See https://docs.openstack.org/octavia/latest/configuration/policy.html
and https://docs.openstack.org/keystone/latest/contributor/services.html#reusable-default-roles
for more information.
deprecated_rule:
check_str: role:load-balancer_observer and rule:load-balancer:owner
name: load-balancer:observer_and_owner
deprecated_since: W
description: null
name: load-balancer:observer_and_owner
operations: []
scope_types:
- project
- check_str: role:load-balancer_global_observer or rule:system-reader
description: null
name: load-balancer:global_observer
operations: []
scope_types:
- system
- check_str: role:load-balancer_member and rule:project-member
deprecated_reason: The Octavia API now requires the OpenStack default roles and
scoped tokens. See https://docs.openstack.org/octavia/latest/configuration/policy.html
and https://docs.openstack.org/keystone/latest/contributor/services.html#reusable-default-roles
for more information.
deprecated_rule:
check_str: role:load-balancer_member and rule:load-balancer:owner
name: load-balancer:member_and_owner
deprecated_since: W
description: null
name: load-balancer:member_and_owner
operations: []
scope_types:
- project
- check_str: is_admin:True or role:load-balancer_admin or rule:system-admin
description: null
name: load-balancer:admin
operations: []
scope_types:
- system
- check_str: rule:load-balancer:observer_and_owner or rule:load-balancer:global_observer
or rule:load-balancer:member_and_owner or rule:load-balancer:admin
description: null
name: load-balancer:read
operations: []
scope_types:
- project
- system
- check_str: rule:load-balancer:global_observer or rule:load-balancer:admin
description: null
name: load-balancer:read-global
operations: []
scope_types:
- system
- check_str: rule:load-balancer:member_and_owner or rule:load-balancer:admin
description: null
name: load-balancer:write
operations: []
scope_types:
- project
- system
- check_str: rule:load-balancer:observer_and_owner or rule:load-balancer:global_observer
or rule:load-balancer:member_and_owner or role:load-balancer_quota_admin or rule:load-balancer:admin
description: null
name: load-balancer:read-quota
operations: []
scope_types:
- project
- system
- check_str: rule:load-balancer:global_observer or role:load-balancer_quota_admin
or rule:load-balancer:admin
description: null
name: load-balancer:read-quota-global
operations: []
scope_types:
- system
- check_str: role:load-balancer_quota_admin or rule:load-balancer:admin
description: null
name: load-balancer:write-quota
operations: []
scope_types:
- system
- check_str: rule:load-balancer:read
description: List Flavors
name: os_load-balancer_api:flavor:get_all
operations:
- method: GET
path: /v2.0/lbaas/flavors
scope_types: null
- check_str: rule:load-balancer:admin
description: Create a Flavor
name: os_load-balancer_api:flavor:post
operations:
- method: POST
path: /v2.0/lbaas/flavors
scope_types: null
- check_str: rule:load-balancer:admin
description: Update a Flavor
name: os_load-balancer_api:flavor:put
operations:
- method: PUT
path: /v2.0/lbaas/flavors/{flavor_id}
scope_types: null
- check_str: rule:load-balancer:read
description: Show Flavor details
name: os_load-balancer_api:flavor:get_one
operations:
- method: GET
path: /v2.0/lbaas/flavors/{flavor_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Remove a Flavor
name: os_load-balancer_api:flavor:delete
operations:
- method: DELETE
path: /v2.0/lbaas/flavors/{flavor_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: List Flavor Profiles
name: os_load-balancer_api:flavor-profile:get_all
operations:
- method: GET
path: /v2.0/lbaas/flavorprofiles
scope_types: null
- check_str: rule:load-balancer:admin
description: Create a Flavor Profile
name: os_load-balancer_api:flavor-profile:post
operations:
- method: POST
path: /v2.0/lbaas/flavorprofiles
scope_types: null
- check_str: rule:load-balancer:admin
description: Update a Flavor Profile
name: os_load-balancer_api:flavor-profile:put
operations:
- method: PUT
path: /v2.0/lbaas/flavorprofiles/{flavor_profile_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Show Flavor Profile details
name: os_load-balancer_api:flavor-profile:get_one
operations:
- method: GET
path: /v2.0/lbaas/flavorprofiles/{flavor_profile_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Remove a Flavor Profile
name: os_load-balancer_api:flavor-profile:delete
operations:
- method: DELETE
path: /v2.0/lbaas/flavorprofiles/{flavor_profile_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List Availability Zones
name: os_load-balancer_api:availability-zone:get_all
operations:
- method: GET
path: /v2.0/lbaas/availabilityzones
scope_types: null
- check_str: rule:load-balancer:admin
description: Create an Availability Zone
name: os_load-balancer_api:availability-zone:post
operations:
- method: POST
path: /v2.0/lbaas/availabilityzones
scope_types: null
- check_str: rule:load-balancer:admin
description: Update an Availability Zone
name: os_load-balancer_api:availability-zone:put
operations:
- method: PUT
path: /v2.0/lbaas/availabilityzones/{availability_zone_id}
scope_types: null
- check_str: rule:load-balancer:read
description: Show Availability Zone details
name: os_load-balancer_api:availability-zone:get_one
operations:
- method: GET
path: /v2.0/lbaas/availabilityzones/{availability_zone_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Remove an Availability Zone
name: os_load-balancer_api:availability-zone:delete
operations:
- method: DELETE
path: /v2.0/lbaas/availabilityzones/{availability_zone_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: List Availability Zones
name: os_load-balancer_api:availability-zone-profile:get_all
operations:
- method: GET
path: /v2.0/lbaas/availabilityzoneprofiles
scope_types: null
- check_str: rule:load-balancer:admin
description: Create an Availability Zone
name: os_load-balancer_api:availability-zone-profile:post
operations:
- method: POST
path: /v2.0/lbaas/availabilityzoneprofiles
scope_types: null
- check_str: rule:load-balancer:admin
description: Update an Availability Zone
name: os_load-balancer_api:availability-zone-profile:put
operations:
- method: PUT
path: /v2.0/lbaas/availabilityzoneprofiles/{availability_zone_profile_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Show Availability Zone details
name: os_load-balancer_api:availability-zone-profile:get_one
operations:
- method: GET
path: /v2.0/lbaas/availabilityzoneprofiles/{availability_zone_profile_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Remove an Availability Zone
name: os_load-balancer_api:availability-zone-profile:delete
operations:
- method: DELETE
path: /v2.0/lbaas/availabilityzoneprofiles/{availability_zone_profile_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List Health Monitors of a Pool
name: os_load-balancer_api:healthmonitor:get_all
operations:
- method: GET
path: /v2/lbaas/healthmonitors
scope_types: null
- check_str: rule:load-balancer:read-global
description: List Health Monitors including resources owned by others
name: os_load-balancer_api:healthmonitor:get_all-global
operations:
- method: GET
path: /v2/lbaas/healthmonitors
scope_types: null
- check_str: rule:load-balancer:write
description: Create a Health Monitor
name: os_load-balancer_api:healthmonitor:post
operations:
- method: POST
path: /v2/lbaas/healthmonitors
scope_types: null
- check_str: rule:load-balancer:read
description: Show Health Monitor details
name: os_load-balancer_api:healthmonitor:get_one
operations:
- method: GET
path: /v2/lbaas/healthmonitors/{healthmonitor_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a Health Monitor
name: os_load-balancer_api:healthmonitor:put
operations:
- method: PUT
path: /v2/lbaas/healthmonitors/{healthmonitor_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a Health Monitor
name: os_load-balancer_api:healthmonitor:delete
operations:
- method: DELETE
path: /v2/lbaas/healthmonitors/{healthmonitor_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List L7 Policys
name: os_load-balancer_api:l7policy:get_all
operations:
- method: GET
path: /v2/lbaas/l7policies
scope_types: null
- check_str: rule:load-balancer:read-global
description: List L7 Policys including resources owned by others
name: os_load-balancer_api:l7policy:get_all-global
operations:
- method: GET
path: /v2/lbaas/l7policies
scope_types: null
- check_str: rule:load-balancer:write
description: Create a L7 Policy
name: os_load-balancer_api:l7policy:post
operations:
- method: POST
path: /v2/lbaas/l7policies
scope_types: null
- check_str: rule:load-balancer:read
description: Show L7 Policy details
name: os_load-balancer_api:l7policy:get_one
operations:
- method: GET
path: /v2/lbaas/l7policies/{l7policy_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a L7 Policy
name: os_load-balancer_api:l7policy:put
operations:
- method: PUT
path: /v2/lbaas/l7policies/{l7policy_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a L7 Policy
name: os_load-balancer_api:l7policy:delete
operations:
- method: DELETE
path: /v2/lbaas/l7policies/{l7policy_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List L7 Rules
name: os_load-balancer_api:l7rule:get_all
operations:
- method: GET
path: /v2/lbaas/l7policies/{l7policy_id}/rules
scope_types: null
- check_str: rule:load-balancer:write
description: Create a L7 Rule
name: os_load-balancer_api:l7rule:post
operations:
- method: POST
path: /v2/lbaas/l7policies/{l7policy_id}/rules
scope_types: null
- check_str: rule:load-balancer:read
description: Show L7 Rule details
name: os_load-balancer_api:l7rule:get_one
operations:
- method: GET
path: /v2/lbaas/l7policies/{l7policy_id}/rules/{l7rule_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a L7 Rule
name: os_load-balancer_api:l7rule:put
operations:
- method: PUT
path: /v2/lbaas/l7policies/{l7policy_id}/rules/{l7rule_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a L7 Rule
name: os_load-balancer_api:l7rule:delete
operations:
- method: DELETE
path: /v2/lbaas/l7policies/{l7policy_id}/rules/{l7rule_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List Listeners
name: os_load-balancer_api:listener:get_all
operations:
- method: GET
path: /v2/lbaas/listeners
scope_types: null
- check_str: rule:load-balancer:read-global
description: List Listeners including resources owned by others
name: os_load-balancer_api:listener:get_all-global
operations:
- method: GET
path: /v2/lbaas/listeners
scope_types: null
- check_str: rule:load-balancer:write
description: Create a Listener
name: os_load-balancer_api:listener:post
operations:
- method: POST
path: /v2/lbaas/listeners
scope_types: null
- check_str: rule:load-balancer:read
description: Show Listener details
name: os_load-balancer_api:listener:get_one
operations:
- method: GET
path: /v2/lbaas/listeners/{listener_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a Listener
name: os_load-balancer_api:listener:put
operations:
- method: PUT
path: /v2/lbaas/listeners/{listener_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a Listener
name: os_load-balancer_api:listener:delete
operations:
- method: DELETE
path: /v2/lbaas/listeners/{listener_id}
scope_types: null
- check_str: rule:load-balancer:read
description: Show Listener statistics
name: os_load-balancer_api:listener:get_stats
operations:
- method: GET
path: /v2/lbaas/listeners/{listener_id}/stats
scope_types: null
- check_str: rule:load-balancer:read
description: List Load Balancers
name: os_load-balancer_api:loadbalancer:get_all
operations:
- method: GET
path: /v2/lbaas/loadbalancers
scope_types: null
- check_str: rule:load-balancer:read-global
description: List Load Balancers including resources owned by others
name: os_load-balancer_api:loadbalancer:get_all-global
operations:
- method: GET
path: /v2/lbaas/loadbalancers
scope_types: null
- check_str: rule:load-balancer:write
description: Create a Load Balancer
name: os_load-balancer_api:loadbalancer:post
operations:
- method: POST
path: /v2/lbaas/loadbalancers
scope_types: null
- check_str: rule:load-balancer:read
description: Show Load Balancer details
name: os_load-balancer_api:loadbalancer:get_one
operations:
- method: GET
path: /v2/lbaas/loadbalancers/{loadbalancer_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a Load Balancer
name: os_load-balancer_api:loadbalancer:put
operations:
- method: PUT
path: /v2/lbaas/loadbalancers/{loadbalancer_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a Load Balancer
name: os_load-balancer_api:loadbalancer:delete
operations:
- method: DELETE
path: /v2/lbaas/loadbalancers/{loadbalancer_id}
scope_types: null
- check_str: rule:load-balancer:read
description: Show Load Balancer statistics
name: os_load-balancer_api:loadbalancer:get_stats
operations:
- method: GET
path: /v2/lbaas/loadbalancers/{loadbalancer_id}/stats
scope_types: null
- check_str: rule:load-balancer:read
description: Show Load Balancer status
name: os_load-balancer_api:loadbalancer:get_status
operations:
- method: GET
path: /v2/lbaas/loadbalancers/{loadbalancer_id}/status
scope_types: null
- check_str: rule:load-balancer:admin
description: Failover a Load Balancer
name: os_load-balancer_api:loadbalancer:put_failover
operations:
- method: PUT
path: /v2/lbaas/loadbalancers/{loadbalancer_id}/failover
scope_types: null
- check_str: rule:load-balancer:read
description: List Members of a Pool
name: os_load-balancer_api:member:get_all
operations:
- method: GET
path: /v2/lbaas/pools/{pool_id}/members
scope_types: null
- check_str: rule:load-balancer:write
description: Create a Member
name: os_load-balancer_api:member:post
operations:
- method: POST
path: /v2/lbaas/pools/{pool_id}/members
scope_types: null
- check_str: rule:load-balancer:read
description: Show Member details
name: os_load-balancer_api:member:get_one
operations:
- method: GET
path: /v2/lbaas/pools/{pool_id}/members/{member_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a Member
name: os_load-balancer_api:member:put
operations:
- method: PUT
path: /v2/lbaas/pools/{pool_id}/members/{member_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a Member
name: os_load-balancer_api:member:delete
operations:
- method: DELETE
path: /v2/lbaas/pools/{pool_id}/members/{member_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List Pools
name: os_load-balancer_api:pool:get_all
operations:
- method: GET
path: /v2/lbaas/pools
scope_types: null
- check_str: rule:load-balancer:read-global
description: List Pools including resources owned by others
name: os_load-balancer_api:pool:get_all-global
operations:
- method: GET
path: /v2/lbaas/pools
scope_types: null
- check_str: rule:load-balancer:write
description: Create a Pool
name: os_load-balancer_api:pool:post
operations:
- method: POST
path: /v2/lbaas/pools
scope_types: null
- check_str: rule:load-balancer:read
description: Show Pool details
name: os_load-balancer_api:pool:get_one
operations:
- method: GET
path: /v2/lbaas/pools/{pool_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Update a Pool
name: os_load-balancer_api:pool:put
operations:
- method: PUT
path: /v2/lbaas/pools/{pool_id}
scope_types: null
- check_str: rule:load-balancer:write
description: Remove a Pool
name: os_load-balancer_api:pool:delete
operations:
- method: DELETE
path: /v2/lbaas/pools/{pool_id}
scope_types: null
- check_str: rule:load-balancer:read
description: List enabled providers
name: os_load-balancer_api:provider:get_all
operations:
- method: GET
path: /v2/lbaas/providers
scope_types: null
- check_str: rule:load-balancer:read-quota
description: List Quotas
name: os_load-balancer_api:quota:get_all
operations:
- method: GET
path: /v2/lbaas/quotas
scope_types: null
- check_str: rule:load-balancer:read-quota-global
description: List Quotas including resources owned by others
name: os_load-balancer_api:quota:get_all-global
operations:
- method: GET
path: /v2/lbaas/quotas
scope_types: null
- check_str: rule:load-balancer:read-quota
description: Show Quota details
name: os_load-balancer_api:quota:get_one
operations:
- method: GET
path: /v2/lbaas/quotas/{project_id}
scope_types: null
- check_str: rule:load-balancer:write-quota
description: Update a Quota
name: os_load-balancer_api:quota:put
operations:
- method: PUT
path: /v2/lbaas/quotas/{project_id}
scope_types: null
- check_str: rule:load-balancer:write-quota
description: Reset a Quota
name: os_load-balancer_api:quota:delete
operations:
- method: DELETE
path: /v2/lbaas/quotas/{project_id}
scope_types: null
- check_str: rule:load-balancer:read-quota
description: Show Default Quota for a Project
name: os_load-balancer_api:quota:get_defaults
operations:
- method: GET
path: /v2/lbaas/quotas/{project_id}/default
scope_types: null
- check_str: rule:load-balancer:admin
description: List Amphorae
name: os_load-balancer_api:amphora:get_all
operations:
- method: GET
path: /v2/octavia/amphorae
scope_types: null
- check_str: rule:load-balancer:admin
description: Show Amphora details
name: os_load-balancer_api:amphora:get_one
operations:
- method: GET
path: /v2/octavia/amphorae/{amphora_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Delete an Amphora
name: os_load-balancer_api:amphora:delete
operations:
- method: DELETE
path: /v2/octavia/amphorae/{amphora_id}
scope_types: null
- check_str: rule:load-balancer:admin
description: Update Amphora Agent Configuration
name: os_load-balancer_api:amphora:put_config
operations:
- method: PUT
path: /v2/octavia/amphorae/{amphora_id}/config
scope_types: null
- check_str: rule:load-balancer:admin
description: Failover Amphora
name: os_load-balancer_api:amphora:put_failover
operations:
- method: PUT
path: /v2/octavia/amphorae/{amphora_id}/failover
scope_types: null
- check_str: rule:load-balancer:admin
description: Show Amphora statistics
name: os_load-balancer_api:amphora:get_stats
operations:
- method: GET
path: /v2/octavia/amphorae/{amphora_id}/stats
scope_types: null
- check_str: rule:load-balancer:admin
description: List the provider flavor capabilities.
name: os_load-balancer_api:provider-flavor:get_all
operations:
- method: GET
path: /v2/lbaas/providers/{provider}/flavor_capabilities
scope_types: null
- check_str: rule:load-balancer:admin
description: List the provider availability zone capabilities.
name: os_load-balancer_api:provider-availability-zone:get_all
operations:
- method: GET
path: /v2/lbaas/providers/{provider}/availability_zone_capabilities
scope_types: null