Update paste, policy and rootwrap configurations 2017-01-26

Change-Id: Id5adac759a79f314787ad0c540c7530e5530f50c

defaults/main.yml

@@ -111,6 +111,7 @@ magnum_pip_packages:
   - PyMySQL
   - magnum
   - python-memcached
+  - osprofiler
 
 # This variable is used by the repo_build process to determine
 # which host group to check for members of before building the

templates/api-paste.ini.j2

@@ -1,5 +1,5 @@
 [pipeline:main]
-pipeline = cors healthcheck http_proxy_to_wsgi request_id authtoken api_v1
+pipeline = cors healthcheck http_proxy_to_wsgi request_id osprofiler authtoken api_v1
 
 [app:api_v1]
 paste.app_factory = magnum.api.app:app_factory
@@ -8,6 +8,9 @@ paste.app_factory = magnum.api.app:app_factory
 acl_public_routes = /, /v1
 paste.filter_factory = magnum.api.middleware.auth_token:AuthTokenMiddleware.factory
 
+[filter:osprofiler]
+paste.filter_factory = magnum.common.profiler:WsgiMiddleware.factory
+
 [filter:request_id]
 paste.filter_factory = oslo_middleware:RequestId.factory
 

templates/magnum.conf.j2

@@ -60,6 +60,9 @@ rabbit_virtual_host = {{ magnum_rabbitmq_vhost }}
 rabbit_notification_exchange = magnum
 rabbit_notification_topic = notification
 
+[profiler]
+enabled = false
+
 [trust]
 trustee_domain_admin_password = {{ magnum_trustee_password }}
 trustee_domain_admin_name = {{ magnum_trustee_domain_admin_name }}

templates/policy.json.j2

@@ -35,8 +35,15 @@
     "clustertemplate:update": "rule:default",
     "clustertemplate:publish": "rule:admin_or_owner",
 
+    "quotas:get": "rule:default",
+    "quotas:get_all": "rule:admin_api",
+    "quotas:create": "rule:admin_api",
+    "quotas:update": "rule:admin_api",
+    "quotas:delete": "rule:admin_api",
+
     "certificate:create": "rule:admin_or_user",
     "certificate:get": "rule:admin_or_user",
+    "certificate:rotate_ca": "rule:admin_or_owner",
 
     "magnum-service:get_all": "rule:admin_api",
     "stats:get_all": "rule:admin_or_owner"