4b06c280bb
Now, admin user could list/show/delete/update most of qinling resources, except function deletion. Because function deletion needs to delete the trust created for qinling service by its owner, only end user has the authority to delete their trust. Implements: blueprint qinling-admin-operations Change-Id: I9ec4df59fbf8ac50c96d9677dd74c54677b307a5
23 lines
793 B
Plaintext
23 lines
793 B
Plaintext
{
|
|
"context_is_admin": "role:admin or is_admin:1",
|
|
"owner" : "project_id:%(project_id)s",
|
|
"admin_or_owner": "rule:context_is_admin or rule:owner",
|
|
"default": "rule:admin_or_owner",
|
|
|
|
"runtime:create": "rule:context_is_admin",
|
|
"runtime:update": "rule:context_is_admin",
|
|
"runtime:delete": "rule:context_is_admin",
|
|
|
|
"function:get_all:all_projects": "rule:context_is_admin",
|
|
"function_worker:get_all": "rule:context_is_admin",
|
|
"function:scale_up": "rule:context_is_admin",
|
|
"function:scale_down": "rule:context_is_admin",
|
|
"function:detach": "rule:context_is_admin",
|
|
|
|
"execution:get_all:all_projects": "rule:context_is_admin",
|
|
|
|
"webhook:get_all:all_projects": "rule:context_is_admin",
|
|
|
|
"job:get_all:all_projects": "rule:context_is_admin",
|
|
}
|