Merge "Implement project personas in custom manila policy file" into stable/wallaby

environments/enable-secure-rbac.yaml

@@ -3311,496 +3311,493 @@ parameter_defaults:
       value: "rule:admin_or_owner"
     manila-admin_api:
       key: "admin_api"
-      value: "is_admin:True"
+      value: "role:admin"
     manila-availability_zone_index:
       key: "availability_zone:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-scheduler_stats_pools_index:
       key: "scheduler_stats:pools:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-scheduler_stats_pools_detail:
       key: "scheduler_stats:pools:detail"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_create:
       key: "share:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_create_public_share:
       key: "share:create_public_share"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_get:
       key: "share:get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_get_all:
       key: "share:get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_update:
       key: "share:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_set_public_share:
       key: "share:set_public_share"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_delete:
       key: "share:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_force_delete:
       key: "share:force_delete"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_manage:
       key: "share:manage"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_unmanage:
       key: "share:unmanage"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_list_by_host:
       key: "share:list_by_host"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_list_by_share_server_id:
       key: "share:list_by_share_server_id"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_access_get:
       key: "share:access_get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_access_get_all:
       key: "share:access_get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_extend:
       key: "share:extend"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
-    manila-share_force_extend:
-      key: "share:force_extend"
-      value: "(rule:system-admin) or (rule:project-admin)"
     manila-share_shrink:
       key: "share:shrink"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_migration_start:
       key: "share:migration_start"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_migration_complete:
       key: "share:migration_complete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_migration_cancel:
       key: "share:migration_cancel"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_migration_get_progress:
       key: "share:migration_get_progress"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_reset_task_state:
       key: "share:reset_task_state"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_reset_status:
       key: "share:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_revert_to_snapshot:
       key: "share:revert_to_snapshot"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_allow_access:
       key: "share:allow_access"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_deny_access:
       key: "share:deny_access"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_update_share_metadata:
       key: "share:update_share_metadata"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_delete_share_metadata:
       key: "share:delete_share_metadata"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_get_share_metadata:
       key: "share:get_share_metadata"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_create_snapshot:
       key: "share:create_snapshot"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_delete_snapshot:
       key: "share:delete_snapshot"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_snapshot_update:
       key: "share:snapshot_update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_instance_export_location_index:
       key: "share_instance_export_location:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_instance_export_location_show:
       key: "share_instance_export_location:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_type_create:
       key: "share_type:create"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_type_update:
       key: "share_type:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_type_show:
       key: "share_type:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_type_index:
       key: "share_type:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_type_default:
       key: "share_type:default"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_type_delete:
       key: "share_type:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_type_list_project_access:
       key: "share_type:list_project_access"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_type_add_project_access:
       key: "share_type:add_project_access"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_type_remove_project_access:
       key: "share_type:remove_project_access"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_types_extra_spec_create:
       key: "share_types_extra_spec:create"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_types_extra_spec_show:
       key: "share_types_extra_spec:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_types_extra_spec_index:
       key: "share_types_extra_spec:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_types_extra_spec_update:
       key: "share_types_extra_spec:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_types_extra_spec_delete:
       key: "share_types_extra_spec:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_snapshot_get_snapshot:
       key: "share_snapshot:get_snapshot"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_snapshot_get_all_snapshots:
       key: "share_snapshot:get_all_snapshots"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_snapshot_force_delete:
       key: "share_snapshot:force_delete"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_snapshot_manage_snapshot:
       key: "share_snapshot:manage_snapshot"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_snapshot_unmanage_snapshot:
       key: "share_snapshot:unmanage_snapshot"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_snapshot_reset_status:
       key: "share_snapshot:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_snapshot_access_list:
       key: "share_snapshot:access_list"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_snapshot_allow_access:
       key: "share_snapshot:allow_access"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_snapshot_deny_access:
       key: "share_snapshot:deny_access"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_snapshot_export_location_index:
       key: "share_snapshot_export_location:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_snapshot_export_location_show:
       key: "share_snapshot_export_location:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_snapshot_instance_show:
       key: "share_snapshot_instance:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_snapshot_instance_index:
       key: "share_snapshot_instance:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_snapshot_instance_detail:
       key: "share_snapshot_instance:detail"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_snapshot_instance_reset_status:
       key: "share_snapshot_instance:reset_status"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_snapshot_instance_export_location_index:
       key: "share_snapshot_instance_export_location:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_snapshot_instance_export_location_show:
       key: "share_snapshot_instance_export_location:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_index:
       key: "share_server:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_show:
       key: "share_server:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_details:
       key: "share_server:details"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_delete:
       key: "share_server:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_manage_share_server:
       key: "share_server:manage_share_server"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_unmanage_share_server:
       key: "share_server:unmanage_share_server"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_reset_status:
       key: "share_server:reset_status"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_share_server_migration_start:
       key: "share_server:share_server_migration_start"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_share_server_migration_check:
       key: "share_server:share_server_migration_check"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_share_server_migration_complete:
       key: "share_server:share_server_migration_complete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_share_server_migration_cancel:
       key: "share_server:share_server_migration_cancel"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_server_share_server_migration_get_progress:
       key: "share_server:share_server_migration_get_progress"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_server_share_server_reset_task_state:
       key: "share_server:share_server_reset_task_state"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-service_index:
       key: "service:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-service_update:
       key: "service:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-quota_set_update:
       key: "quota_set:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-quota_set_show:
       key: "quota_set:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-quota_set_delete:
       key: "quota_set:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-quota_class_set_update:
       key: "quota_class_set:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-quota_class_set_show:
       key: "quota_class_set:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_types_spec_create:
       key: "share_group_types_spec:create"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_types_spec_index:
       key: "share_group_types_spec:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_group_types_spec_show:
       key: "share_group_types_spec:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_group_types_spec_update:
       key: "share_group_types_spec:update"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_types_spec_delete:
       key: "share_group_types_spec:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_type_create:
       key: "share_group_type:create"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_type_index:
       key: "share_group_type:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_type_show:
       key: "share_group_type:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_type_default:
       key: "share_group_type:default"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_type_delete:
       key: "share_group_type:delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_type_list_project_access:
       key: "share_group_type:list_project_access"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_group_type_add_project_access:
       key: "share_group_type:add_project_access"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_type_remove_project_access:
       key: "share_group_type:remove_project_access"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_group_snapshot_create:
       key: "share_group_snapshot:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_snapshot_get:
       key: "share_group_snapshot:get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_snapshot_get_all:
       key: "share_group_snapshot:get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_snapshot_update:
       key: "share_group_snapshot:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_snapshot_delete:
       key: "share_group_snapshot:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_snapshot_force_delete:
       key: "share_group_snapshot:force_delete"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_group_snapshot_reset_status:
       key: "share_group_snapshot:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_group_create:
       key: "share_group:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_get:
       key: "share_group:get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_get_all:
       key: "share_group:get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_group_update:
       key: "share_group:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_delete:
       key: "share_group:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_group_force_delete:
       key: "share_group:force_delete"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_group_reset_status:
       key: "share_group:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_replica_create:
       key: "share_replica:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_replica_get_all:
       key: "share_replica:get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_replica_show:
       key: "share_replica:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_replica_delete:
       key: "share_replica:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_replica_force_delete:
       key: "share_replica:force_delete"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_replica_promote:
       key: "share_replica:promote"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_replica_resync:
       key: "share_replica:resync"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_replica_reset_replica_state:
       key: "share_replica:reset_replica_state"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_replica_reset_status:
       key: "share_replica:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_replica_export_location_index:
       key: "share_replica_export_location:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_replica_export_location_show:
       key: "share_replica_export_location:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_network_create:
       key: "share_network:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_show:
       key: "share_network:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_network_index:
       key: "share_network:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_network_detail:
       key: "share_network:detail"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_network_update:
       key: "share_network:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_delete:
       key: "share_network:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_add_security_service:
       key: "share_network:add_security_service"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_add_security_service_check:
       key: "share_network:add_security_service_check"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_remove_security_service:
       key: "share_network:remove_security_service"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_update_security_service:
       key: "share_network:update_security_service"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_update_security_service_check:
       key: "share_network:update_security_service_check"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_reset_status:
       key: "share_network:reset_status"
-      value: "(rule:system-admin) or (rule:project-admin)"
+      value: "(rule:admin_api) or (rule:project-admin)"
     manila-share_network_get_all_share_networks:
       key: "share_network:get_all_share_networks"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_network_subnet_create:
       key: "share_network_subnet:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_subnet_delete:
       key: "share_network_subnet:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_network_subnet_show:
       key: "share_network_subnet:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_network_subnet_index:
       key: "share_network_subnet:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-security_service_create:
       key: "security_service:create"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-security_service_show:
       key: "security_service:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-security_service_detail:
       key: "security_service:detail"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-security_service_index:
       key: "security_service:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-security_service_update:
       key: "security_service:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-security_service_delete:
       key: "security_service:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-security_service_get_all_security_services:
       key: "security_service:get_all_security_services"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_export_location_index:
       key: "share_export_location:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_export_location_show:
       key: "share_export_location:show"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_instance_index:
       key: "share_instance:index"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_instance_show:
       key: "share_instance:show"
-      value: "rule:system-reader"
+      value: "rule:admin_api"
     manila-share_instance_force_delete:
       key: "share_instance:force_delete"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-share_instance_reset_status:
       key: "share_instance:reset_status"
-      value: "rule:system-admin"
+      value: "rule:admin_api"
     manila-message_get:
       key: "message:get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-message_get_all:
       key: "message:get_all"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-message_delete:
       key: "message:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_access_rule_get:
       key: "share_access_rule:get"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_access_rule_index:
       key: "share_access_rule:index"
-      value: "(rule:system-reader) or (rule:project-reader)"
+      value: "(rule:admin_api) or (rule:project-reader)"
     manila-share_access_metadata_update:
       key: "share_access_metadata:update"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
     manila-share_access_metadata_delete:
       key: "share_access_metadata:delete"
-      value: "(rule:system-admin) or (rule:project-member)"
+      value: "(rule:admin_api) or (rule:project-member)"
   OctaviaApiPolicies:
     octavia-system-admin:
       key: "system-admin"