150 lines
9.0 KiB
YAML
150 lines
9.0 KiB
YAML
conf:
|
|
policy:
|
|
admin_api: is_admin:True or (role:admin and is_admin_project:True)
|
|
admin_or_owner: is_admin:True or (role:admin and is_admin_project:True) or project_id:%(project_id)s
|
|
admin_or_projectadmin_owner: rule:admin_api or rule:projectadmin_and_owner
|
|
admin_or_projectadmin_required: rule:admin_api or rule:projectadmin_required
|
|
admin_or_projectmember_owner: rule:admin_api or rule:projectmember_and_owner
|
|
admin_or_projectmember_required: rule:admin_api or rule:projectmember_required
|
|
backup:backup-export: rule:admin_api
|
|
backup:backup-import: rule:admin_api
|
|
backup:backup_project_attribute: rule:admin_api
|
|
backup:create: rule:admin_or_projectmember_owner
|
|
backup:delete: rule:admin_or_projectadmin_owner
|
|
backup:get: rule:admin_or_owner
|
|
backup:get_all: rule:admin_or_owner
|
|
backup:restore: rule:admin_or_projectadmin_owner
|
|
backup:update: rule:admin_or_projectadmin_owner
|
|
clusters:get: rule:admin_api
|
|
clusters:get_all: rule:admin_api
|
|
clusters:update: rule:admin_api
|
|
consistencygroup:create: rule:admin_or_projectadmin_required
|
|
consistencygroup:create_cgsnapshot: rule:admin_or_projectadmin_required
|
|
consistencygroup:delete: rule:admin_or_projectadmin_required
|
|
consistencygroup:delete_cgsnapshot: rule:admin_or_projectadmin_required
|
|
consistencygroup:get: ""
|
|
consistencygroup:get_all: ""
|
|
consistencygroup:get_all_cgsnapshots: ""
|
|
consistencygroup:get_cgsnapshot: ""
|
|
consistencygroup:update: rule:admin_or_projectadmin_required
|
|
default: rule:admin_or_owner
|
|
group:access_group_types_specs: rule:admin_api
|
|
group:create: rule:admin_or_projectadmin_required
|
|
group:create_group_snapshot: rule:admin_or_projectadmin_required
|
|
group:delete: rule:admin_or_projectadmin_owner
|
|
group:delete_group_snapshot: rule:admin_or_projectadmin_owner
|
|
group:disable_replication: rule:admin_or_projectadmin_owner
|
|
group:enable_replication: rule:admin_or_projectadmin_owner
|
|
group:failover_replication: rule:admin_or_projectadmin_owner
|
|
group:get: rule:admin_or_owner
|
|
group:get_all: rule:admin_or_owner
|
|
group:get_all_group_snapshots: rule:admin_or_owner
|
|
group:get_group_snapshot: rule:admin_or_owner
|
|
group:group_type_access: rule:admin_or_projectadmin_owner
|
|
group:group_types_manage: rule:admin_api
|
|
group:group_types_specs: rule:admin_api
|
|
group:list_replication_targets: rule:admin_or_owner
|
|
group:reset_group_snapshot_status: rule:admin_api
|
|
group:reset_status: rule:admin_api
|
|
group:update: rule:admin_or_projectadmin_owner
|
|
group:update_group_snapshot: rule:admin_or_projectadmin_owner
|
|
message:delete: rule:admin_or_projectadmin_owner
|
|
message:get: rule:admin_or_owner
|
|
message:get_all: rule:admin_or_owner
|
|
owner: project_id:%(project_id)s
|
|
projectadmin_and_owner: rule:projectadmin_required and rule:owner
|
|
projectadmin_required: role:project_admin
|
|
projectmember_and_owner: rule:projectmember_required and rule:owner
|
|
projectmember_required: role:project_admin or role:member
|
|
scheduler_extension:scheduler_stats:get_pools: rule:admin_api
|
|
snapshot_extension:list_manageable: rule:admin_api
|
|
snapshot_extension:snapshot_actions:update_snapshot_status: rule:admin_or_projectmember_required
|
|
snapshot_extension:snapshot_manage: rule:admin_api
|
|
snapshot_extension:snapshot_unmanage: rule:admin_api
|
|
volume:accept_transfer: rule:admin_or_projectmember_required
|
|
volume:attachment_create: rule:admin_or_projectmember_required
|
|
volume:attachment_delete: rule:admin_or_projectmember_owner
|
|
volume:attachment_update: rule:admin_or_projectmember_owner
|
|
volume:create: rule:admin_or_projectmember_required
|
|
volume:create_from_image: rule:admin_or_projectmember_required
|
|
volume:create_snapshot: rule:admin_or_projectmember_owner
|
|
volume:create_transfer: rule:admin_or_projectadmin_owner
|
|
volume:create_volume_metadata: rule:admin_or_projectmember_owner
|
|
volume:delete: rule:admin_or_projectadmin_owner
|
|
volume:delete_snapshot: rule:admin_or_projectadmin_owner
|
|
volume:delete_snapshot_metadata: rule:admin_or_projectadmin_owner
|
|
volume:delete_transfer: rule:admin_or_projectadmin_owner
|
|
volume:delete_volume_metadata: rule:admin_or_projectadmin_owner
|
|
volume:extend: rule:admin_or_projectadmin_owner
|
|
volume:extend_attached_volume: rule:admin_or_projectadmin_owner
|
|
volume:failover_host: rule:admin_api
|
|
volume:force_delete: rule:admin_api
|
|
volume:freeze_host: rule:admin_api
|
|
volume:get: rule:admin_or_owner
|
|
volume:get_all: rule:admin_or_owner
|
|
volume:get_all_snapshots: rule:admin_or_owner
|
|
volume:get_all_transfers: rule:admin_or_owner
|
|
volume:get_snapshot: rule:admin_or_owner
|
|
volume:get_snapshot_metadata: rule:admin_or_owner
|
|
volume:get_transfer: rule:admin_or_owner
|
|
volume:get_volume_admin_metadata: rule:admin_api
|
|
volume:get_volume_metadata: rule:admin_or_owner
|
|
volume:retype: rule:admin_or_projectadmin_owner
|
|
volume:revert_to_snapshot: rule:admin_or_projectadmin_owner
|
|
volume:thaw_host: rule:admin_api
|
|
volume:update: rule:admin_or_projectadmin_owner
|
|
volume:update_readonly_flag: rule:admin_or_projectadmin_owner
|
|
volume:update_snapshot: rule:admin_or_projectadmin_owner
|
|
volume:update_snapshot_metadata: rule:admin_or_projectadmin_owner
|
|
volume:update_volume_admin_metadata: rule:admin_api
|
|
volume:update_volume_metadata: rule:admin_or_projectadmin_owner
|
|
volume_extension:access_types_extra_specs: rule:admin_api
|
|
volume_extension:access_types_qos_specs_id: rule:admin_api
|
|
volume_extension:backup_admin_actions:force_delete: rule:admin_api
|
|
volume_extension:backup_admin_actions:reset_status: rule:admin_api
|
|
volume_extension:capabilities: rule:admin_api
|
|
volume_extension:extended_snapshot_attributes: rule:admin_or_projectadmin_owner
|
|
volume_extension:hosts: rule:admin_api
|
|
volume_extension:list_manageable: rule:admin_api
|
|
volume_extension:qos_specs_manage:create: rule:admin_api
|
|
volume_extension:qos_specs_manage:delete: rule:admin_api
|
|
volume_extension:qos_specs_manage:get: rule:admin_api
|
|
volume_extension:qos_specs_manage:get_all: rule:admin_api
|
|
volume_extension:qos_specs_manage:update: rule:admin_api
|
|
volume_extension:quota_classes: rule:admin_api
|
|
volume_extension:quota_classes:validate_setup_for_nested_quota_use: rule:admin_api
|
|
volume_extension:quotas:delete: rule:admin_api
|
|
volume_extension:quotas:show: ""
|
|
volume_extension:quotas:update: rule:admin_api
|
|
volume_extension:services:index: rule:admin_api
|
|
volume_extension:services:update: rule:admin_api
|
|
volume_extension:snapshot_admin_actions:force_delete: rule:admin_api
|
|
volume_extension:snapshot_admin_actions:reset_status: rule:admin_api
|
|
volume_extension:snapshot_backup_status_attribute: rule:admin_or_projectadmin_owner
|
|
volume_extension:snapshot_export_attributes: rule:admin_or_projectadmin_owner
|
|
volume_extension:types_extra_specs:create: rule:admin_api
|
|
volume_extension:types_extra_specs:delete: rule:admin_api
|
|
volume_extension:types_extra_specs:index: rule:admin_api
|
|
volume_extension:types_extra_specs:show: rule:admin_api
|
|
volume_extension:types_extra_specs:update: rule:admin_api
|
|
volume_extension:types_manage: rule:admin_api
|
|
volume_extension:volume_actions:upload_image: rule:admin_or_projectadmin_owner
|
|
volume_extension:volume_actions:upload_public: rule:admin_api
|
|
volume_extension:volume_admin_actions:force_delete: rule:admin_api
|
|
volume_extension:volume_admin_actions:force_detach: rule:admin_api
|
|
volume_extension:volume_admin_actions:migrate_volume: rule:admin_api
|
|
volume_extension:volume_admin_actions:migrate_volume_completion: rule:admin_api
|
|
volume_extension:volume_admin_actions:reset_status: rule:admin_api
|
|
volume_extension:volume_encryption_metadata: rule:admin_or_projectadmin_owner
|
|
volume_extension:volume_host_attribute: rule:admin_api
|
|
volume_extension:volume_image_metadata: rule:admin_or_owner
|
|
volume_extension:volume_manage: rule:admin_api
|
|
volume_extension:volume_mig_status_attribute: rule:admin_api
|
|
volume_extension:volume_tenant_attribute: rule:admin_or_projectadmin_owner
|
|
volume_extension:volume_type_access: rule:admin_or_projectadmin_owner
|
|
volume_extension:volume_type_access:addProjectAccess: rule:admin_api
|
|
volume_extension:volume_type_access:removeProjectAccess: rule:admin_api
|
|
volume_extension:volume_type_encryption: rule:admin_api
|
|
volume_extension:volume_unmanage: rule:admin_api
|
|
workers:cleanup: rule:admin_api
|