518d89d7c1
Implements more fine-grained policy support within our API service, following the oslo policy-in-code spec, while maintaining compatibility with the previous default policy.json file. An empty policy.json file is included, along with a sample file listig all supported policy settings and their default values. A new tox target "genpolicy" has been added to ease automation of sample policy file generation. Any policy has be changed, please run "tox -e genpolicy" to update policy.json.sample. ref: http://docs.openstack.org/developer/oslo.policy/usage.html ref: pydoc oslo_policy.policy Change-Id: I3a971f2565c2f35665007461c1ae91eeb3b2de5a
31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
# Legacy rule for cloud admin access
|
|
"admin_api": "role:admin or role:administrator"
|
|
# Internal flag for public API routes
|
|
"public_api": "is_public_api:True"
|
|
# Show or mask secrets within instance information in API responses
|
|
"show_instance_secrets": "!"
|
|
# any access will be passed
|
|
"allow": "@"
|
|
# all access will be forbidden
|
|
"deny": "!"
|
|
# Full read/write API access
|
|
"is_admin": "rule:admin_api or (rule:is_member and role:nimble_admin)"
|
|
# Admin or owner API access
|
|
"admin_or_owner": "is_admin:True or project_id:%(project_id)s"
|
|
# Admin or user API access
|
|
"admin_or_user": "is_admin:True or user_id:%(user_id)s"
|
|
# Default API access rule
|
|
"default": "rule:admin_or_owner"
|
|
# Retrieve Instance records
|
|
"nimble:instance:get": "rule:default"
|
|
# View Instance power and provision state
|
|
"nimble:instance:get_states": "rule:default"
|
|
# Create Instance records
|
|
"nimble:instance:create": "rule:allow"
|
|
# Delete Instance records
|
|
"nimble:instance:delete": "rule:default"
|
|
# Update Instance records
|
|
"nimble:instance:update": "rule:default"
|
|
# Change Instance power status
|
|
"nimble:instance:set_power_state": "rule:default"
|