diff options
| author | Ghanshyam Mann <gmann@ghanshyammann.com> | 2021-11-30 17:35:45 -0600 |
|---|---|---|
| committer | Ghanshyam <gmann@ghanshyammann.com> | 2022-02-17 05:20:07 +0000 |
| commit | 60c9e3edadb3497043d20361ff665ed72241301e (patch) | |
| tree | 4a34746fdceaefc1ef401ecd1d30e61b6a7b2401 /nova/policies/hosts.py | |
| parent | ed1a854c90620716050845c5ff0031d85c1ef81c (diff) | |
| download | nova-60c9e3edadb3497043d20361ff665ed72241301e.tar.gz | |
Convert SYSTEM_ADMIN|READER to Admin and system scope
As per the new direction, we will move all the
system level policies to system admin even GET
policies. system reader will be added in next phase
in future cycle.
To dissociate the scope checks form the new defaults,
check_str is added as 'admin' rule (role:admin) without
'system:all'. So that policy with that admin rule and
scope_type as 'system' works like:
- with enforce_scope=false, legacy or project admin still able to
access the system level APIs.
- with enforce_scope=True, only system user with admin role can
access the system level APIs.
Also modifying and adding tests for four cases:
1. enforce_scope=False + legacy rule (current default policies)
2. enforce_scope=False + No legacy rule
3. enforce_scope=True + legacy rule
4. enforce_scope=True + no legacy rule (end goal of new RBAC)
Partial implement blueprint policy-defaults-refresh-2
Change-Id: I344276d2ab054311a4b6c34c6998e116e7507246
Diffstat (limited to 'nova/policies/hosts.py')
| -rw-r--r-- | nova/policies/hosts.py | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/nova/policies/hosts.py b/nova/policies/hosts.py index 64c36845bf..1505f225ba 100644 --- a/nova/policies/hosts.py +++ b/nova/policies/hosts.py @@ -38,7 +38,7 @@ DEPRECATED_POLICY = policy.DeprecatedRule( hosts_policies = [ policy.DocumentedRuleDefault( name=POLICY_NAME % 'list', - check_str=base.SYSTEM_READER, + check_str=base.ADMIN, description="""List physical hosts. This API is deprecated in favor of os-hypervisors and os-services.""", @@ -52,7 +52,7 @@ This API is deprecated in favor of os-hypervisors and os-services.""", deprecated_rule=DEPRECATED_POLICY), policy.DocumentedRuleDefault( name=POLICY_NAME % 'show', - check_str=base.SYSTEM_READER, + check_str=base.ADMIN, description="""Show physical host. This API is deprecated in favor of os-hypervisors and os-services.""", @@ -66,7 +66,7 @@ This API is deprecated in favor of os-hypervisors and os-services.""", deprecated_rule=DEPRECATED_POLICY), policy.DocumentedRuleDefault( name=POLICY_NAME % 'update', - check_str=base.SYSTEM_ADMIN, + check_str=base.ADMIN, description="""Update physical host. This API is deprecated in favor of os-hypervisors and os-services.""", @@ -80,7 +80,7 @@ This API is deprecated in favor of os-hypervisors and os-services.""", deprecated_rule=DEPRECATED_POLICY), policy.DocumentedRuleDefault( name=POLICY_NAME % 'reboot', - check_str=base.SYSTEM_ADMIN, + check_str=base.ADMIN, description="""Reboot physical host. This API is deprecated in favor of os-hypervisors and os-services.""", @@ -94,7 +94,7 @@ This API is deprecated in favor of os-hypervisors and os-services.""", deprecated_rule=DEPRECATED_POLICY), policy.DocumentedRuleDefault( name=POLICY_NAME % 'shutdown', - check_str=base.SYSTEM_ADMIN, + check_str=base.ADMIN, description="""Shutdown physical host. This API is deprecated in favor of os-hypervisors and os-services.""", @@ -108,7 +108,7 @@ This API is deprecated in favor of os-hypervisors and os-services.""", deprecated_rule=DEPRECATED_POLICY), policy.DocumentedRuleDefault( name=POLICY_NAME % 'start', - check_str=base.SYSTEM_ADMIN, + check_str=base.ADMIN, description="""Start physical host. This API is deprecated in favor of os-hypervisors and os-services.""", |