diff options
author | Petr Malik <pmalik@tesora.com> | 2016-06-27 16:01:42 -0400 |
---|---|---|
committer | Petr Malik <pmalik@tesora.com> | 2016-12-06 21:51:21 +0000 |
commit | 21250cf20c0efbe6d57c4a712c51b80667e53b44 (patch) | |
tree | d18e6ee84986b798e7654e254a2a6894dc8d54f4 /trove/flavor | |
parent | 77fd7014c0007c83652dd4fb1f9d3316a97b1ed3 (diff) | |
download | trove-21250cf20c0efbe6d57c4a712c51b80667e53b44.tar.gz |
Add support for Oslo Policies to Trove
The Oslo Policy library provides support for RBAC policy
enforcement across all OpenStack services.
Update the devstack plugin to copy the default policy file
over to /etc/trove in the gate environments.
Note: Not adding a rule for 'reset-password' instance
action as that API was discontinued years ago
and is now just waiting for removal (Bug: 1645866).
DocImpact
Co-Authored-By: Ali Adil <aadil@tesora.com>
Change-Id: Ic443a4c663301840406cad537159eab7b0b5ed1c
Implements: blueprint trove-policy
Diffstat (limited to 'trove/flavor')
-rw-r--r-- | trove/flavor/service.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/trove/flavor/service.py b/trove/flavor/service.py index ea5b0d72..60e87935 100644 --- a/trove/flavor/service.py +++ b/trove/flavor/service.py @@ -17,6 +17,7 @@ import six from trove.common import exception +from trove.common import policy from trove.common import wsgi from trove.flavor import models from trove.flavor import views @@ -30,12 +31,16 @@ class FlavorController(wsgi.Controller): context = req.environ[wsgi.CONTEXT_KEY] self._validate_flavor_id(id) flavor = models.Flavor(context=context, flavor_id=id) + # Flavors do not bind to a particular tenant. + # Only authorize the current tenant. + policy.authorize_on_tenant(context, 'flavor:show') # Pass in the request to build accurate links. return wsgi.Result(views.FlavorView(flavor, req).data(), 200) def index(self, req, tenant_id): """Return all flavors.""" context = req.environ[wsgi.CONTEXT_KEY] + policy.authorize_on_tenant(context, 'flavor:index') flavors = models.Flavors(context=context) return wsgi.Result(views.FlavorsView(flavors, req).data(), 200) |