270d12e9a8
Cyborg Policy Default Refresh is one of the planned blueprints for victoria
release, the specification[0] has been merged in ussuri. To be brief, we need
to do the followings to incorporate authorization scopes into cyborg:
1. Add protection test for all APIs.
A protection test is similar to an API test, but purely focused on the
authoritative outcome.In other words, protection testing is sufficient when
we can assert that a user is or isn’t allowed to do or see something. For
example, users with a reader role on the system or a project shouldn’t be
able to make writable changes.
2. Add the following applicable seven personas to cyborg and mark old
ones as deprecated roles:
* project reader
* project member
* project admin
* system reader
* system admin
* system admin or owner
* system or project reader
3. Rewrite check string(authorization rules) using new personas for all APIs
4. Update policy documentation on cyborg-doc page
This patch refreshed cyborg default RBAC policy to scoped RBAC policy, and
reorganized the policy framework into a more logical way:
1) added seven personas to basic policies and marked legacy roles
as deprecated ones.
2) extract API_policies from policy.py to indenpendent policy files
3) extract authorize_wsgi.py out from policy.py
[0]https://specs.openstack.org/openstack/cyborg-specs/specs/ussuri/approved/policy-defaults-refresh.html
Story: 2007024
Task: 40835
Change-Id: I948d0202ddcd82a532c4de2c1850893cbfaf003d
59 lines
2.0 KiB
INI
59 lines
2.0 KiB
INI
[metadata]
|
|
name = openstack-cyborg
|
|
summary = Distributed Acceleration Management as a Service
|
|
description-file =
|
|
README.rst
|
|
author = OpenStack
|
|
author-email = openstack-discuss@lists.openstack.org
|
|
home-page = https://docs.openstack.org/cyborg/latest/
|
|
python-requires = >=3.6
|
|
classifier =
|
|
Environment :: OpenStack
|
|
Intended Audience :: Information Technology
|
|
Intended Audience :: System Administrators
|
|
License :: OSI Approved :: Apache Software License
|
|
Operating System :: POSIX :: Linux
|
|
Programming Language :: Python
|
|
Programming Language :: Python :: Implementation :: CPython
|
|
Programming Language :: Python :: 3 :: Only
|
|
Programming Language :: Python :: 3
|
|
Programming Language :: Python :: 3.6
|
|
Programming Language :: Python :: 3.7
|
|
Programming Language :: Python :: 3.8
|
|
|
|
[files]
|
|
packages =
|
|
cyborg
|
|
data_files =
|
|
etc/cyborg =
|
|
etc/cyborg/policy.json
|
|
etc/cyborg/api-paste.ini
|
|
|
|
[entry_points]
|
|
oslo.policy.policies =
|
|
cyborg.api = cyborg.policies:list_policies
|
|
|
|
console_scripts =
|
|
cyborg-api = cyborg.cmd.api:main
|
|
cyborg-conductor = cyborg.cmd.conductor:main
|
|
cyborg-dbsync = cyborg.cmd.dbsync:main
|
|
cyborg-agent = cyborg.cmd.agent:main
|
|
cyborg-status = cyborg.cmd.status:main
|
|
wsgi_scripts =
|
|
cyborg-wsgi-api = cyborg.api.wsgi_app:init_application
|
|
|
|
cyborg.database.migration_backend =
|
|
sqlalchemy = cyborg.db.sqlalchemy.migration
|
|
|
|
cyborg.accelerator.driver =
|
|
intel_fpga_driver = cyborg.accelerator.drivers.fpga.intel.driver:IntelFPGADriver
|
|
inspur_fpga_driver = cyborg.accelerator.drivers.fpga.inspur.driver:InspurFPGADriver
|
|
nvmf_spdk_driver = cyborg.accelerator.drivers.spdk.nvmf.nvmf:NVMFDRIVER
|
|
nvidia_gpu_driver = cyborg.accelerator.drivers.gpu.nvidia.driver:NVIDIAGPUDriver
|
|
fake_driver = cyborg.accelerator.drivers.fake:FakeDriver
|
|
huawei_ascend_driver = cyborg.accelerator.drivers.aichip.huawei.ascend:AscendDriver
|
|
intel_qat_driver = cyborg.accelerator.drivers.qat.intel.driver:IntelQATDriver
|
|
|
|
oslo.config.opts =
|
|
cyborg = cyborg.conf.opts:list_opts
|