chore: Add license for python file and update policy

1. Add license for python file
2. Update the policy for all services

Change-Id: I4bc6a68874afe1cc51da1a24d278165356d5dec3

skyline_apiserver/api/v1/prometheus.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status

skyline_apiserver/cmd/policy_manager.py

@@ -166,6 +166,20 @@ def generate_rule(service: str) -> None:
                 rules.append(Rule.from_oslo(rule))
 
     header_str = """\
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/barbican.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 
@@ -99,11 +113,31 @@ list_rules = (
         check_str=("rule:all_users and rule:container_project_match and not rule:container_private_read"),
         description="No description",
     ),
+    base.Rule(
+        name="secret_project_reader",
+        check_str=("role:reader and rule:secret_project_match"),
+        description="No description",
+    ),
+    base.Rule(
+        name="secret_project_member",
+        check_str=("role:member and rule:secret_project_match"),
+        description="No description",
+    ),
     base.Rule(
         name="secret_project_admin",
         check_str=("rule:admin and rule:secret_project_match"),
         description="No description",
     ),
+    base.Rule(
+        name="secret_owner",
+        check_str=("user_id:%(target.secret.creator_id)s"),
+        description="No description",
+    ),
+    base.Rule(
+        name="secret_is_not_private",
+        check_str=("True:%(target.secret.read_project_access)s"),
+        description="No description",
+    ),
     base.Rule(
         name="secret_project_creator",
         check_str=("rule:creator and rule:secret_project_match and rule:secret_creator_user"),
@@ -355,42 +389,42 @@ list_rules = (
     ),
     base.APIRule(
         name="secret:decrypt",
-        check_str=("rule:secret_decrypt_non_private_read or rule:secret_project_creator or rule:secret_project_admin or rule:secret_acl_read or (role:member and project_id:%(target.secret.project_id)s and (user_id:%(target.secret.creator_id)s or True:%(target.secret.read_project_access)s)) or role:admin and project_id:%(target.secret.project_id)s"),
+        check_str=("True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)"),
         description="Retrieve a secrets payload.",
         scope_types=["project"],
         operations=[{"method": "GET", "path": "/v1/secrets/{uuid}/payload"}],
     ),
     base.APIRule(
         name="secret:get",
-        check_str=("rule:secret_non_private_read or rule:secret_project_creator or rule:secret_project_admin or rule:secret_acl_read or (role:member and project_id:%(target.secret.project_id)s and (user_id:%(target.secret.creator_id)s or True:%(target.secret.read_project_access)s)) or role:admin and project_id:%(target.secret.project_id)s"),
+        check_str=("True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)"),
         description="Retrieves a secrets metadata.",
         scope_types=["project"],
         operations=[{"method": "GET", "path": "/v1/secrets/{secret-id}"}],
     ),
     base.APIRule(
         name="secret:put",
-        check_str=("rule:admin_or_creator and rule:secret_project_match or (role:member and project_id:%(target.secret.project_id)s and (user_id:%(target.secret.creator_id)s or True:%(target.secret.read_project_access)s)) or role:admin and project_id:%(target.secret.project_id)s"),
+        check_str=("True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))"),
         description="Add the payload to an existing metadata-only secret.",
         scope_types=["project"],
         operations=[{"method": "PUT", "path": "/v1/secrets/{secret-id}"}],
     ),
     base.APIRule(
         name="secret:delete",
-        check_str=("rule:secret_project_admin or rule:secret_project_creator or (rule:secret_project_creator_role and not rule:secret_private_read) or (role:member and project_id:%(target.secret.project_id)s and (user_id:%(target.secret.creator_id)s or True:%(target.secret.read_project_access)s)) or role:admin and project_id:%(target.secret.project_id)s"),
+        check_str=("True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))"),
         description="Delete a secret by uuid.",
         scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/v1/secrets/{secret-id}"}],
     ),
     base.APIRule(
         name="secrets:post",
-        check_str=("rule:admin_or_creator or role:member"),
+        check_str=("True:%(enforce_new_defaults)s and role:member"),
         description="Creates a Secret entity.",
         scope_types=["project"],
         operations=[{"method": "POST", "path": "/v1/secrets"}],
     ),
     base.APIRule(
         name="secrets:get",
-        check_str=("rule:all_but_audit or role:member"),
+        check_str=("True:%(enforce_new_defaults)s and role:member"),
         description="Lists a projects secrets.",
         scope_types=["project"],
         operations=[{"method": "GET", "path": "/v1/secrets"}],

skyline_apiserver/policy/manager/cinder.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/glance.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/heat.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/ironic.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/ironic_inspector.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/keystone.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/magnum.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/manila.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/nova.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 
@@ -64,63 +78,63 @@ list_rules = (
         name="os_compute_api:os-aggregates:set_metadata",
         check_str=("rule:context_is_admin"),
         description="Create or replace metadata for an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-aggregates/{aggregate_id}/action (set_metadata)"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:add_host",
         check_str=("rule:context_is_admin"),
         description="Add a host to an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-aggregates/{aggregate_id}/action (add_host)"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:create",
         check_str=("rule:context_is_admin"),
         description="Create an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-aggregates"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:remove_host",
         check_str=("rule:context_is_admin"),
         description="Remove a host from an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-aggregates/{aggregate_id}/action (remove_host)"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:update",
         check_str=("rule:context_is_admin"),
         description="Update name and/or availability zone for an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/os-aggregates/{aggregate_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:index",
         check_str=("rule:context_is_admin"),
         description="List all aggregates",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-aggregates"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:delete",
         check_str=("rule:context_is_admin"),
         description="Delete an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/os-aggregates/{aggregate_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-aggregates:show",
         check_str=("rule:context_is_admin"),
         description="Show details for an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-aggregates/{aggregate_id}"}],
     ),
     base.APIRule(
         name="compute:aggregates:images",
         check_str=("rule:context_is_admin"),
         description="Request image caching for an aggregate",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-aggregates/{aggregate_id}/images"}],
     ),
     base.APIRule(
@@ -169,28 +183,28 @@ list_rules = (
         name="os_compute_api:os-availability-zone:list",
         check_str=("@"),
         description="List availability zone information without host information",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-availability-zone"}],
     ),
     base.APIRule(
         name="os_compute_api:os-availability-zone:detail",
         check_str=("rule:context_is_admin"),
         description="List detailed availability zone information with host information",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-availability-zone/detail"}],
     ),
     base.APIRule(
         name="os_compute_api:os-baremetal-nodes:list",
         check_str=("rule:context_is_admin"),
         description="List and show details of bare metal nodes.\n#\n#These APIs are proxy calls to the Ironic service and are deprecated.\n#",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-baremetal-nodes"}],
     ),
     base.APIRule(
         name="os_compute_api:os-baremetal-nodes:show",
         check_str=("rule:context_is_admin"),
         description="Show action details for a server.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-baremetal-nodes/{node_id}"}],
     ),
     base.APIRule(
@@ -246,91 +260,91 @@ list_rules = (
         name="os_compute_api:extensions",
         check_str=("@"),
         description="List available extensions and show information for an extension by alias",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/extensions"}, {"method": "GET", "path": "/extensions/{alias}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-access:add_tenant_access",
         check_str=("rule:context_is_admin"),
         description="Add flavor access to a tenant",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/flavors/{flavor_id}/action (addTenantAccess)"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-access:remove_tenant_access",
         check_str=("rule:context_is_admin"),
         description="Remove flavor access from a tenant",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/flavors/{flavor_id}/action (removeTenantAccess)"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-access",
         check_str=("rule:context_is_admin"),
         description="List flavor access information\n#\n#Allows access to the full list of tenants that have access\n#to a flavor via an os-flavor-access API.\n#",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/flavors/{flavor_id}/os-flavor-access"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-extra-specs:show",
         check_str=("rule:project_reader_or_admin"),
         description="Show an extra spec for a flavor",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-extra-specs:create",
         check_str=("rule:context_is_admin"),
         description="Create extra specs for a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/flavors/{flavor_id}/os-extra_specs/"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-extra-specs:update",
         check_str=("rule:context_is_admin"),
         description="Update an extra spec for a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-extra-specs:delete",
         check_str=("rule:context_is_admin"),
         description="Delete an extra spec for a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-extra-specs:index",
         check_str=("rule:project_reader_or_admin"),
         description="List extra specs for a flavor. Starting with microversion 2.61, extra specs may be returned in responses for the flavor resource.",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/flavors/{flavor_id}/os-extra_specs/"}, {"method": "POST", "path": "/flavors"}, {"method": "GET", "path": "/flavors/detail"}, {"method": "GET", "path": "/flavors/{flavor_id}"}, {"method": "PUT", "path": "/flavors/{flavor_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-manage:create",
         check_str=("rule:context_is_admin"),
         description="Create a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/flavors"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-manage:update",
         check_str=("rule:context_is_admin"),
         description="Update a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/flavors/{flavor_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-flavor-manage:delete",
         check_str=("rule:context_is_admin"),
         description="Delete a flavor",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/flavors/{flavor_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-floating-ip-pools",
         check_str=("@"),
         description="List floating IP pools. This API is deprecated.",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-floating-ip-pools"}],
     ),
     base.APIRule(
@@ -379,91 +393,91 @@ list_rules = (
         name="os_compute_api:os-hosts:list",
         check_str=("rule:context_is_admin"),
         description="List physical hosts.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hosts"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hosts:show",
         check_str=("rule:context_is_admin"),
         description="Show physical host.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hosts/{host_name}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hosts:update",
         check_str=("rule:context_is_admin"),
         description="Update physical host.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/os-hosts/{host_name}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hosts:reboot",
         check_str=("rule:context_is_admin"),
         description="Reboot physical host.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hosts/{host_name}/reboot"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hosts:shutdown",
         check_str=("rule:context_is_admin"),
         description="Shutdown physical host.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hosts/{host_name}/shutdown"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hosts:start",
         check_str=("rule:context_is_admin"),
         description="Start physical host.\n#\n#This API is deprecated in favor of os-hypervisors and os-services.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hosts/{host_name}/startup"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:list",
         check_str=("rule:context_is_admin"),
         description="List all hypervisors.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:list-detail",
         check_str=("rule:context_is_admin"),
         description="List all hypervisors with details",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/details"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:statistics",
         check_str=("rule:context_is_admin"),
         description="Show summary statistics for all hypervisors over all compute nodes.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/statistics"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:show",
         check_str=("rule:context_is_admin"),
         description="Show details for a hypervisor.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/{hypervisor_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:uptime",
         check_str=("rule:context_is_admin"),
         description="Show the uptime of a hypervisor.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/{hypervisor_id}/uptime"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:search",
         check_str=("rule:context_is_admin"),
         description="Search hypervisor by hypervisor_hostname pattern.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/{hypervisor_hostname_pattern}/search"}],
     ),
     base.APIRule(
         name="os_compute_api:os-hypervisors:servers",
         check_str=("rule:context_is_admin"),
         description="List all servers on hypervisors that can match the provided hypervisor_hostname pattern.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-hypervisors/{hypervisor_hostname_pattern}/servers"}],
     ),
     base.APIRule(
@@ -498,14 +512,14 @@ list_rules = (
         name="os_compute_api:os-instance-usage-audit-log:list",
         check_str=("rule:context_is_admin"),
         description="List all usage audits.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-instance_usage_audit_log"}],
     ),
     base.APIRule(
         name="os_compute_api:os-instance-usage-audit-log:show",
         check_str=("rule:context_is_admin"),
         description="List all usage audits occurred before a specified time for all servers on all compute hosts where usage auditing is configured",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-instance_usage_audit_log/{before_timestamp}"}],
     ),
     base.APIRule(
@@ -526,28 +540,28 @@ list_rules = (
         name="os_compute_api:os-keypairs:index",
         check_str=("(rule:context_is_admin) or user_id:%(user_id)s"),
         description="List all keypairs",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-keypairs"}],
     ),
     base.APIRule(
         name="os_compute_api:os-keypairs:create",
         check_str=("(rule:context_is_admin) or user_id:%(user_id)s"),
         description="Create a keypair",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "POST", "path": "/os-keypairs"}],
     ),
     base.APIRule(
         name="os_compute_api:os-keypairs:delete",
         check_str=("(rule:context_is_admin) or user_id:%(user_id)s"),
         description="Delete a keypair",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/os-keypairs/{keypair_name}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-keypairs:show",
         check_str=("(rule:context_is_admin) or user_id:%(user_id)s"),
         description="Show details of a keypair",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-keypairs/{keypair_name}"}],
     ),
     base.APIRule(
@@ -652,14 +666,14 @@ list_rules = (
         name="os_compute_api:os-quota-class-sets:show",
         check_str=("rule:context_is_admin"),
         description="List quotas for specific quota classs",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-quota-class-sets/{quota_class}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-quota-class-sets:update",
         check_str=("rule:context_is_admin"),
         description="Update quotas for specific quota class",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/os-quota-class-sets/{quota_class}"}],
     ),
     base.APIRule(
@@ -673,7 +687,7 @@ list_rules = (
         name="os_compute_api:os-quota-sets:defaults",
         check_str=("@"),
         description="List default quotas",
-        scope_types=["system", "project"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-quota-sets/{tenant_id}/defaults"}],
     ),
     base.APIRule(
@@ -1198,21 +1212,21 @@ list_rules = (
         name="os_compute_api:os-services:list",
         check_str=("rule:context_is_admin"),
         description="List all running Compute services in a region.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "GET", "path": "/os-services"}],
     ),
     base.APIRule(
         name="os_compute_api:os-services:update",
         check_str=("rule:context_is_admin"),
         description="Update a Compute service.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "PUT", "path": "/os-services/{service_id}"}],
     ),
     base.APIRule(
         name="os_compute_api:os-services:delete",
         check_str=("rule:context_is_admin"),
         description="Delete a Compute service.",
-        scope_types=["system"],
+        scope_types=["project"],
         operations=[{"method": "DELETE", "path": "/os-services/{service_id}"}],
     ),
     base.APIRule(

skyline_apiserver/policy/manager/octavia.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/placement.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/trove.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/policy/manager/zun.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # flake8: noqa
 # fmt: off
 

skyline_apiserver/schemas/prometheus.py

@@ -1,3 +1,17 @@
+# Copyright 2022 99cloud
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 from __future__ import annotations
 
 from typing import Any, Dict, List, Optional