60144767cd
1. add magnum install into post_install.sh 2. add magnum into SUPPORTED_SERVICE_EPS and PREFIX_MAPPINGS 3. add magnum policy Change-Id: I10d2d337331d8c4857f6e58331e545eead0bf26f
490 lines
19 KiB
Python
490 lines
19 KiB
Python
from . import base
|
|
|
|
list_rules = (
|
|
base.Rule(
|
|
name="context_is_admin",
|
|
check_str=("role:admin"),
|
|
description="No description",
|
|
),
|
|
base.Rule(
|
|
name="admin_or_owner",
|
|
check_str=("is_admin:True or project_id:%(project_id)s"),
|
|
description="No description",
|
|
),
|
|
base.Rule(
|
|
name="admin_api",
|
|
check_str=("rule:context_is_admin"),
|
|
description="No description",
|
|
),
|
|
base.Rule(
|
|
name="admin_or_user",
|
|
check_str=("is_admin:True or user_id:%(user_id)s"),
|
|
description="No description",
|
|
),
|
|
base.Rule(
|
|
name="cluster_user",
|
|
check_str=("user_id:%(trustee_user_id)s"),
|
|
description="No description",
|
|
),
|
|
base.Rule(
|
|
name="deny_cluster_user",
|
|
check_str=("not domain_id:%(trustee_domain_id)s"),
|
|
description="No description",
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:create",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Create a new bay.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/bays"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:delete",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Delete a bay.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/bays/{bay_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:detail",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of bays with detail.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/bays"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:get",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve information about the given bay.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/bays/{bay_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:get_all",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of bays.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/bays/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:bay:update",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Update an existing bay.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/bays/{bay_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:create",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Create a new baymodel.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/baymodels"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:delete",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Delete a baymodel.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/baymodels/{baymodel_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:detail",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of baymodel with detail.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/baymodels"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:get",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve information about the given baymodel.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/baymodels/{baymodel_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:get_all",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of baymodel.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/baymodels"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:update",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Update an existing baymodel.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/baymodels/{baymodel_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:baymodel:publish",
|
|
check_str=("(role:admin)"),
|
|
description="Publish an existing baymodel.",
|
|
scope_types=["project"],
|
|
operations=[
|
|
{"method": "POST", "path": "/v1/baymodels"},
|
|
{"method": "PATCH", "path": "/v1/baymodels"},
|
|
],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:certificate:create",
|
|
check_str=("(is_admin:True or user_id:%(user_id)s) or (user_id:%(trustee_user_id)s)"),
|
|
description="Sign a new certificate by the CA.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/certificates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:certificate:get",
|
|
check_str=("(is_admin:True or user_id:%(user_id)s) or (user_id:%(trustee_user_id)s)"),
|
|
description="Retrieve CA information about the given bay/cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/certificates/{bay_uuid/cluster_uuid}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:certificate:rotate_ca",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Rotate the CA certificate on the given bay/cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/certificates/{bay_uuid/cluster_uuid}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:create",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Create a new cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clusters"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:delete",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Delete a cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:delete_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Delete a cluster from any project.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:detail",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of clusters with detail.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:detail_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of clusters with detail across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:get",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve information about the given cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:get_one_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve information about the given cluster across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:get_all",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of clusters.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:get_all_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of all clusters across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:update",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Update an existing cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:update_health_status",
|
|
check_str=("(is_admin:True or user_id:%(user_id)s) or (user_id:%(trustee_user_id)s)"),
|
|
description="Update the health status of an existing cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:update_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Update an existing cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/clusters/{cluster_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:resize",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Resize an existing cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clusters/{cluster_ident}/actions/resize"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:upgrade",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Upgrade an existing cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clusters/{cluster_ident}/actions/upgrade"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:cluster:upgrade_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Upgrade an existing cluster across all projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clusters/{cluster_ident}/actions/upgrade"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:create",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Create a new cluster template.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clustertemplates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:delete",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Delete a cluster template.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:delete_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Delete a cluster template from any project.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:detail_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of cluster templates with detail across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:detail",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of cluster templates with detail.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:get",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve information about the given cluster template.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:get_one_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve information about the given cluster template across project.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:get_all",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of cluster templates.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:get_all_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of cluster templates across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clustertemplates"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:update",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Update an existing cluster template.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:update_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Update an existing cluster template.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/clustertemplate/{clustertemplate_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:clustertemplate:publish",
|
|
check_str=("(role:admin)"),
|
|
description="Publish an existing cluster template.",
|
|
scope_types=["project"],
|
|
operations=[
|
|
{"method": "POST", "path": "/v1/clustertemplates"},
|
|
{"method": "PATCH", "path": "/v1/clustertemplates"},
|
|
],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:create",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Create a new federation.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/federations"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:delete",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Delete a federation.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/federations/{federation_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:detail",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of federations with detail.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/federations"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:get",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve information about the given federation.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/federations/{federation_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:get_all",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Retrieve a list of federations.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/federations/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:federation:update",
|
|
check_str=("(not domain_id:%(trustee_domain_id)s)"),
|
|
description="Update an existing federation.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/federations/{federation_ident}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:magnum-service:get_all",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of magnum-services.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/mservices"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:quota:create",
|
|
check_str=("(role:admin)"),
|
|
description="Create quota.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/quotas"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:quota:delete",
|
|
check_str=("(role:admin)"),
|
|
description="Delete quota for a given project_id and resource.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "DELETE", "path": "/v1/quotas/{project_id}/{resource}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:quota:get",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Retrieve Quota information for the given project_id.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/quotas/{project_id}/{resource}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:quota:get_all",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of quotas.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/quotas"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:quota:update",
|
|
check_str=("(role:admin)"),
|
|
description="Update quota for a given project_id.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "PATCH", "path": "/v1/quotas/{project_id}/{resource}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:stats:get_all",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Retrieve magnum stats.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/stats"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:get",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Retrieve information about the given nodegroup.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/{cluster_id}/nodegroup/{nodegroup}"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:get_all",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Retrieve a list of nodegroups that belong to a cluster.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/{cluster_id}/nodegroups/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:get_all_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve a list of nodegroups across projects.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "GET", "path": "/v1/clusters/{cluster_id}/nodegroups/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:get_one_all_projects",
|
|
check_str=("(role:admin)"),
|
|
description="Retrieve infornation for a given nodegroup.",
|
|
scope_types=["project"],
|
|
operations=[
|
|
{"method": "GET", "path": "/v1/clusters/{cluster_id}/nodegroups/{nodegroup}"},
|
|
],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:create",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Create a new nodegroup.",
|
|
scope_types=["project"],
|
|
operations=[{"method": "POST", "path": "/v1/clusters/{cluster_id}/nodegroups/"}],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:delete",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Delete a nodegroup.",
|
|
scope_types=["project"],
|
|
operations=[
|
|
{"method": "DELETE", "path": "/v1/clusters/{cluster_id}/nodegroups/{nodegroup}"},
|
|
],
|
|
),
|
|
base.APIRule(
|
|
name="magnum:nodegroup:update",
|
|
check_str=("(is_admin:True or project_id:%(project_id)s)"),
|
|
description="Update an existing nodegroup.",
|
|
scope_types=["project"],
|
|
operations=[
|
|
{"method": "PATCH", "path": "/v1/clusters/{cluster_id}/nodegroups/{nodegroup}"},
|
|
],
|
|
),
|
|
)
|
|
|
|
__all__ = ("list_rules",)
|