openstack
/
manila
Code Issues Proposed changes

[policy in code] Add support for service and quota resource [5/10] 

This patch adds policy in code support for service and quota
resources.

Change-Id: I9a79b5ececc583e80149cc980930e162e805b143
Partial-Implements: blueprint policy-in-code
This commit is contained in:
zhongjun 2017-11-24 18:08:29 +08:00 committed by zhongjun
parent dd160df611
commit 9a201768ae
7 changed files with 300 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
etc/manila/policy.json
View File

@ -1,16 +1,6 @@
{
"availability_zone:index": "rule:default",
"quota_set:update": "rule:admin_api",
"quota_set:show": "rule:default",
"quota_set:delete": "rule:admin_api",
"quota_class_set:show": "rule:default",
"quota_class_set:update": "rule:admin_api",
"service:index": "rule:admin_api",
"service:update": "rule:admin_api",
"share_export_location:index": "rule:default",
"share_export_location:show": "rule:default",
@ -33,11 +23,6 @@
"security_service:detail": "rule:default",
"security_service:get_all_security_services": "rule:admin_api",
"share_server:index": "rule:admin_api",
"share_server:show": "rule:admin_api",
"share_server:details": "rule:admin_api",
"share_server:delete": "rule:admin_api",
"share_network:create": "rule:default",
"share_network:delete": "rule:default",
"share_network:update": "rule:default",

8
manila/policies/__init__.py
View File

@ -17,7 +17,11 @@
import itertools
from manila.policies import base
from manila.policies import quota_class_set
from manila.policies import quota_set
from manila.policies import service
from manila.policies import share_instance_export_location
from manila.policies import share_server
from manila.policies import share_snapshot
from manila.policies import share_snapshot_export_location
from manila.policies import share_snapshot_instance
@ -36,4 +40,8 @@ def list_rules():
share_snapshot_export_location.list_rules(),
share_snapshot_instance.list_rules(),
share_snapshot_instance_export_location.list_rules(),
share_server.list_rules(),
service.list_rules(),
quota_set.list_rules(),
quota_class_set.list_rules(),
)

54
manila/policies/quota_class_set.py Normal file
View File

@ -0,0 +1,54 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'quota_class_set:%s'
quota_class_set_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update',
check_str=base.RULE_ADMIN_API,
description="Update quota class.",
operations=[
{
'method': 'PUT',
'path': '/quota-class-sets/{class_name}'
},
{
'method': 'PUT',
'path': '/os-quota-class-sets/{class_name}'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_DEFAULT,
description="Get quota class.",
operations=[
{
'method': 'GET',
'path': '/quota-class-sets/{class_name}'
},
{
'method': 'GET',
'path': '/os-quota-class-sets/{class_name}'
}
]),
]
def list_rules():
return quota_class_set_policies

95
manila/policies/quota_set.py Normal file
View File

@ -0,0 +1,95 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'quota_set:%s'
quota_set_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update',
check_str=base.RULE_ADMIN_API,
description=("Update the quotas for a project/user and/or share "
"type."),
operations=[
{
'method': 'PUT',
'path': '/quota-sets/{tenant_id}'
},
{
'method': 'PUT',
'path': '/quota-sets/{tenant_id}?user_id={user_id}'
},
{
'method': 'PUT',
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}'
},
{
'method': 'PUT',
'path': '/os-quota-sets/{tenant_id}'
},
{
'method': 'PUT',
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}'
},
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_DEFAULT,
description="List the quotas for a tenant/user.",
operations=[
{
'method': 'GET',
'path': '/quota-sets/{tenant_id}/defaults'
},
{
'method': 'GET',
'path': '/os-quota-sets/{tenant_id}/defaults'
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
check_str=base.RULE_ADMIN_API,
description=("Delete quota for a tenant/user or "
"tenant/share-type. The quota will revert back to "
"default (Admin only)."),
operations=[
{
'method': 'DELETE',
'path': '/quota-sets/{tenant_id}'
},
{
'method': 'DELETE',
'path': '/quota-sets/{tenant_id}?user_id={user_id}'
},
{
'method': 'DELETE',
'path': '/quota-sets/{tenant_id}?share_type={share_type_id}'
},
{
'method': 'DELETE',
'path': '/os-quota-sets/{tenant_id}'
},
{
'method': 'DELETE',
'path': '/os-quota-sets/{tenant_id}?user_id={user_id}'
},
]),
]
def list_rules():
return quota_set_policies

70
manila/policies/service.py Normal file
View File

@ -0,0 +1,70 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'service:%s'
service_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API,
description="Return a list of all running services.",
operations=[
{
'method': 'GET',
'path': '/os-services',
},
{
'method': 'GET',
'path': '/os-services?{query}',
},
{
'method': 'GET',
'path': '/services',
},
{
'method': 'GET',
'path': '/services?{query}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'update',
check_str=base.RULE_ADMIN_API,
description="Enable/Disable scheduling for a service.",
operations=[
{
'method': 'PUT',
'path': '/os-services/disable',
},
{
'method': 'PUT',
'path': '/os-services/enable',
},
{
'method': 'PUT',
'path': '/services/disable',
},
{
'method': 'PUT',
'path': '/services/enable',
},
]),
]
def list_rules():
return service_policies

70
manila/policies/share_server.py Normal file
View File

@ -0,0 +1,70 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'share_server:%s'
share_server_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
check_str=base.RULE_ADMIN_API,
description="Get share servers.",
operations=[
{
'method': 'GET',
'path': '/share-servers',
},
{
'method': 'GET',
'path': '/share-servers?{query}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
check_str=base.RULE_ADMIN_API,
description="Show share server.",
operations=[
{
'method': 'GET',
'path': '/share-servers/{server_id}',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'details',
check_str=base.RULE_ADMIN_API,
description="Get share server details.",
operations=[
{
'method': 'GET',
'path': '/share-servers/{server_id}/details',
}
]),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
check_str=base.RULE_ADMIN_API,
description="Delete share server.",
operations=[
{
'method': 'DELETE',
'path': '/share-servers/{server_id}',
}
]),
]
def list_rules():
return share_server_policies

4
manila/policy.py
View File

@ -212,7 +212,9 @@ def check_policy(context, resource, action, target_obj=None):
'share', 'share_snapshot',
'share_snapshot_export_location',
'share_snapshot_instance',
'share_snapshot_instance_export_location'):
'share_snapshot_instance_export_location',
'quota_set', 'quota_class_set', 'service',
'share_server', ):
authorize(context, _action, target)
else:
enforce(context, _action, target)