Skip to content

Commit fbe32cb

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "RBAC updates: drop system scope"
2 parents 2f4dd20 + f7b0d1c commit fbe32cb

File tree

6 files changed

+84
-69
lines changed

6 files changed

+84
-69
lines changed

‎glance/policies/base.py‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,9 @@
5454
#
5555
# These check strings do not support tenancy with the `admin` role. This means
5656
# anyone with the `admin` role on any project can execute a policy, which is
57-
# typical in OpenStack services. Eventually, these check strings will be
58-
# superseded by check strings that implement scope checking and system-scope
59-
# for applicable APIs (e.g., making an image public). But, we have a lot of
60-
# cleanup to do in different parts of glance to sweep all the authorization
61-
# code into a single layer before we can safely consume system-scope and
62-
# implement scope checking. This refactoring also needs significant API testing
63-
# to ensure we don't leave doors open to unintended users, or expose
64-
# authoritative regressions. In the mean time, we can use the following check
65-
# strings to offer formal support for project membership and a read-only
66-
# variant consistent with other OpenStack services.
57+
# typical in OpenStack services. But following check strings offer formal
58+
# support for project membership and a read-only variant consistent with
59+
# other OpenStack services.
6760
ADMIN_OR_PROJECT_MEMBER = f'role:admin or ({PROJECT_MEMBER})'
6861
ADMIN_OR_PROJECT_READER = f'role:admin or ({PROJECT_READER})'
6962
ADMIN_OR_PROJECT_READER_GET_IMAGE = (

‎glance/policies/discovery.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
policy.DocumentedRuleDefault(
2020
name="stores_info_detail",
2121
check_str='role:admin',
22-
scope_types=['system', 'project'],
22+
scope_types=['project'],
2323
description='Expose store specific information',
2424
operations=[
2525
{'path': '/v2/info/stores/detail',

‎glance/policies/image.py‎

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
policy.DocumentedRuleDefault(
2525
name="add_image",
2626
check_str=base.ADMIN_OR_PROJECT_MEMBER_CREATE_IMAGE,
27-
scope_types=['system', 'project'],
27+
scope_types=['project'],
2828
description='Create new image',
2929
operations=[
3030
{'path': '/v2/images',
@@ -38,7 +38,7 @@
3838
policy.DocumentedRuleDefault(
3939
name="delete_image",
4040
check_str=base.ADMIN_OR_PROJECT_MEMBER,
41-
scope_types=['system', 'project'],
41+
scope_types=['project'],
4242
description='Deletes the image',
4343
operations=[
4444
{'path': '/v2/images/{image_id}',
@@ -52,7 +52,7 @@
5252
policy.DocumentedRuleDefault(
5353
name="get_image",
5454
check_str=base.ADMIN_OR_PROJECT_READER_GET_IMAGE,
55-
scope_types=['system', 'project'],
55+
scope_types=['project'],
5656
description='Get specified image',
5757
operations=[
5858
{'path': '/v2/images/{image_id}',
@@ -66,7 +66,7 @@
6666
policy.DocumentedRuleDefault(
6767
name="get_images",
6868
check_str=base.ADMIN_OR_PROJECT_READER,
69-
scope_types=['system', 'project'],
69+
scope_types=['project'],
7070
description='Get all available images',
7171
operations=[
7272
{'path': '/v2/images',
@@ -80,7 +80,7 @@
8080
policy.DocumentedRuleDefault(
8181
name="modify_image",
8282
check_str=base.ADMIN_OR_PROJECT_MEMBER,
83-
scope_types=['system', 'project'],
83+
scope_types=['project'],
8484
description='Updates given image',
8585
operations=[
8686
{'path': '/v2/images/{image_id}',
@@ -94,7 +94,7 @@
9494
policy.DocumentedRuleDefault(
9595
name="publicize_image",
9696
check_str='role:admin',
97-
scope_types=['system', 'project'],
97+
scope_types=['project'],
9898
description='Publicize given image',
9999
operations=[
100100
{'path': '/v2/images/{image_id}',
@@ -104,7 +104,7 @@
104104
policy.DocumentedRuleDefault(
105105
name="communitize_image",
106106
check_str=base.ADMIN_OR_PROJECT_MEMBER,
107-
scope_types=['system', 'project'],
107+
scope_types=['project'],
108108
description='Communitize given image',
109109
operations=[
110110
{'path': '/v2/images/{image_id}',
@@ -119,7 +119,7 @@
119119
policy.DocumentedRuleDefault(
120120
name="download_image",
121121
check_str=base.ADMIN_OR_PROJECT_MEMBER_DOWNLOAD_IMAGE,
122-
scope_types=['system', 'project'],
122+
scope_types=['project'],
123123
description='Downloads given image',
124124
operations=[
125125
{'path': '/v2/images/{image_id}/file',
@@ -133,7 +133,7 @@
133133
policy.DocumentedRuleDefault(
134134
name="upload_image",
135135
check_str=base.ADMIN_OR_PROJECT_MEMBER,
136-
scope_types=['system', 'project'],
136+
scope_types=['project'],
137137
description='Uploads data to specified image',
138138
operations=[
139139
{'path': '/v2/images/{image_id}/file',
@@ -148,7 +148,7 @@
148148
policy.DocumentedRuleDefault(
149149
name="delete_image_location",
150150
check_str="role:admin",
151-
scope_types=['system', 'project'],
151+
scope_types=['project'],
152152
description='Deletes the location of given image',
153153
operations=[
154154
{'path': '/v2/images/{image_id}',
@@ -162,7 +162,7 @@
162162
policy.DocumentedRuleDefault(
163163
name="get_image_location",
164164
check_str=base.ADMIN_OR_PROJECT_READER,
165-
scope_types=['system', 'project'],
165+
scope_types=['project'],
166166
description='Reads the location of the image',
167167
operations=[
168168
{'path': '/v2/images/{image_id}',
@@ -176,7 +176,7 @@
176176
policy.DocumentedRuleDefault(
177177
name="set_image_location",
178178
check_str=base.ADMIN_OR_PROJECT_MEMBER,
179-
scope_types=['system', 'project'],
179+
scope_types=['project'],
180180
description='Sets location URI to given image',
181181
operations=[
182182
{'path': '/v2/images/{image_id}',
@@ -191,7 +191,7 @@
191191
policy.DocumentedRuleDefault(
192192
name="add_member",
193193
check_str=base.ADMIN_OR_PROJECT_MEMBER,
194-
scope_types=['system', 'project'],
194+
scope_types=['project'],
195195
description='Create image member',
196196
operations=[
197197
{'path': '/v2/images/{image_id}/members',
@@ -205,7 +205,7 @@
205205
policy.DocumentedRuleDefault(
206206
name="delete_member",
207207
check_str=base.ADMIN_OR_PROJECT_MEMBER,
208-
scope_types=['system', 'project'],
208+
scope_types=['project'],
209209
description='Delete image member',
210210
operations=[
211211
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -219,7 +219,7 @@
219219
policy.DocumentedRuleDefault(
220220
name="get_member",
221221
check_str=base.ADMIN_OR_PROJECT_READER_OR_SHARED_MEMBER,
222-
scope_types=['system', 'project'],
222+
scope_types=['project'],
223223
description='Show image member details',
224224
operations=[
225225
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -233,7 +233,7 @@
233233
policy.DocumentedRuleDefault(
234234
name="get_members",
235235
check_str=base.ADMIN_OR_PROJECT_READER_OR_SHARED_MEMBER,
236-
scope_types=['system', 'project'],
236+
scope_types=['project'],
237237
description='List image members',
238238
operations=[
239239
{'path': '/v2/images/{image_id}/members',
@@ -247,7 +247,7 @@
247247
policy.DocumentedRuleDefault(
248248
name="modify_member",
249249
check_str=base.ADMIN_OR_SHARED_MEMBER,
250-
scope_types=['system', 'project'],
250+
scope_types=['project'],
251251
description='Update image member',
252252
operations=[
253253
{'path': '/v2/images/{image_id}/members/{member_id}',
@@ -262,17 +262,14 @@
262262
policy.RuleDefault(
263263
name="manage_image_cache",
264264
check_str='role:admin',
265-
# NOTE(lbragstad): Remove 'project' from the list below when glance
266-
# fully supports system-scope and this policy is updated to reflect
267-
# that in the check string.
268-
scope_types=['system', 'project'],
265+
scope_types=['project'],
269266
description='Manage image cache'
270267
),
271268

272269
policy.DocumentedRuleDefault(
273270
name="deactivate",
274271
check_str=base.ADMIN_OR_PROJECT_MEMBER,
275-
scope_types=['system', 'project'],
272+
scope_types=['project'],
276273
description='Deactivate image',
277274
operations=[
278275
{'path': '/v2/images/{image_id}/actions/deactivate',
@@ -286,7 +283,7 @@
286283
policy.DocumentedRuleDefault(
287284
name="reactivate",
288285
check_str=base.ADMIN_OR_PROJECT_MEMBER,
289-
scope_types=['system', 'project'],
286+
scope_types=['project'],
290287
description='Reactivate image',
291288
operations=[
292289
{'path': '/v2/images/{image_id}/actions/reactivate',
@@ -301,11 +298,10 @@
301298
policy.DocumentedRuleDefault(
302299
name="copy_image",
303300
check_str='role:admin',
304-
# Eventually, we need to make sure we update the check string here to
305-
# be scope-aware, but for now this is restricted to system-admins and
306-
# project-admins. That might change in the future if we decide to push
301+
# For now this is restricted to project-admins.
302+
# That might change in the future if we decide to push
307303
# this functionality down to project-members.
308-
scope_types=['system', 'project'],
304+
scope_types=['project'],
309305
description='Copy existing image to other stores',
310306
operations=[
311307
{'path': '/v2/images/{image_id}/import',

0 commit comments

Comments
 (0)