Skip to content

Commit 6085783

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Convert SYSTEM_ADMIN|READER to Admin and system scope"
2 parents f99f68e + 60c9e3e commit 6085783

15 files changed

+344
-573
lines changed

‎nova/policies/aggregates.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
aggregates_policies = [
2626
policy.DocumentedRuleDefault(
2727
name=POLICY_ROOT % 'set_metadata',
28-
check_str=base.SYSTEM_ADMIN,
28+
check_str=base.ADMIN,
2929
description="Create or replace metadata for an aggregate",
3030
operations=[
3131
{
@@ -36,7 +36,7 @@
3636
scope_types=['system']),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'add_host',
39-
check_str=base.SYSTEM_ADMIN,
39+
check_str=base.ADMIN,
4040
description="Add a host to an aggregate",
4141
operations=[
4242
{
@@ -47,7 +47,7 @@
4747
scope_types=['system']),
4848
policy.DocumentedRuleDefault(
4949
name=POLICY_ROOT % 'create',
50-
check_str=base.SYSTEM_ADMIN,
50+
check_str=base.ADMIN,
5151
description="Create an aggregate",
5252
operations=[
5353
{
@@ -58,7 +58,7 @@
5858
scope_types=['system']),
5959
policy.DocumentedRuleDefault(
6060
name=POLICY_ROOT % 'remove_host',
61-
check_str=base.SYSTEM_ADMIN,
61+
check_str=base.ADMIN,
6262
description="Remove a host from an aggregate",
6363
operations=[
6464
{
@@ -69,7 +69,7 @@
6969
scope_types=['system']),
7070
policy.DocumentedRuleDefault(
7171
name=POLICY_ROOT % 'update',
72-
check_str=base.SYSTEM_ADMIN,
72+
check_str=base.ADMIN,
7373
description="Update name and/or availability zone for an aggregate",
7474
operations=[
7575
{
@@ -80,7 +80,7 @@
8080
scope_types=['system']),
8181
policy.DocumentedRuleDefault(
8282
name=POLICY_ROOT % 'index',
83-
check_str=base.SYSTEM_READER,
83+
check_str=base.ADMIN,
8484
description="List all aggregates",
8585
operations=[
8686
{
@@ -91,7 +91,7 @@
9191
scope_types=['system']),
9292
policy.DocumentedRuleDefault(
9393
name=POLICY_ROOT % 'delete',
94-
check_str=base.SYSTEM_ADMIN,
94+
check_str=base.ADMIN,
9595
description="Delete an aggregate",
9696
operations=[
9797
{
@@ -102,7 +102,7 @@
102102
scope_types=['system']),
103103
policy.DocumentedRuleDefault(
104104
name=POLICY_ROOT % 'show',
105-
check_str=base.SYSTEM_READER,
105+
check_str=base.ADMIN,
106106
description="Show details for an aggregate",
107107
operations=[
108108
{
@@ -113,7 +113,7 @@
113113
scope_types=['system']),
114114
policy.DocumentedRuleDefault(
115115
name=NEW_POLICY_ROOT % 'images',
116-
check_str=base.SYSTEM_ADMIN,
116+
check_str=base.ADMIN,
117117
description="Request image caching for an aggregate",
118118
operations=[
119119
{

‎nova/policies/availability_zone.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
scope_types=['system', 'project']),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'detail',
39-
check_str=base.SYSTEM_READER,
39+
check_str=base.ADMIN,
4040
description="List detailed availability zone information with host "
4141
"information",
4242
operations=[

‎nova/policies/baremetal_nodes.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
baremetal_nodes_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=BASE_POLICY_NAME % 'list',
41-
check_str=base.SYSTEM_READER,
41+
check_str=base.ADMIN,
4242
description="""List and show details of bare metal nodes.
4343
4444
These APIs are proxy calls to the Ironic service and are deprecated.
@@ -53,7 +53,7 @@
5353
deprecated_rule=DEPRECATED_BAREMETAL_POLICY),
5454
policy.DocumentedRuleDefault(
5555
name=BASE_POLICY_NAME % 'show',
56-
check_str=base.SYSTEM_READER,
56+
check_str=base.ADMIN,
5757
description="""Show action details for a server.""",
5858
operations=[
5959
{

‎nova/policies/hosts.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
hosts_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=POLICY_NAME % 'list',
41-
check_str=base.SYSTEM_READER,
41+
check_str=base.ADMIN,
4242
description="""List physical hosts.
4343
4444
This API is deprecated in favor of os-hypervisors and os-services.""",
@@ -52,7 +52,7 @@
5252
deprecated_rule=DEPRECATED_POLICY),
5353
policy.DocumentedRuleDefault(
5454
name=POLICY_NAME % 'show',
55-
check_str=base.SYSTEM_READER,
55+
check_str=base.ADMIN,
5656
description="""Show physical host.
5757
5858
This API is deprecated in favor of os-hypervisors and os-services.""",
@@ -66,7 +66,7 @@
6666
deprecated_rule=DEPRECATED_POLICY),
6767
policy.DocumentedRuleDefault(
6868
name=POLICY_NAME % 'update',
69-
check_str=base.SYSTEM_ADMIN,
69+
check_str=base.ADMIN,
7070
description="""Update physical host.
7171
7272
This API is deprecated in favor of os-hypervisors and os-services.""",
@@ -80,7 +80,7 @@
8080
deprecated_rule=DEPRECATED_POLICY),
8181
policy.DocumentedRuleDefault(
8282
name=POLICY_NAME % 'reboot',
83-
check_str=base.SYSTEM_ADMIN,
83+
check_str=base.ADMIN,
8484
description="""Reboot physical host.
8585
8686
This API is deprecated in favor of os-hypervisors and os-services.""",
@@ -94,7 +94,7 @@
9494
deprecated_rule=DEPRECATED_POLICY),
9595
policy.DocumentedRuleDefault(
9696
name=POLICY_NAME % 'shutdown',
97-
check_str=base.SYSTEM_ADMIN,
97+
check_str=base.ADMIN,
9898
description="""Shutdown physical host.
9999
100100
This API is deprecated in favor of os-hypervisors and os-services.""",
@@ -108,7 +108,7 @@
108108
deprecated_rule=DEPRECATED_POLICY),
109109
policy.DocumentedRuleDefault(
110110
name=POLICY_NAME % 'start',
111-
check_str=base.SYSTEM_ADMIN,
111+
check_str=base.ADMIN,
112112
description="""Start physical host.
113113
114114
This API is deprecated in favor of os-hypervisors and os-services.""",

‎nova/policies/hypervisors.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
hypervisors_policies = [
3838
policy.DocumentedRuleDefault(
3939
name=BASE_POLICY_NAME % 'list',
40-
check_str=base.SYSTEM_READER,
40+
check_str=base.ADMIN,
4141
description="List all hypervisors.",
4242
operations=[
4343
{
@@ -49,7 +49,7 @@
4949
deprecated_rule=DEPRECATED_POLICY),
5050
policy.DocumentedRuleDefault(
5151
name=BASE_POLICY_NAME % 'list-detail',
52-
check_str=base.SYSTEM_READER,
52+
check_str=base.ADMIN,
5353
description="List all hypervisors with details",
5454
operations=[
5555
{
@@ -61,7 +61,7 @@
6161
deprecated_rule=DEPRECATED_POLICY),
6262
policy.DocumentedRuleDefault(
6363
name=BASE_POLICY_NAME % 'statistics',
64-
check_str=base.SYSTEM_READER,
64+
check_str=base.ADMIN,
6565
description="Show summary statistics for all hypervisors "
6666
"over all compute nodes.",
6767
operations=[
@@ -74,7 +74,7 @@
7474
deprecated_rule=DEPRECATED_POLICY),
7575
policy.DocumentedRuleDefault(
7676
name=BASE_POLICY_NAME % 'show',
77-
check_str=base.SYSTEM_READER,
77+
check_str=base.ADMIN,
7878
description="Show details for a hypervisor.",
7979
operations=[
8080
{
@@ -86,7 +86,7 @@
8686
deprecated_rule=DEPRECATED_POLICY),
8787
policy.DocumentedRuleDefault(
8888
name=BASE_POLICY_NAME % 'uptime',
89-
check_str=base.SYSTEM_READER,
89+
check_str=base.ADMIN,
9090
description="Show the uptime of a hypervisor.",
9191
operations=[
9292
{
@@ -98,7 +98,7 @@
9898
deprecated_rule=DEPRECATED_POLICY),
9999
policy.DocumentedRuleDefault(
100100
name=BASE_POLICY_NAME % 'search',
101-
check_str=base.SYSTEM_READER,
101+
check_str=base.ADMIN,
102102
description="Search hypervisor by hypervisor_hostname pattern.",
103103
operations=[
104104
{
@@ -110,7 +110,7 @@
110110
deprecated_rule=DEPRECATED_POLICY),
111111
policy.DocumentedRuleDefault(
112112
name=BASE_POLICY_NAME % 'servers',
113-
check_str=base.SYSTEM_READER,
113+
check_str=base.ADMIN,
114114
description="List all servers on hypervisors that can match "
115115
"the provided hypervisor_hostname pattern.",
116116
operations=[

‎nova/policies/quota_class_sets.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
quota_class_sets_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'show',
27-
check_str=base.SYSTEM_READER,
27+
check_str=base.ADMIN,
2828
description="List quotas for specific quota classs",
2929
operations=[
3030
{
@@ -35,7 +35,7 @@
3535
scope_types=['system']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'update',
38-
check_str=base.SYSTEM_ADMIN,
38+
check_str=base.ADMIN,
3939
description='Update quotas for specific quota class',
4040
operations=[
4141
{

‎nova/policies/services.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
services_policies = [
3838
policy.DocumentedRuleDefault(
3939
name=BASE_POLICY_NAME % 'list',
40-
check_str=base.SYSTEM_READER,
40+
check_str=base.ADMIN,
4141
description="List all running Compute services in a region.",
4242
operations=[
4343
{
@@ -49,7 +49,7 @@
4949
deprecated_rule=DEPRECATED_SERVICE_POLICY),
5050
policy.DocumentedRuleDefault(
5151
name=BASE_POLICY_NAME % 'update',
52-
check_str=base.SYSTEM_ADMIN,
52+
check_str=base.ADMIN,
5353
description="Update a Compute service.",
5454
operations=[
5555
{
@@ -62,7 +62,7 @@
6262
deprecated_rule=DEPRECATED_SERVICE_POLICY),
6363
policy.DocumentedRuleDefault(
6464
name=BASE_POLICY_NAME % 'delete',
65-
check_str=base.SYSTEM_ADMIN,
65+
check_str=base.ADMIN,
6666
description="Delete a Compute service.",
6767
operations=[
6868
{

‎nova/tests/unit/policies/base.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@ def setUp(self):
139139
# To simulate the new world, remove deprecations by overriding
140140
# rules which has the deprecated rules.
141141
self.rules_without_deprecation.update({
142+
"context_is_admin":
143+
"role:admin",
142144
"system_admin_or_owner":
143145
"rule:system_admin_api or rule:project_member_api",
144146
"system_or_project_reader":

0 commit comments

Comments
 (0)