Skip to content

Commit f9c1d11

Browse files
author
Ghanshyam Mann
committed
Complete phase-1 of RBAC community-wide goal
After moving the nova APIs policy as per the new guidlines where system scoped token will be only allowed to access system level APIs and will not be allowed any operation on project level APIs. With that we do not need below base rules (who have hardcoded 'system_scope:all' check_str): - system_admin_api - system_reader_api - system_admin_or_owner - system_or_project_reader At this stage (phase-1 target), we allow below roles as targeted in phase-1 [1] 1. ADMIN(this is System Administrator with scope_type 'system' when scope enabled otherwise legacy admin) 2. PROJECT_ADMIN 3. PROJECT_MEMBER 4. PROJECT_READER & below one specific to nova 5. PROJECT_READER_OR_ADMIN (to allow system admin and project reader to list flavor extra specs) This complete the phase-1 of RBAC community-wide goal[2] for nova. Add release notes too. [1] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#how-operator [2] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#yoga-timeline-7th-mar-2022 Partial implement blueprint policy-defaults-refresh-2 Change-Id: I075005d13ff6bfe048bbb21d80d71bf1602e4c02
1 parent 1be0072 commit f9c1d11

File tree

9 files changed

+108
-132
lines changed

9 files changed

+108
-132
lines changed

‎doc/source/configuration/policy-concepts.rst‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ resources from project or system level resources. Please refer to
4141
:keystone-doc:`this document </admin/tokens-overview.html#authorization-scopes>`
4242
and `system scope specification <https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html>`_ to understand the scope concept.
4343

44-
In the Nova 21.0.0 (Ussuri) release, Nova policies implemented
44+
In the Nova 25.0.0 (Yoga) release, Nova policies implemented
4545
the scope concept and default roles provided by keystone (admin, member,
4646
and reader). Using common roles from keystone reduces the likelihood of
4747
similar, but different, roles implemented across projects or deployments
@@ -112,15 +112,15 @@ Policies with a ``scope_type`` of ``system and project`` means a user with a
112112
resource. All the system and project level operation's policies have defaulted
113113
to ``scope_type`` of ``['system', 'project']``.
114114

115-
For example, consider the ``POST /servers/{server_id}/action (os-migrateLive)``
115+
For example, consider the ``GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}``
116116
API.
117117

118118
.. code::
119119
120-
# Live migrate a server to a new host without a reboot
121-
# POST /servers/{server_id}/action (os-migrateLive)
120+
# Show an extra spec for a flavor
121+
# GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
122122
# Intended scope(s): system, project
123-
#"os_compute_api:os-migrate-server:migrate_live": "rule:system_admin_api"
123+
#"os_compute_api:os-flavor-extra-specs:show": "rule:project_reader_or_admin"
124124
125125
These scope types provide a way to differentiate between system-level and
126126
project-level access roles. You can control the information with scope of the
@@ -212,11 +212,12 @@ Nova supported scope & Roles
212212
Nova supports the below combination of scopes and roles where roles can be
213213
overridden in the policy.yaml file but scope is not override-able.
214214

215-
#. SYSTEM_ADMIN: ``admin`` role on ``system`` scope
215+
#. ADMIN: ``admin`` role on ``system`` scope. This is System Administrator to
216+
perform the system level resource operations. Example: enable/disable compute
217+
services.
216218

217-
#. SYSTEM_READER: ``reader`` role on ``system`` scope
218-
219-
#. PROJECT_ADMIN: ``admin`` role on ``project`` scope
219+
#. PROJECT_ADMIN: ``admin`` role on ``project`` scope. This is used to perform
220+
admin level operation within project. For example: Live migrate server.
220221

221222
.. note::
222223

@@ -231,17 +232,18 @@ overridden in the policy.yaml file but scope is not override-able.
231232
via API. This limitation will be addressed in a future release.
232233

233234

234-
#. PROJECT_MEMBER: ``member`` role on ``project`` scope
235+
#. PROJECT_MEMBER: ``member`` role on ``project`` scope. This is used to perform
236+
resource owner level operation within project. For example: Pause a server.
237+
235238

236-
#. PROJECT_READER: ``reader`` role on ``project`` scope
239+
#. PROJECT_READER: ``reader`` role on ``project`` scope. This is used to perform
240+
read-only operation within project. For example: Get server.
237241

238-
#. PROJECT_MEMBER_OR_SYSTEM_ADMIN: ``admin`` role on ``system`` scope
239-
or ``member`` role on ``project`` scope. Such policy rules are scoped
240-
as both ``system`` as well as ``project``.
241242

242-
#. PROJECT_READER_OR_SYSTEM_READER: ``reader`` role on ``system`` scope
243-
or ``project`` scope. Such policy rules are scoped as both ``system``
244-
as well as ``project``.
243+
#. PROJECT_READER_OR_ADMIN: ``admin`` role on ``system`` scope
244+
or ``reader`` role on ``project`` scope. Such policy rules are scoped
245+
as both ``system`` as well as ``project``. Example: to allow system
246+
admin and project reader to list flavor extra specs.
245247

246248
.. note:: As of now, only ``system`` and ``project`` scopes are supported in Nova.
247249

@@ -252,8 +254,9 @@ Backward compatibility with versions prior to 21.0.0 (Ussuri) is maintained by
252254
supporting the old defaults and disabling the ``scope_type`` feature by default.
253255
This means the old defaults and deployments that use them will keep working
254256
as-is. However, we encourage every deployment to switch to new policy.
255-
``scope_type`` will be enabled by default and the old defaults will be removed
256-
starting in the 23.0.0 (W) release.
257+
Scope checks are disabled by default and will be enabled by default starting
258+
Nova 26.0.0 (OpenStack Zed release) and the old defaults will be removed
259+
starting in the Nova 27.0.0 release.
257260

258261
To implement the new default reader roles, some policies needed to become
259262
granular. They have been renamed, with the old names still supported for
@@ -323,9 +326,9 @@ Below table show how legacy rules are mapped to new rules:
323326
+====================+==================================+=================+===================+
324327
| | | *Roles* | *Scope* |
325328
| +----------------------------------+-----------------+-------------------+
326-
| | SYSTEM_ADMIN | admin | system |
329+
| | ADMIN | admin | system |
327330
| Project Admin +----------------------------------+-----------------+ |
328-
| Role | SYSTEM_READER | reader | |
331+
| Role | PROJECT_ADMIN | admin | project |
329332
| | | | |
330333
+--------------------+----------------------------------+-----------------+-------------------+
331334
| | PROJECT_ADMIN | admin | project |
@@ -334,12 +337,10 @@ Below table show how legacy rules are mapped to new rules:
334337
| +----------------------------------+-----------------+ |
335338
| Project admin or | PROJECT_READER | reader | |
336339
| owner role +----------------------------------+-----------------+-------------------+
337-
| | PROJECT_MEMBER_OR_SYSTEM_ADMIN | admin on system | system |
338-
| | | or member on | OR |
340+
| | PROJECT_READER_OR_ADMIN | admin on system | system |
341+
| | | or reader on | OR |
339342
| | | project | project |
340-
| +----------------------------------+-----------------+ |
341-
| | PROJECT_READER_OR_SYSTEM_READER | reader | |
342343
+--------------------+----------------------------------+-----------------+-------------------+
343344

344-
We expect all deployments to migrate to new policy by 23.0.0 release so that
345+
We expect all deployments to migrate to new policy by 27.0.0 release so that
345346
we can remove the support of old policies.

‎nova/cmd/status.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ def _check_policy(self):
279279
"2. Use a pre-existing sample config file from the Train "
280280
"release. 3. Use an empty or non-existent file to take all "
281281
"the defaults.")
282-
rule = "system_admin_api"
282+
rule = "context_is_admin"
283283
rule_new_default = "role:admin and system_scope:all"
284284
status = upgradecheck.Result(upgradecheck.Code.SUCCESS)
285285
# NOTE(gmann): Initialise the policy if it not initialized.

‎nova/policies/base.py‎

Lines changed: 13 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -36,43 +36,28 @@
3636
deprecated_reason=DEPRECATED_REASON,
3737
deprecated_since='21.0.0'
3838
)
39-
40-
# TODO(gmann): # Special string ``system_scope:all`` is added for system
41-
# scoped policies for backwards compatibility where ``nova.conf [oslo_policy]
42-
# enforce_scope = False``.
43-
# Otherwise, this might open up APIs to be more permissive unintentionally if a
44-
# deployment isn't enforcing scope. For example, the 'list all servers'
45-
# policy will be System Scoped Reader with ``role:reader`` and
46-
# scope_type=['system'] Until enforce_scope=True by default, it would
47-
# be possible for users with the ``reader`` role on a project to access the
48-
# 'list all servers' API. Once nova defaults ``nova.conf [oslo_policy]
49-
# enforce_scope=True``, the ``system_scope:all`` bits of these check strings
50-
# can be removed since that will be handled automatically by scope_types in
51-
# oslo.policy's RuleDefault objects.
52-
SYSTEM_ADMIN = 'rule:system_admin_api'
53-
SYSTEM_READER = 'rule:system_reader_api'
5439
PROJECT_ADMIN = 'rule:project_admin_api'
5540
PROJECT_MEMBER = 'rule:project_member_api'
5641
PROJECT_READER = 'rule:project_reader_api'
57-
PROJECT_MEMBER_OR_SYSTEM_ADMIN = 'rule:system_admin_or_owner'
58-
PROJECT_READER_OR_SYSTEM_READER = 'rule:system_or_project_reader'
5942
PROJECT_READER_OR_ADMIN = 'rule:project_reader_or_admin'
6043
ADMIN = 'rule:context_is_admin'
6144

6245
# NOTE(gmann): Below is the mapping of new roles and scope_types
6346
# with legacy roles::
6447

65-
# Legacy Rule | New Rules |Operation |scope_type|
66-
# -------------------+----------------------------------+----------+-----------
67-
# |-> SYSTEM_ADMIN |Global | [system]
68-
# RULE_ADMIN_API | Write
69-
# |-> SYSTEM_READER |Global | [system]
70-
# | |Read |
71-
#
72-
# |-> PROJECT_MEMBER_OR_SYSTEM_ADMIN |Project | [system,
73-
# RULE_ADMIN_OR_OWNER| |Write | project]
74-
# |-> PROJECT_READER_OR_SYSTEM_READER|Project | [system,
75-
# |Read | project]
48+
# Legacy Rule | New Rules |Operation |scope_type|
49+
# -------------------+---------------------+----------------+-----------
50+
# |-> ADMIN |Global resource | [system]
51+
# RULE_ADMIN_API | |Write & Read |
52+
# |-> PROJECT_ADMIN |Project resource| [project]
53+
# | |Write |
54+
# ----------------------------------------------------------------------
55+
# |-> PROJECT_ADMIN |Project resource| [project]
56+
# | |Write |
57+
# |-> PROJECT_MEMBER |Project resource| [project]
58+
# RULE_ADMIN_OR_OWNER| |Write |
59+
# |-> PROJECT_READER |Project resource| [project]
60+
# | |Read |
7661

7762
# NOTE(johngarbutt) The base rules here affect so many APIs the list
7863
# of related API operations has not been populated. It would be
@@ -106,16 +91,6 @@
10691
deprecated_for_removal=True,
10792
deprecated_reason=DEPRECATED_REASON,
10893
deprecated_since='21.0.0'),
109-
policy.RuleDefault(
110-
name="system_admin_api",
111-
check_str='role:admin and system_scope:all',
112-
description="Default rule for System Admin APIs.",
113-
deprecated_rule=DEPRECATED_ADMIN_POLICY),
114-
policy.RuleDefault(
115-
name="system_reader_api",
116-
check_str="role:reader and system_scope:all",
117-
description="Default rule for System level read only APIs.",
118-
deprecated_rule=DEPRECATED_ADMIN_POLICY),
11994
policy.RuleDefault(
12095
"project_admin_api",
12196
"role:admin and project_id:%(project_id)s",
@@ -131,16 +106,6 @@
131106
"role:reader and project_id:%(project_id)s",
132107
"Default rule for Project level read only APIs.",
133108
deprecated_rule=DEPRECATED_ADMIN_OR_OWNER_POLICY),
134-
policy.RuleDefault(
135-
name="system_admin_or_owner",
136-
check_str="rule:system_admin_api or rule:project_member_api",
137-
description="Default rule for System admin+owner APIs.",
138-
deprecated_rule=DEPRECATED_ADMIN_OR_OWNER_POLICY),
139-
policy.RuleDefault(
140-
"system_or_project_reader",
141-
"rule:system_reader_api or rule:project_reader_api",
142-
"Default rule for System+Project read only APIs.",
143-
deprecated_rule=DEPRECATED_ADMIN_OR_OWNER_POLICY),
144109
policy.RuleDefault(
145110
"project_reader_or_admin",
146111
"rule:project_reader_api or rule:context_is_admin",

‎nova/tests/unit/cmd/test_status.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ class TestUpgradeCheckPolicy(test.NoDBTestCase):
401401
def setUp(self):
402402
super(TestUpgradeCheckPolicy, self).setUp()
403403
self.cmd = status.UpgradeCommands()
404-
self.rule_name = "system_admin_api"
404+
self.rule_name = "context_is_admin"
405405

406406
def tearDown(self):
407407
super(TestUpgradeCheckPolicy, self).tearDown()

‎nova/tests/unit/policies/base.py‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class BasePolicyTest(test.TestCase):
5353
# For Example:
5454
# rules_without_deprecation{
5555
# "os_compute_api:os-deferred-delete:restore":
56-
# "rule:system_admin_or_owner"}
56+
# "rule:project_admin_api"}
5757
rules_without_deprecation = {}
5858

5959
def setUp(self):
@@ -141,14 +141,6 @@ def setUp(self):
141141
self.rules_without_deprecation.update({
142142
"context_is_admin":
143143
"role:admin",
144-
"system_admin_or_owner":
145-
"rule:system_admin_api or rule:project_member_api",
146-
"system_or_project_reader":
147-
"rule:system_reader_api or rule:project_reader_api",
148-
"system_admin_api":
149-
"role:admin and system_scope:all",
150-
"system_reader_api":
151-
"role:reader and system_scope:all",
152144
"project_reader_or_admin":
153145
"rule:project_reader_api or rule:context_is_admin",
154146
"project_admin_api":

‎nova/tests/unit/policies/test_extensions.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ def setUp(self):
7575

7676
class ExtensionsNoLegacyPolicyTest(ExtensionsScopeTypePolicyTest):
7777
"""Test Extensions APIs policies with system scope enabled,
78-
and no more deprecated rules that allow the legacy admin API to
79-
access system_admin_or_owner APIs.
78+
and no more deprecated rules.
8079
"""
8180
without_deprecated_rules = True

‎nova/tests/unit/policies/test_servers.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414

1515
import fixtures
1616
import mock
17-
from oslo_log import log as logging
1817
from oslo_utils.fixture import uuidsentinel as uuids
1918
from oslo_utils import timeutils
2019

@@ -38,7 +37,6 @@
3837
from nova.tests.unit.policies import base
3938

4039
CONF = nova.conf.CONF
41-
LOG = logging.getLogger(__name__)
4240

4341

4442
class ServersPolicyTest(base.BasePolicyTest):

‎nova/tests/unit/test_policy.py‎

Lines changed: 34 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,26 @@ def setUp(self):
366366
"os_compute_api:os-server-external-events:create",
367367
"os_compute_api:os-volumes-attachments:swap",
368368
"os_compute_api:servers:create:zero_disk_flavor",
369+
"os_compute_api:os-baremetal-nodes:list",
370+
"os_compute_api:os-baremetal-nodes:show",
371+
"os_compute_api:servers:migrations:index",
372+
"os_compute_api:servers:migrations:show",
373+
"os_compute_api:os-simple-tenant-usage:list",
374+
"os_compute_api:os-migrations:index",
375+
"os_compute_api:os-services:list",
376+
"os_compute_api:os-instance-actions:events:details",
377+
"os_compute_api:os-instance-usage-audit-log:list",
378+
"os_compute_api:os-instance-usage-audit-log:show",
379+
"os_compute_api:os-hosts:list",
380+
"os_compute_api:os-hosts:show",
381+
"os_compute_api:os-hypervisors:list",
382+
"os_compute_api:os-hypervisors:list-detail",
383+
"os_compute_api:os-hypervisors:show",
384+
"os_compute_api:os-hypervisors:statistics",
385+
"os_compute_api:os-hypervisors:uptime",
386+
"os_compute_api:os-hypervisors:search",
387+
"os_compute_api:os-hypervisors:servers",
388+
"os_compute_api:limits:other_project",
369389
)
370390

371391
self.admin_or_owner_rules = (
@@ -455,44 +475,6 @@ def setUp(self):
455475
"os_compute_api:os-volumes-attachments:create",
456476
"os_compute_api:os-volumes-attachments:delete",
457477
"os_compute_api:os-volumes-attachments:update",
458-
)
459-
460-
self.allow_all_rules = (
461-
"os_compute_api:os-quota-sets:defaults",
462-
"os_compute_api:os-availability-zone:list",
463-
"os_compute_api:limits",
464-
"os_compute_api:extensions",
465-
"os_compute_api:os-floating-ip-pools",
466-
)
467-
468-
self.system_reader_rules = (
469-
"os_compute_api:os-tenant-networks:list",
470-
"os_compute_api:os-tenant-networks:show",
471-
"os_compute_api:os-baremetal-nodes:list",
472-
"os_compute_api:os-baremetal-nodes:show",
473-
"os_compute_api:servers:migrations:index",
474-
"os_compute_api:servers:migrations:show",
475-
"os_compute_api:os-simple-tenant-usage:list",
476-
"os_compute_api:os-migrations:index",
477-
"os_compute_api:os-services:list",
478-
"os_compute_api:os-instance-actions:events:details",
479-
"os_compute_api:os-instance-usage-audit-log:list",
480-
"os_compute_api:os-instance-usage-audit-log:show",
481-
"os_compute_api:os-hosts:list",
482-
"os_compute_api:os-hosts:show",
483-
"os_compute_api:os-hypervisors:list",
484-
"os_compute_api:os-hypervisors:list-detail",
485-
"os_compute_api:os-hypervisors:show",
486-
"os_compute_api:os-hypervisors:statistics",
487-
"os_compute_api:os-hypervisors:uptime",
488-
"os_compute_api:os-hypervisors:search",
489-
"os_compute_api:os-hypervisors:servers",
490-
"os_compute_api:limits:other_project",
491-
"os_compute_api:os-networks:list",
492-
"os_compute_api:os-networks:show",
493-
)
494-
495-
self.system_reader_or_owner_rules = (
496478
"os_compute_api:os-simple-tenant-usage:show",
497479
"os_compute_api:os-security-groups:get",
498480
"os_compute_api:os-security-groups:show",
@@ -514,6 +496,18 @@ def setUp(self):
514496
"os_compute_api:os-volumes:snapshots:show",
515497
"os_compute_api:os-volumes:snapshots:list",
516498
"os_compute_api:os-volumes:snapshots:detail",
499+
"os_compute_api:os-networks:list",
500+
"os_compute_api:os-networks:show",
501+
"os_compute_api:os-tenant-networks:list",
502+
"os_compute_api:os-tenant-networks:show",
503+
)
504+
505+
self.allow_all_rules = (
506+
"os_compute_api:os-quota-sets:defaults",
507+
"os_compute_api:os-availability-zone:list",
508+
"os_compute_api:limits",
509+
"os_compute_api:extensions",
510+
"os_compute_api:os-floating-ip-pools",
517511
)
518512

519513
self.allow_nobody_rules = (
@@ -558,13 +552,10 @@ def test_rule_missing(self):
558552
# admin_only, non_admin, admin_or_user, empty_rule
559553
special_rules = ('admin_api', 'admin_or_owner', 'context_is_admin',
560554
'os_compute_api:os-quota-class-sets:show',
561-
'system_admin_api', 'system_reader_api',
562555
'project_admin_api', 'project_member_api',
563-
'project_reader_api', 'system_admin_or_owner',
564-
'system_or_project_reader', 'project_reader_or_admin')
556+
'project_reader_api', 'project_reader_or_admin')
565557
result = set(rules.keys()) - set(self.admin_only_rules +
566558
self.admin_or_owner_rules +
567-
self.allow_all_rules + self.system_reader_rules +
568-
self.system_reader_or_owner_rules +
559+
self.allow_all_rules +
569560
self.allow_nobody_rules + special_rules)
570561
self.assertEqual(set([]), result)

0 commit comments

Comments
 (0)