Skip to content

Commit fa8f481

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Server actions APIs scoped to project scope"
2 parents 2b88b6a + 20a07ee commit fa8f481

21 files changed

+508
-499
lines changed

‎nova/api/openstack/compute/shelve.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,11 @@ def _shelve(self, req, id, body):
6464
def _shelve_offload(self, req, id, body):
6565
"""Force removal of a shelved instance from the compute node."""
6666
context = req.environ["nova.context"]
67-
context.can(shelve_policies.POLICY_ROOT % 'shelve_offload')
68-
6967
instance = common.get_instance(self.compute_api, context, id)
68+
context.can(shelve_policies.POLICY_ROOT % 'shelve_offload',
69+
target={'user_id': instance.user_id,
70+
'project_id': instance.project_id})
71+
7072
try:
7173
self.compute_api.shelve_offload(context, instance)
7274
except exception.InstanceIsLocked as e:

‎nova/policies/admin_actions.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,26 +24,26 @@
2424
admin_actions_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'reset_state',
27-
check_str=base.SYSTEM_ADMIN,
27+
check_str=base.PROJECT_ADMIN,
2828
description="Reset the state of a given server",
2929
operations=[
3030
{
3131
'method': 'POST',
3232
'path': '/servers/{server_id}/action (os-resetState)'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'inject_network_info',
38-
check_str=base.SYSTEM_ADMIN,
38+
check_str=base.PROJECT_ADMIN,
3939
description="Inject network information into the server",
4040
operations=[
4141
{
4242
'method': 'POST',
4343
'path': '/servers/{server_id}/action (injectNetworkInfo)'
4444
}
4545
],
46-
scope_types=['system', 'project']),
46+
scope_types=['project']),
4747
]
4848

4949

‎nova/policies/admin_password.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@
2424
admin_password_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Change the administrative password for a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (changePassword)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project'])
35+
scope_types=['project'])
3636
]
3737

3838

‎nova/policies/evacuate.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@
2424
evacuate_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.SYSTEM_ADMIN,
27+
check_str=base.PROJECT_ADMIN,
2828
description="Evacuate a server from a failed host to a new host",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (evacuate)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
]
3737

3838

‎nova/policies/lock_server.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,31 +24,31 @@
2424
lock_server_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'lock',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Lock a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (lock)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']
35+
scope_types=['project']
3636
),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'unlock',
39-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
39+
check_str=base.PROJECT_MEMBER,
4040
description="Unlock a server",
4141
operations=[
4242
{
4343
'path': '/servers/{server_id}/action (unlock)',
4444
'method': 'POST'
4545
}
4646
],
47-
scope_types=['system', 'project']
47+
scope_types=['project']
4848
),
4949
policy.DocumentedRuleDefault(
5050
name=POLICY_ROOT % 'unlock:unlock_override',
51-
check_str=base.SYSTEM_ADMIN,
51+
check_str=base.PROJECT_ADMIN,
5252
description="""Unlock a server, regardless who locked the server.
5353
5454
This check is performed only after the check
@@ -59,7 +59,7 @@
5959
'method': 'POST'
6060
}
6161
],
62-
scope_types=['system', 'project']
62+
scope_types=['project']
6363
),
6464
]
6565

‎nova/policies/multinic.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
multinic_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=BASE_POLICY_NAME % 'add',
41-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
41+
check_str=base.PROJECT_MEMBER,
4242
description="""Add a fixed IP address to a server.
4343
4444
This API is proxy calls to the Network service. This is
@@ -49,11 +49,11 @@
4949
'path': '/servers/{server_id}/action (addFixedIp)'
5050
}
5151
],
52-
scope_types=['system', 'project'],
52+
scope_types=['project'],
5353
deprecated_rule=DEPRECATED_POLICY),
5454
policy.DocumentedRuleDefault(
5555
name=BASE_POLICY_NAME % 'remove',
56-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
56+
check_str=base.PROJECT_MEMBER,
5757
description="""Remove a fixed IP address from a server.
5858
5959
This API is proxy calls to the Network service. This is
@@ -64,7 +64,7 @@
6464
'path': '/servers/{server_id}/action (removeFixedIp)'
6565
}
6666
],
67-
scope_types=['system', 'project'],
67+
scope_types=['project'],
6868
deprecated_rule=DEPRECATED_POLICY),
6969
]
7070

‎nova/policies/pause_server.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,27 +24,27 @@
2424
pause_server_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'pause',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Pause a server",
2929
operations=[
3030
{
3131
'path': '/servers/{server_id}/action (pause)',
3232
'method': 'POST'
3333
}
3434
],
35-
scope_types=['system', 'project']
35+
scope_types=['project']
3636
),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'unpause',
39-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
39+
check_str=base.PROJECT_MEMBER,
4040
description="Unpause a paused server",
4141
operations=[
4242
{
4343
'path': '/servers/{server_id}/action (unpause)',
4444
'method': 'POST'
4545
}
4646
],
47-
scope_types=['system', 'project']
47+
scope_types=['project']
4848
),
4949
]
5050

‎nova/policies/remote_consoles.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
remote_consoles_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=BASE_POLICY_NAME,
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="""Generate a URL to access remove server console.
2929
3030
This policy is for ``POST /remote-consoles`` API and below Server actions APIs
@@ -56,7 +56,7 @@
5656
'path': '/servers/{server_id}/remote-consoles'
5757
},
5858
],
59-
scope_types=['system', 'project']),
59+
scope_types=['project']),
6060
]
6161

6262

‎nova/policies/rescue.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,26 +37,26 @@
3737
rescue_policies = [
3838
policy.DocumentedRuleDefault(
3939
name=BASE_POLICY_NAME,
40-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
40+
check_str=base.PROJECT_MEMBER,
4141
description="Rescue a server",
4242
operations=[
4343
{
4444
'path': '/servers/{server_id}/action (rescue)',
4545
'method': 'POST'
4646
},
4747
],
48-
scope_types=['system', 'project']),
48+
scope_types=['project']),
4949
policy.DocumentedRuleDefault(
5050
name=UNRESCUE_POLICY_NAME,
51-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
51+
check_str=base.PROJECT_MEMBER,
5252
description="Unrescue a server",
5353
operations=[
5454
{
5555
'path': '/servers/{server_id}/action (unrescue)',
5656
'method': 'POST'
5757
}
5858
],
59-
scope_types=['system', 'project'],
59+
scope_types=['project'],
6060
deprecated_rule=DEPRECATED_POLICY
6161
),
6262
]

‎nova/policies/shelve.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,37 +24,37 @@
2424
shelve_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'shelve',
27-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
27+
check_str=base.PROJECT_MEMBER,
2828
description="Shelve server",
2929
operations=[
3030
{
3131
'method': 'POST',
3232
'path': '/servers/{server_id}/action (shelve)'
3333
}
3434
],
35-
scope_types=['system', 'project']),
35+
scope_types=['project']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'unshelve',
38-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
38+
check_str=base.PROJECT_MEMBER,
3939
description="Unshelve (restore) shelved server",
4040
operations=[
4141
{
4242
'method': 'POST',
4343
'path': '/servers/{server_id}/action (unshelve)'
4444
}
4545
],
46-
scope_types=['system', 'project']),
46+
scope_types=['project']),
4747
policy.DocumentedRuleDefault(
4848
name=POLICY_ROOT % 'shelve_offload',
49-
check_str=base.SYSTEM_ADMIN,
49+
check_str=base.PROJECT_ADMIN,
5050
description="Shelf-offload (remove) server",
5151
operations=[
5252
{
5353
'method': 'POST',
5454
'path': '/servers/{server_id}/action (shelveOffload)'
5555
}
5656
],
57-
scope_types=['system', 'project']),
57+
scope_types=['project']),
5858
]
5959

6060

0 commit comments

Comments
 (0)