policy.yaml¶

glance¶

default

Default:

<empty string>

Defines the default rule used for policies that historically had an empty policy in the supplied policy.json file.

context_is_admin

Default:

role:admin

Defines the rule for the is_admin:True check.

add_image

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)

Operations:

• POST /v2/images

Scope Types:

• project

Create new image

delete_image

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/images/{image_id}

Scope Types:

• project

Deletes the image

get_image

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))

Operations:

• GET /v2/images/{image_id}

Scope Types:

• project

Get specified image

get_images

Default:

rule:context_is_admin or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/images

Scope Types:

• project

Get all available images

modify_image

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• PATCH /v2/images/{image_id}

Scope Types:

• project

Updates given image

publicize_image

Default:

rule:context_is_admin

Operations:

• PATCH /v2/images/{image_id}

Scope Types:

• project

Publicize given image

communitize_image

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• PATCH /v2/images/{image_id}

Scope Types:

• project

Communitize given image

download_image

Default:

rule:context_is_admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))

Operations:

• GET /v2/images/{image_id}/file

Scope Types:

• project

Downloads given image

upload_image

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• PUT /v2/images/{image_id}/file

Scope Types:

• project

Uploads data to specified image

delete_image_location

Default:

rule:context_is_admin

Operations:

• PATCH /v2/images/{image_id}

Scope Types:

• project

Deletes the location of given image

get_image_location

Default:

rule:context_is_admin or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/images/{image_id}

Scope Types:

• project

Reads the location of the image

set_image_location

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• PATCH /v2/images/{image_id}

Scope Types:

• project

Sets location URI to given image

add_member

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/images/{image_id}/members

Scope Types:

• project

Create image member

delete_member

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/images/{image_id}/members/{member_id}

Scope Types:

• project

Delete image member

get_member

Default:

rule:context_is_admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)

Operations:

• GET /v2/images/{image_id}/members/{member_id}

Scope Types:

• project

Show image member details

get_members

Default:

rule:context_is_admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)

Operations:

• GET /v2/images/{image_id}/members

Scope Types:

• project

List image members

modify_member

Default:

rule:context_is_admin or (role:member and project_id:%(member_id)s)

Operations:

• PUT /v2/images/{image_id}/members/{member_id}

Scope Types:

• project

Update image member

manage_image_cache

Default:

rule:context_is_admin

Scope Types:

• project

Manage image cache

deactivate

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/images/{image_id}/actions/deactivate

Scope Types:

• project

Deactivate image

reactivate

Default:

rule:context_is_admin or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/images/{image_id}/actions/reactivate

Scope Types:

• project

Reactivate image

copy_image

Default:

rule:context_is_admin

Operations:

• POST /v2/images/{image_id}/import

Scope Types:

• project

Copy existing image to other stores

get_task

Default:

rule:default

Operations:

• GET /v2/tasks/{task_id}

Scope Types:

• project

Get an image task.

This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.

get_tasks

Default:

rule:default

Operations:

• GET /v2/tasks

Scope Types:

• project

List tasks for all images.

This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.

add_task

Default:

rule:default

Operations:

• POST /v2/tasks

Scope Types:

• project

List tasks for all images.

This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.

modify_task

Default:

rule:default

Operations:

• DELETE /v2/tasks/{task_id}

Scope Types:

• project

This policy is not used.

tasks_api_access

Default:

rule:context_is_admin

Operations:

• GET /v2/tasks/{task_id}

• GET /v2/tasks

• POST /v2/tasks

• DELETE /v2/tasks/{task_id}

Scope Types:

• project

This is a generic blanket policy for protecting all task APIs. It is not granular and will not allow you to separate writable and readable task operations into different roles.

metadef_default

Default:

<empty string>

(no description provided)

metadef_admin

Default:

rule:context_is_admin

(no description provided)

get_metadef_namespace

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}

Scope Types:

• project

Get a specific namespace.

get_metadef_namespaces

Default:

rule:context_is_admin or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/metadefs/namespaces

Scope Types:

• project

List namespace.

modify_metadef_namespace

Default:

rule:metadef_admin

Operations:

• PUT /v2/metadefs/namespaces/{namespace_name}

Scope Types:

• project

Modify an existing namespace.

add_metadef_namespace

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces

Scope Types:

• project

Create a namespace.

delete_metadef_namespace

Default:

rule:metadef_admin

Operations:

• DELETE /v2/metadefs/namespaces/{namespace_name}

Scope Types:

• project

Delete a namespace.

get_metadef_object

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/objects/{object_name}

Scope Types:

• project

Get a specific object from a namespace.

get_metadef_objects

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/objects

Scope Types:

• project

Get objects from a namespace.

modify_metadef_object

Default:

rule:metadef_admin

Operations:

• PUT /v2/metadefs/namespaces/{namespace_name}/objects/{object_name}

Scope Types:

• project

Update an object within a namespace.

add_metadef_object

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/objects

Scope Types:

• project

Create an object within a namespace.

delete_metadef_object

Default:

rule:metadef_admin

Operations:

• DELETE /v2/metadefs/namespaces/{namespace_name}/objects/{object_name}

Scope Types:

• project

Delete an object within a namespace.

list_metadef_resource_types

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/resource_types

Scope Types:

• project

List meta definition resource types.

get_metadef_resource_type

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/resource_types

Scope Types:

• project

Get meta definition resource types associations.

add_metadef_resource_type_association

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/resource_types

Scope Types:

• project

Create meta definition resource types association.

remove_metadef_resource_type_association

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/resource_types/{name}

Scope Types:

• project

Delete meta definition resource types association.

get_metadef_property

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/properties/{property_name}

Scope Types:

• project

Get a specific meta definition property.

get_metadef_properties

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/properties

Scope Types:

• project

List meta definition properties.

modify_metadef_property

Default:

rule:metadef_admin

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/properties/{property_name}

Scope Types:

• project

Update meta definition property.

add_metadef_property

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/properties

Scope Types:

• project

Create meta definition property.

remove_metadef_property

Default:

rule:metadef_admin

Operations:

• DELETE /v2/metadefs/namespaces/{namespace_name}/properties/{property_name}

Scope Types:

• project

Delete meta definition property.

get_metadef_tag

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}

Scope Types:

• project

Get tag definition.

get_metadef_tags

Default:

rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))

Operations:

• GET /v2/metadefs/namespaces/{namespace_name}/tags

Scope Types:

• project

List tag definitions.

modify_metadef_tag

Default:

rule:metadef_admin

Operations:

• PUT /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}

Scope Types:

• project

Update tag definition.

add_metadef_tag

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}

Scope Types:

• project

Add tag definition.

add_metadef_tags

Default:

rule:metadef_admin

Operations:

• POST /v2/metadefs/namespaces/{namespace_name}/tags

Scope Types:

• project

Create tag definitions.

delete_metadef_tag

Default:

rule:metadef_admin

Operations:

• DELETE /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}

Scope Types:

• project

Delete tag definition.

delete_metadef_tags

Default:

rule:metadef_admin

Operations:

• DELETE /v2/metadefs/namespaces/{namespace_name}/tags

Scope Types:

• project

Delete tag definitions.

cache_image

Default:

rule:context_is_admin

Operations:

• PUT /v2/cache/{image_id}

Scope Types:

• project

Queue image for caching

cache_list

Default:

rule:context_is_admin

Operations:

• GET /v2/cache

Scope Types:

• project

List cache status

cache_delete

Default:

rule:context_is_admin

Operations:

• DELETE /v2/cache

• DELETE /v2/cache/{image_id}

Scope Types:

• project

Delete image(s) from cache and/or queue

stores_info_detail

Default:

rule:context_is_admin

Operations:

• GET /v2/info/stores/detail

Scope Types:

• project

Expose store specific information