Policy Documentation

updated: 2020-07-07 15:13

Policy Documentation

The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.

designate

admin
Default:role:admin or is_admin:True

(no description provided)

primary_zone
Default:target.zone_type:SECONDARY

(no description provided)

owner
Default:tenant:%(tenant_id)s

(no description provided)

admin_or_owner
Default:rule:admin or rule:owner

(no description provided)

default
Default:rule:admin_or_owner

(no description provided)

target
Default:tenant:%(target_tenant_id)s

(no description provided)

owner_or_target
Default:rule:target or rule:owner

(no description provided)

admin_or_owner_or_target
Default:rule:owner_or_target or rule:admin

(no description provided)

admin_or_target
Default:rule:admin or rule:target

(no description provided)

zone_primary_or_admin
Default:('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

(no description provided)

create_blacklist
Default:

rule:admin
Operations:
  • POST /v2/blacklists

Create blacklist.

find_blacklist
Default:

rule:admin
Operations:
  • GET /v2/blacklists

Find blacklist.

find_blacklists
Default:

rule:admin
Operations:
  • GET /v2/blacklists

Find blacklists.

get_blacklist
Default:

rule:admin
Operations:
  • GET /v2/blacklists/{blacklist_id}

Get blacklist.

update_blacklist
Default:

rule:admin
Operations:
  • PATCH /v2/blacklists/{blacklist_id}

Update blacklist.

delete_blacklist
Default:

rule:admin
Operations:
  • DELETE /v2/blacklists/{blacklist_id}

Delete blacklist.

use_blacklisted_zone
Default:

rule:admin
Operations:
  • POST /v2/zones

Allowed bypass the blacklist.

all_tenants
Default:rule:admin

Action on all tenants.

edit_managed_records
Default:rule:admin

Edit managed records.

use_low_ttl
Default:rule:admin

Use low TTL.

use_sudo
Default:rule:admin

Accept sudo from user to tenant.

diagnostics_ping
Default:rule:admin

Diagnose ping.

diagnostics_sync_zones
Default:rule:admin

Diagnose sync zones.

diagnostics_sync_zone
Default:rule:admin

Diagnose sync zone.

diagnostics_sync_record
Default:rule:admin

Diagnose sync record.

create_pool
Default:rule:admin

Create pool.

find_pools
Default:

rule:admin
Operations:
  • GET /v2/pools

Find pool.

find_pool
Default:

rule:admin
Operations:
  • GET /v2/pools

Find pools.

get_pool
Default:

rule:admin
Operations:
  • GET /v2/pools/{pool_id}

Get pool.

update_pool
Default:rule:admin

Update pool.

delete_pool
Default:rule:admin

Delete pool.

zone_create_forced_pool
Default:

rule:admin
Operations:
  • POST /v2/zones

load and set the pool to the one provided in the Zone attributes.

get_quotas
Default:

rule:admin_or_owner
Operations:
  • GET /v2/quotas

View Current Project’s Quotas.

get_quota
Default:rule:admin_or_owner

(no description provided)

set_quota
Default:

rule:admin
Operations:
  • PATCH /v2/quotas/{project_id}

Set Quotas.

reset_quotas
Default:

rule:admin
Operations:
  • DELETE /v2/quotas/{project_id}

Reset Quotas.

find_records
Default:

rule:admin_or_owner
Operations:
  • GET /v2/reverse/floatingips/{region}:{floatingip_id}
  • GET /v2/reverse/floatingips

Find records.

count_records
Default:rule:admin_or_owner

(no description provided)

create_recordset
Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations:
  • POST /v2/zones/{zone_id}/recordsets
  • PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Create Recordset

get_recordsets
Default:rule:admin_or_owner

(no description provided)

get_recordset
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/{zone_id}/recordsets/{recordset_id}
  • DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}
  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Get recordset

update_recordset
Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations:
  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
  • PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Update recordset

delete_recordset
Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations:
  • DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}

Delete RecordSet

count_recordset
Default:rule:admin_or_owner

Count recordsets

find_service_status
Default:

rule:admin
Operations:
  • GET /v2/service_status/{service_id}

Find a single Service Status

find_service_statuses
Default:

rule:admin
Operations:
  • GET /v2/service_status

List service statuses.

update_service_status
Default:rule:admin

(no description provided)

find_tenants
Default:rule:admin

Find all Tenants.

get_tenant
Default:rule:admin

Get all Tenants.

count_tenants
Default:rule:admin

Count tenants

create_tld
Default:

rule:admin
Operations:
  • POST /v2/tlds

Create Tld

find_tlds
Default:

rule:admin
Operations:
  • GET /v2/tlds

List Tlds

get_tld
Default:

rule:admin
Operations:
  • GET /v2/tlds/{tld_id}

Show Tld

update_tld
Default:

rule:admin
Operations:
  • PATCH /v2/tlds/{tld_id}

Update Tld

delete_tld
Default:

rule:admin
Operations:
  • DELETE /v2/tlds/{tld_id}

Delete Tld

create_tsigkey
Default:

rule:admin
Operations:
  • POST /v2/tsigkeys

Create Tsigkey

find_tsigkeys
Default:

rule:admin
Operations:
  • GET /v2/tsigkeys

List Tsigkeys

get_tsigkey
Default:

rule:admin
Operations:
  • PATCH /v2/tsigkeys/{tsigkey_id}
  • GET /v2/tsigkeys/{tsigkey_id}

Show a Tsigkey

update_tsigkey
Default:

rule:admin
Operations:
  • PATCH /v2/tsigkeys/{tsigkey_id}

Update Tsigkey

delete_tsigkey
Default:

rule:admin
Operations:
  • DELETE /v2/tsigkeys/{tsigkey_id}

Delete a Tsigkey

create_zone
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones

Create Zone

get_zones
Default:rule:admin_or_owner

(no description provided)

get_zone
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/{zone_id}
  • PATCH /v2/zones/{zone_id}
  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Get Zone

get_zone_servers
Default:rule:admin_or_owner

(no description provided)

find_zones
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones

List existing zones

update_zone
Default:

rule:admin_or_owner
Operations:
  • PATCH /v2/zones/{zone_id}

Update Zone

delete_zone
Default:

rule:admin_or_owner
Operations:
  • DELETE /v2/zones/{zone_id}

Delete Zone

xfr_zone
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/{zone_id}/tasks/xfr

Manually Trigger an Update of a Secondary Zone

abandon_zone
Default:

rule:admin
Operations:
  • POST /v2/zones/{zone_id}/tasks/abandon

Abandon Zone

count_zones
Default:rule:admin_or_owner

(no description provided)

count_zones_pending_notify
Default:rule:admin_or_owner

(no description provided)

purge_zones
Default:rule:admin

(no description provided)

touch_zone
Default:rule:admin_or_owner

(no description provided)

zone_export
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/exports/{zone_export_id}/export

Retrive a Zone Export from the Designate Datastore

create_zone_export
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/{zone_id}/tasks/export

Create Zone Export

find_zone_exports
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/exports

List Zone Exports

get_zone_export
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/exports/{zone_export_id}
  • GET /v2/zones/tasks/exports/{zone_export_id}/export

Get Zone Exports

update_zone_export
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/{zone_id}/tasks/export

Update Zone Exports

create_zone_import
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/tasks/imports

Create Zone Import

find_zone_imports
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/imports

List all Zone Imports

get_zone_import
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/imports/{zone_import_id}

Get Zone Imports

update_zone_import
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/tasks/imports

Update Zone Imports

delete_zone_import
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/imports/{zone_import_id}

Delete a Zone Import

create_zone_transfer_accept
Default:

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
Operations:
  • POST /v2/zones/tasks/transfer_accepts

Create Zone Transfer Accept

get_zone_transfer_accept
Default:

rule:admin_or_owner
Operations:
  • GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}

Get Zone Transfer Accept

find_zone_transfer_accepts
Default:

rule:admin
Operations:
  • GET /v2/zones/tasks/transfer_accepts

List Zone Transfer Accepts

find_zone_transfer_accept
Default:rule:admin

(no description provided)

update_zone_transfer_accept
Default:

rule:admin
Operations:
  • POST /v2/zones/tasks/transfer_accepts

Update a Zone Transfer Accept

delete_zone_transfer_accept
Default:rule:admin

(no description provided)

create_zone_transfer_request
Default:

rule:admin_or_owner
Operations:
  • POST /v2/zones/{zone_id}/tasks/transfer_requests

Create Zone Transfer Accept

get_zone_transfer_request
Default:

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
Operations:
  • GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
  • PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Show a Zone Transfer Request

get_zone_transfer_request_detailed
Default:rule:admin_or_owner

(no description provided)

find_zone_transfer_requests
Default:

@
Operations:
  • GET /v2/zones/tasks/transfer_requests

List Zone Transfer Requests

find_zone_transfer_request
Default:@

(no description provided)

update_zone_transfer_request
Default:

rule:admin_or_owner
Operations:
  • PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Update a Zone Transfer Request

delete_zone_transfer_request
Default:

rule:admin_or_owner
Operations:
  • DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Delete a Zone Transfer Request

updated: 2020-07-07 15:13
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug questions?