Policy configuration¶

magnum¶

context_is_admin

Default:	role:admin

(no description provided)

admin_or_owner

Default:	is_admin:True or project_id:%(project_id)s

(no description provided)

admin_api

Default:	rule:context_is_admin

(no description provided)

admin_or_user

Default:	is_admin:True or user_id:%(user_id)s

(no description provided)

cluster_user

Default:	user_id:%(trustee_user_id)s

(no description provided)

deny_cluster_user

Default:	not domain_id:%(trustee_domain_id)s

(no description provided)

bay:create

Default:	rule:deny_cluster_user
Operations:	POST /v1/bays

Create a new bay.

bay:delete

Default:	rule:deny_cluster_user
Operations:	DELETE /v1/bays/{bay_ident}

Delete a bay.

bay:detail

Default:	rule:deny_cluster_user
Operations:	GET /v1/bays

Retrieve a list of bays with detail.

bay:get

Default:	rule:deny_cluster_user
Operations:	GET /v1/bays/{bay_ident}

Retrieve information about the given bay.

bay:get_all

Default:	rule:deny_cluster_user
Operations:	GET /v1/bays/

Retrieve a list of bays.

bay:update

Default:	rule:deny_cluster_user
Operations:	PATCH /v1/bays/{bay_ident}

Update an existing bay.

baymodel:create

Default:	rule:deny_cluster_user
Operations:	POST /v1/baymodels

Create a new baymodel.

baymodel:delete

Default:	rule:deny_cluster_user
Operations:	DELETE /v1/baymodels/{baymodel_ident}

Delete a baymodel.

baymodel:detail

Default:	rule:deny_cluster_user
Operations:	GET /v1/baymodels

Retrieve a list of baymodel with detail.

baymodel:get

Default:	rule:deny_cluster_user
Operations:	GET /v1/baymodels/{baymodel_ident}

Retrieve information about the given baymodel.

baymodel:get_all

Default:	rule:deny_cluster_user
Operations:	GET /v1/baymodels

Retrieve a list of baymodel.

baymodel:update

Default:	rule:deny_cluster_user
Operations:	PATCH /v1/baymodels/{baymodel_ident}

Update an existing baymodel.

baymodel:publish

Default:	rule:admin_api
Operations:	POST /v1/baymodels PATCH /v1/baymodels

Publish an existing baymodel.

certificate:create

Default:	rule:admin_or_user or rule:cluster_user
Operations:	POST /v1/certificates

Sign a new certificate by the CA.

certificate:get

Default:	rule:admin_or_user or rule:cluster_user
Operations:	GET /v1/certificates/{bay_uuid/cluster_uuid}

Retrieve CA information about the given bay/cluster.

certificate:rotate_ca

Default:	rule:admin_or_owner
Operations:	PATCH /v1/certificates/{bay_uuid/cluster_uuid}

Rotate the CA certificate on the given bay/cluster.

cluster:create

Default:	rule:deny_cluster_user
Operations:	POST /v1/clusters

Create a new cluster.

cluster:delete

Default:	rule:deny_cluster_user
Operations:	DELETE /v1/clusters/{cluster_ident}

Delete a cluster.

cluster:delete_all_projects

Default:	rule:admin_api
Operations:	DELETE /v1/clusters/{cluster_ident}

Delete a cluster from any project.

cluster:detail

Default:	rule:deny_cluster_user
Operations:	GET /v1/clusters

Retrieve a list of clusters with detail.

cluster:detail_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clusters

Retrieve a list of clusters with detail across projects.

cluster:get

Default:	rule:deny_cluster_user
Operations:	GET /v1/clusters/{cluster_ident}

Retrieve information about the given cluster.

cluster:get_one_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clusters/{cluster_ident}

Retrieve information about the given cluster across projects.

cluster:get_all

Default:	rule:deny_cluster_user
Operations:	GET /v1/clusters/

Retrieve a list of clusters.

cluster:get_all_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clusters/

Retrieve a list of all clusters across projects.

cluster:update

Default:	rule:deny_cluster_user
Operations:	PATCH /v1/clusters/{cluster_ident}

Update an existing cluster.

cluster:resize

Default:	rule:deny_cluster_user
Operations:	POST /v1/clusters/{cluster_ident}/actions/resize

Resize an existing cluster.

clustertemplate:create

Default:	rule:deny_cluster_user
Operations:	POST /v1/clustertemplates

Create a new cluster template.

clustertemplate:delete

Default:	rule:deny_cluster_user
Operations:	DELETE /v1/clustertemplate/{clustertemplate_ident}

Delete a cluster template.

clustertemplate:delete_all_projects

Default:	rule:admin_api
Operations:	DELETE /v1/clustertemplate/{clustertemplate_ident}

Delete a cluster template from any project.

clustertemplate:detail_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clustertemplates

Retrieve a list of cluster templates with detail across projects.

clustertemplate:detail

Default:	rule:deny_cluster_user
Operations:	GET /v1/clustertemplates

Retrieve a list of cluster templates with detail.

clustertemplate:get

Default:	rule:deny_cluster_user
Operations:	GET /v1/clustertemplate/{clustertemplate_ident}

Retrieve information about the given cluster template.

clustertemplate:get_one_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clustertemplate/{clustertemplate_ident}

Retrieve information about the given cluster template across project.

clustertemplate:get_all

Default:	rule:deny_cluster_user
Operations:	GET /v1/clustertemplates

Retrieve a list of cluster templates.

clustertemplate:get_all_all_projects

Default:	rule:admin_api
Operations:	GET /v1/clustertemplates

Retrieve a list of cluster templates across projects.

clustertemplate:update

Default:	rule:deny_cluster_user
Operations:	PATCH /v1/clustertemplate/{clustertemplate_ident}

Update an existing cluster template.

clustertemplate:publish

Default:	rule:admin_api
Operations:	POST /v1/clustertemplates PATCH /v1/clustertemplates

Publish an existing cluster template.

federation:create

Default:	rule:deny_cluster_user
Operations:	POST /v1/federations

Create a new federation.

federation:delete

Default:	rule:deny_cluster_user
Operations:	DELETE /v1/federations/{federation_ident}

Delete a federation.

federation:detail

Default:	rule:deny_cluster_user
Operations:	GET /v1/federations

Retrieve a list of federations with detail.

federation:get

Default:	rule:deny_cluster_user
Operations:	GET /v1/federations/{federation_ident}

Retrieve information about the given federation.

federation:get_all

Default:	rule:deny_cluster_user
Operations:	GET /v1/federations/

Retrieve a list of federations.

federation:update

Default:	rule:deny_cluster_user
Operations:	PATCH /v1/federations/{federation_ident}

Update an existing federation.

magnum-service:get_all

Default:	rule:admin_api
Operations:	GET /v1/mservices

Retrieve a list of magnum-services.

quota:create

Default:	rule:admin_api
Operations:	POST /v1/quotas

Create quota.

quota:delete

Default:	rule:admin_api
Operations:	DELETE /v1/quotas/{project_id}/{resource}

Delete quota for a given project_id and resource.

quota:get

Default:	rule:admin_or_owner
Operations:	GET /v1/quotas/{project_id}/{resource}

Retrieve Quota information for the given project_id.

quota:get_all

Default:	rule:admin_api
Operations:	GET /v1/quotas

Retrieve a list of quotas.

quota:update

Default:	rule:admin_api
Operations:	PATCH /v1/quotas/{project_id}/{resource}

Update quota for a given project_id.

stats:get_all

Default:	rule:admin_or_owner
Operations:	GET /v1/stats

Retrieve magnum stats.