Policy configuration¶
Warning
JSON formatted policy file is deprecated since Manila 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
Configuration¶
The following is an overview of all available policies in Manila.
manila¶
project-admin
- Default:
role:admin and project_id:%(project_id)s
- Scope Types:
project
Project scoped Administrator
project-member
- Default:
role:member and project_id:%(project_id)s
- Scope Types:
project
Project scoped Member
project-reader
- Default:
role:reader and project_id:%(project_id)s
- Scope Types:
project
Project scoped Reader
owner-user
- Default:
user_id:%(user_id)s and project_id:%(project_id)s
- Scope Types:
project
Project scoped user that owns a user specific resource
admin_or_service_api
- Default:
role:admin or role:service
- Scope Types:
project
A service user or an administrator user.
context_is_admin
- Default:
role:admin
- Scope Types:
project
Privileged users checked via “context.is_admin”
context_is_host_admin
- Default:
role:admin and project_id:%(project_id)s
- Scope Types:
project
Privileged user who can select host during scheduling
admin_or_owner
- Default:
is_admin:True or project_id:%(project_id)s
Administrator or Member of the project
admin_or_owner_user
- Default:
is_admin:True or project_id:%(project_id)s and user_id:%(user_id)s
Administrator or owner user of a resource
default
- Default:
rule:admin_or_owner
Default rule for most non-Admin APIs
admin_api
- Default:
is_admin:True
Default rule for most Admin APIs.
availability_zone:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/os-availability-zone
GET
/availability-zone
- Scope Types:
project
Get all storage availability zones.
scheduler_stats:pools:index
- Default:
rule:context_is_admin
- Operations:
GET
/scheduler-stats/pools?{query}
- Scope Types:
project
Get information regarding backends (and storage pools) known to the scheduler.
scheduler_stats:pools:detail
- Default:
rule:context_is_admin
- Operations:
GET
/scheduler-stats/pools/detail?{query}
- Scope Types:
project
Get detailed information regarding backends (and storage pools) known to the scheduler.
share:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares
- Scope Types:
project
Create share.
share:create_public_share
- Default:
rule:context_is_admin
- Operations:
POST
/shares
- Scope Types:
project
Create shares visible across all projects in the cloud.
share:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}
- Scope Types:
project
Get share.
share:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares?{query}
GET
/shares/detail?{query}
- Scope Types:
project
List shares.
share:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/shares/{share_id}
- Scope Types:
project
Update a share.
share:set_public_share
- Default:
rule:context_is_admin
- Operations:
PUT
/shares/{share_id}
- Scope Types:
project
Update a share to be visible across all projects in the cloud.
share:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/shares/{share_id}
- Scope Types:
project
Delete share.
share:soft_delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Soft Delete a share.
share:restore
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Restore a share.
share:force_delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/shares/{share_id}
- Scope Types:
project
Force Delete a share.
share:manage
- Default:
rule:context_is_admin
- Operations:
POST
/shares/manage
- Scope Types:
project
Manage share.
share:unmanage
- Default:
rule:context_is_admin
- Operations:
POST
/shares/unmanage
- Scope Types:
project
Unmanage share.
share:list_by_host
- Default:
rule:context_is_admin
- Operations:
GET
/shares?host={host}
GET
/shares/detail?host={host}
- Scope Types:
project
List share by host.
share:list_by_share_server_id
- Default:
rule:context_is_admin
- Operations:
GET
/shares?share_server_id={share_server_id}
GET
/shares/detail?share_server_id={share_server_id}
- Scope Types:
project
List share by server id.
share:access_get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Get share access rule (deprecated in API version 2.45).
share:access_get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}/action
- Scope Types:
project
List share access rules (deprecated in API version 2.45).
share:extend
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Extend share.
share:force_extend
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Force extend share.
share:extend_beyond_max_share_size_spec
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Extend share beyond max share size.
share:shrink
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Shrink share.
share:migration_start
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Migrate a share to the specified host.
share:migration_complete
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Invoke 2nd phase of share migration.
share:migration_cancel
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Attempt to cancel share migration.
share:migration_get_progress
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Retrieve share migration progress for a given share.
share:reset_task_state
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Reset task state.
share:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Reset status.
share:revert_to_snapshot
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Revert a share to a snapshot.
share:allow_access
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Add share access rule.
share:deny_access
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/shares/{share_id}/action
- Scope Types:
project
Remove share access rule.
share:update_share_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/shares/{share_id}/metadata
POST
/shares/{share_id}/metadata/{key}
POST
/shares/{share_id}/metadata
- Scope Types:
project
Update share metadata.
share:delete_share_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/shares/{share_id}/metadata/{key}
- Scope Types:
project
Delete share metadata.
share:get_share_metadata
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}/metadata
GET
/shares/{share_id}/metadata/{key}
- Scope Types:
project
Get share metadata.
share:list_shares_in_deferred_deletion_states
- Default:
rule:context_is_admin
- Operations:
GET
/v2/shares
GET
/shares/{share_id}
- Scope Types:
project
List (or get) shares whose deletion has been deferred
share:create_snapshot
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/snapshots
- Scope Types:
project
Create share snapshot.
share:delete_snapshot
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/snapshots/{snapshot_id}
- Scope Types:
project
Delete share snapshot.
share:snapshot_update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/snapshots/{snapshot_id}/action
- Scope Types:
project
Update share snapshot.
share:update_admin_only_metadata
- Default:
rule:context_is_admin
- Operations:
PUT
/shares/{share_id}/metadata
- Scope Types:
project
Update metadata items that are considered “admin only” by the service.
share_instance_export_location:index
- Default:
rule:context_is_admin
- Operations:
POST
/share_instances/{share_instance_id}/export_locations
- Scope Types:
project
Return data about the requested export location.
share_instance_export_location:show
- Default:
rule:context_is_admin
- Operations:
GET
/share_instances/{share_instance_id}/export_locations/{export_location_id}
- Scope Types:
project
Return data about the requested export location.
share_type:create
- Default:
rule:context_is_admin
- Operations:
POST
/types
- Scope Types:
project
Create share type.
share_type:update
- Default:
rule:context_is_admin
- Operations:
PUT
/types/{share_type_id}
- Scope Types:
project
Update share type.
share_type:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/types/{share_type_id}
- Scope Types:
project
Get share type.
share_type:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/types?is_public=all
- Scope Types:
project
List share types.
share_type:default
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/types/default
- Scope Types:
project
Get default share type.
share_type:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/types/{share_type_id}
- Scope Types:
project
Delete share type.
share_type:list_project_access
- Default:
rule:context_is_admin
- Operations:
GET
/types/{share_type_id}
- Scope Types:
project
List share type project access.
share_type:add_project_access
- Default:
rule:context_is_admin
- Operations:
POST
/types/{share_type_id}/action
- Scope Types:
project
Add share type to project.
share_type:remove_project_access
- Default:
rule:context_is_admin
- Operations:
POST
/types/{share_type_id}/action
- Scope Types:
project
Remove share type from project.
share_types_extra_spec:create
- Default:
rule:context_is_admin
- Operations:
POST
/types/{share_type_id}/extra_specs
- Scope Types:
project
Create share type extra spec.
share_types_extra_spec:show
- Default:
rule:context_is_admin
- Operations:
GET
/types/{share_type_id}/extra_specs
- Scope Types:
project
Get share type extra specs of a given share type.
share_types_extra_spec:index
- Default:
rule:context_is_admin
- Operations:
GET
/types/{share_type_id}/extra_specs/{extra_spec_id}
- Scope Types:
project
Get details of a share type extra spec.
share_types_extra_spec:update
- Default:
rule:context_is_admin
- Operations:
PUT
/types/{share_type_id}/extra_specs
- Scope Types:
project
Update share type extra spec.
share_types_extra_spec:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/types/{share_type_id}/extra_specs/{key}
- Scope Types:
project
Delete share type extra spec.
share_snapshot:get_snapshot
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots/{snapshot_id}
- Scope Types:
project
Get share snapshot.
share_snapshot:get_all_snapshots
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots?{query}
GET
/snapshots/detail?{query}
- Scope Types:
project
Get all share snapshots.
share_snapshot:force_delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/snapshots/{snapshot_id}
- Scope Types:
project
Force Delete a share snapshot.
share_snapshot:manage_snapshot
- Default:
rule:context_is_admin
- Operations:
POST
/snapshots/manage
- Scope Types:
project
Manage share snapshot.
share_snapshot:unmanage_snapshot
- Default:
rule:context_is_admin
- Operations:
POST
/snapshots/{snapshot_id}/action
- Scope Types:
project
Unmanage share snapshot.
share_snapshot:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/snapshots/{snapshot_id}/action
- Scope Types:
project
Reset status.
share_snapshot:access_list
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots/{snapshot_id}/access-list
- Scope Types:
project
List access rules of a share snapshot.
share_snapshot:allow_access
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/snapshots/{snapshot_id}/action
- Scope Types:
project
Allow access to a share snapshot.
share_snapshot:deny_access
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/snapshots/{snapshot_id}/action
- Scope Types:
project
Deny access to a share snapshot.
share_snapshot:update_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/snapshots/{snapshot_id}/metadata
POST
/snapshots/{snapshot_id}/metadata/{key}
POST
/snapshots/{snapshot_id}/metadata
- Scope Types:
project
Update snapshot metadata.
share_snapshot:delete_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/snapshots/{snapshot_id}/metadata/{key}
- Scope Types:
project
Delete snapshot metadata.
share_snapshot:get_metadata
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots/{snapshot_id}/metadata
GET
/snapshots/{snapshot_id}/metadata/{key}
- Scope Types:
project
Get snapshot metadata.
share_snapshot:list_snapshots_in_deferred_deletion_states
- Default:
rule:context_is_admin
- Operations:
GET
/v2/snapshots
GET
/snapshots/{snapshot_id}
- Scope Types:
project
List (or get) snapshots whose deletion has been deferred
share_snapshot_export_location:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots/{snapshot_id}/export-locations/
- Scope Types:
project
List export locations of a share snapshot.
share_snapshot_export_location:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/snapshots/{snapshot_id}/export-locations/{export_location_id}
- Scope Types:
project
Get details of a specified export location of a share snapshot.
share_snapshot_instance:show
- Default:
rule:context_is_admin
- Operations:
GET
/snapshot-instances/{snapshot_instance_id}
- Scope Types:
project
Get share snapshot instance.
share_snapshot_instance:index
- Default:
rule:context_is_admin
- Operations:
GET
/snapshot-instances?{query}
- Scope Types:
project
Get all share snapshot instances.
share_snapshot_instance:detail
- Default:
rule:context_is_admin
- Operations:
GET
/snapshot-instances/detail?{query}
- Scope Types:
project
Get details of share snapshot instances.
share_snapshot_instance:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/snapshot-instances/{snapshot_instance_id}/action
- Scope Types:
project
Reset share snapshot instance’s status.
share_snapshot_instance_export_location:index
- Default:
rule:context_is_admin
- Operations:
GET
/snapshot-instances/{snapshot_instance_id}/export-locations
- Scope Types:
project
List export locations of a share snapshot instance.
share_snapshot_instance_export_location:show
- Default:
rule:context_is_admin
- Operations:
GET
/snapshot-instances/{snapshot_instance_id}/export-locations/{export_location_id}
- Scope Types:
project
Show details of a specified export location of a share snapshot instance.
share_server:index
- Default:
rule:context_is_admin
- Operations:
GET
/share-servers?{query}
- Scope Types:
project
Get share servers.
share_server:show
- Default:
rule:context_is_admin
- Operations:
GET
/share-servers/{server_id}
- Scope Types:
project
Show share server.
share_server:details
- Default:
rule:context_is_admin
- Operations:
GET
/share-servers/{server_id}/details
- Scope Types:
project
Get share server details.
share_server:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/share-servers/{server_id}
- Scope Types:
project
Delete share server.
share_server:manage_share_server
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/manage
- Scope Types:
project
Manage share server.
share_server:unmanage_share_server
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Unmanage share server.
share_server:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Reset the status of a share server.
share_server:share_server_migration_start
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Migrates a share server to the specified host.
share_server:share_server_migration_check
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Check if can migrates a share server to the specified host.
share_server:share_server_migration_complete
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Invokes the 2nd phase of share server migration.
share_server:share_server_migration_cancel
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Attempts to cancel share server migration.
share_server:share_server_migration_get_progress
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Retrieves the share server migration progress for a given share server.
share_server:share_server_reset_task_state
- Default:
rule:context_is_admin
- Operations:
POST
/share-servers/{share_server_id}/action
- Scope Types:
project
Resets task state.
service:index
- Default:
rule:context_is_admin
- Operations:
GET
/os-services?{query}
GET
/services?{query}
- Scope Types:
project
Return a list of all running services.
service:update
- Default:
rule:context_is_admin
- Operations:
PUT
/os-services/disable
PUT
/os-services/enable
PUT
/services/disable
PUT
/services/enable
- Scope Types:
project
Enable/Disable scheduling for a service.
service:ensure_shares
- Default:
rule:context_is_admin
- Operations:
POST
/services/ensure
- Scope Types:
project
Run ensure shares for a manila-share binary.
quota_set:update
- Default:
rule:context_is_admin
- Operations:
PUT
/quota-sets/{project_id}
PUT
/quota-sets/{project_id}?user_id={user_id}
PUT
/quota-sets/{project_id}?share_type={share_type_id}
PUT
/os-quota-sets/{project_id}
PUT
/os-quota-sets/{project_id}?user_id={user_id}
- Scope Types:
project
Update the quotas for a project/user and/or share type.
quota_set:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/quota-sets/{project_id}/defaults
GET
/os-quota-sets/{project_id}/defaults
- Scope Types:
project
List the quotas for a project/user.
quota_set:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/quota-sets/{project_id}
DELETE
/quota-sets/{project_id}?user_id={user_id}
DELETE
/quota-sets/{project_id}?share_type={share_type_id}
DELETE
/os-quota-sets/{project_id}
DELETE
/os-quota-sets/{project_id}?user_id={user_id}
- Scope Types:
project
Delete quota for a project/user or project/share-type. The quota will revert back to default (Admin only).
quota_class_set:update
- Default:
rule:context_is_admin
- Operations:
PUT
/quota-class-sets/{class_name}
PUT
/os-quota-class-sets/{class_name}
- Scope Types:
project
Update quota class.
quota_class_set:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/quota-class-sets/{class_name}
GET
/os-quota-class-sets/{class_name}
- Scope Types:
project
Get quota class.
resource_lock:get
- Default:
(rule:admin_or_service_api) or (rule:project-reader)
- Operations:
GET
/resource-locks/{lock_id}
- Scope Types:
project
Get details of a given resource lock.
resource_lock:get_all
- Default:
(rule:admin_or_service_api) or (rule:project-reader)
- Operations:
GET
/resource-locks
GET
/resource-locks?{query}
- Scope Types:
project
Get all resource locks.
resource_lock:get_all_projects
- Default:
rule:admin_or_service_api
- Operations:
GET
/resource-locks?all_projects=1
GET
/resource-locks?all_projects=1&project_id={project_id}
- Scope Types:
project
Get resource locks from all project namespaces.
resource_lock:create
- Default:
(rule:admin_or_service_api) or (rule:project-member)
- Operations:
POST
/resource-locks
- Scope Types:
project
Create a resource lock.
resource_lock:update
- Default:
(rule:owner-user or rule:admin_or_service_api)
- Operations:
PUT
/resource-locks/{lock_id}
- Scope Types:
project
Update a resource lock.
resource_lock:delete
- Default:
(rule:owner-user or rule:admin_or_service_api)
- Operations:
DELETE
/resource-locks/{lock_id}
- Scope Types:
project
Delete a resource lock.
resource_lock:bypass_locked_show_action
- Default:
(rule:owner-user or rule:admin_or_service_api)
- Operations:
GET
/share-access-rules/{share_access_id}
GET
/share-access-rules?share_id={share_id}&key1=value1&key2=value2
- Scope Types:
project
Bypass a visibility lock placed in a resource.
share_group_types_spec:create
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-types/{share_group_type_id}/group-specs
- Scope Types:
project
Create share group type specs.
share_group_types_spec:index
- Default:
rule:context_is_admin
- Operations:
GET
/share-group-types/{share_group_type_id}/group-specs
- Scope Types:
project
Get share group type specs.
share_group_types_spec:show
- Default:
rule:context_is_admin
- Operations:
GET
/share-group-types/{share_group_type_id}/group-specs/{key}
- Scope Types:
project
Get details of a share group type spec.
share_group_types_spec:update
- Default:
rule:context_is_admin
- Operations:
PUT
/share-group-types/{share_group_type_id}/group-specs/{key}
- Scope Types:
project
Update a share group type spec.
share_group_types_spec:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/share-group-types/{share_group_type_id}/group-specs/{key}
- Scope Types:
project
Delete a share group type spec.
share_group_type:create
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-types
- Scope Types:
project
Create a new share group type.
share_group_type:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-group-types?is_public=all
- Scope Types:
project
Get the list of share group types.
share_group_type:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-group-types/{share_group_type_id}
- Scope Types:
project
Get details regarding the specified share group type.
share_group_type:default
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-group-types/default
- Scope Types:
project
Get the default share group type.
share_group_type:delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/share-group-types/{share_group_type_id}
- Scope Types:
project
Delete an existing group type.
share_group_type:list_project_access
- Default:
rule:context_is_admin
- Operations:
GET
/share-group-types/{share_group_type_id}/access
- Scope Types:
project
Get project access by share group type.
share_group_type:add_project_access
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-types/{share_group_type_id}/action
- Scope Types:
project
Allow project to use the share group type.
share_group_type:remove_project_access
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-types/{share_group_type_id}/action
- Scope Types:
project
Deny project access to use the share group type.
share_group_snapshot:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-group-snapshots
- Scope Types:
project
Create a new share group snapshot.
share_group_snapshot:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-group-snapshots/{share_group_snapshot_id}
- Scope Types:
project
Get details of a share group snapshot.
share_group_snapshot:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-group-snapshots?{query}
GET
/share-group-snapshots/detail?{query}
- Scope Types:
project
Get all share group snapshots.
share_group_snapshot:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-group-snapshots/{share_group_snapshot_id}
- Scope Types:
project
Update a share group snapshot.
share_group_snapshot:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-group-snapshots/{share_group_snapshot_id}
- Scope Types:
project
Delete a share group snapshot.
share_group_snapshot:force_delete
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-snapshots/{share_group_snapshot_id}/action
- Scope Types:
project
Force delete a share group snapshot.
share_group_snapshot:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-group-snapshots/{share_group_snapshot_id}/action
- Scope Types:
project
Reset a share group snapshot’s status.
share_group:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-groups
- Scope Types:
project
Create share group.
share_group:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-groups/{share_group_id}
- Scope Types:
project
Get details of a share group.
share_group:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-groups?{query}
GET
/share-groups/detail?{query}
- Scope Types:
project
Get all share groups.
share_group:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-groups/{share_group_id}
- Scope Types:
project
Update share group.
share_group:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-groups/{share_group_id}
- Scope Types:
project
Delete share group.
share_group:force_delete
- Default:
rule:context_is_admin
- Operations:
POST
/share-groups/{share_group_id}/action
- Scope Types:
project
Force delete a share group.
share_group:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-groups/{share_group_id}/action
- Scope Types:
project
Reset share group’s status.
share_replica:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-replicas
- Scope Types:
project
Create share replica.
share_replica:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-replicas
GET
/share-replicas/detail
GET
/share-replicas/detail?share_id={share_id}
- Scope Types:
project
Get all share replicas.
share_replica:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-replicas/{share_replica_id}
- Scope Types:
project
Get details of a share replica.
share_replica:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-replicas/{share_replica_id}
- Scope Types:
project
Delete a share replica.
share_replica:force_delete
- Default:
rule:context_is_admin
- Operations:
POST
/share-replicas/{share_replica_id}/action
- Scope Types:
project
Force delete a share replica.
share_replica:promote
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-replicas/{share_replica_id}/action
- Scope Types:
project
Promote a non-active share replica to active.
share_replica:resync
- Default:
rule:context_is_admin
- Operations:
POST
/share-replicas/{share_replica_id}/action
- Scope Types:
project
Resync a share replica that is out of sync.
share_replica:reset_replica_state
- Default:
rule:context_is_admin
- Operations:
POST
/share-replicas/{share_replica_id}/action
- Scope Types:
project
Reset share replica’s replica_state attribute.
share_replica:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-replicas/{share_replica_id}/action
- Scope Types:
project
Reset share replica’s status.
share_replica_export_location:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-replicas/{share_replica_id}/export-locations
- Scope Types:
project
Get all export locations of a given share replica.
share_replica_export_location:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-replicas/{share_replica_id}/export-locations/{export_location_id}
- Scope Types:
project
Get details about the requested share replica export location.
share_network:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks
- Scope Types:
project
Create share network.
share_network:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks/{share_network_id}
- Scope Types:
project
Get details of a share network.
share_network:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks?{query}
- Scope Types:
project
Get all share networks under a project.
share_network:detail
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks/detail?{query}
- Scope Types:
project
Get details of share networks under a project.
share_network:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-networks/{share_network_id}
- Scope Types:
project
Update a share network.
share_network:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-networks/{share_network_id}
- Scope Types:
project
Delete a share network.
share_network:add_security_service
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Add security service to share network.
share_network:add_security_service_check
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Check the feasibility of add security service to a share network.
share_network:remove_security_service
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Remove security service from share network.
share_network:update_security_service
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Update security service from share network.
share_network:update_security_service_check
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Check the feasibility of update a security service from share network.
share_network:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Reset share network`s status.
share_network:get_all_share_networks
- Default:
rule:context_is_admin
- Operations:
GET
/share-networks?all_tenants=1
GET
/share-networks/detail?all_tenants=1
- Scope Types:
project
Get share networks belonging to all projects.
share_network:subnet_create_check
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/action
- Scope Types:
project
Check the feasibility of create a new share network subnet for share network.
share_network_subnet:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-networks/{share_network_id}/subnets
- Scope Types:
project
Create a new share network subnet.
share_network_subnet:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}
- Scope Types:
project
Delete a share network subnet.
share_network_subnet:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}
- Scope Types:
project
Shows a share network subnet.
share_network_subnet:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks/{share_network_id}/subnets
- Scope Types:
project
Get all share network subnets.
share_network_subnet:update_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata
POST
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata/{key}
POST
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata
- Scope Types:
system
project
Update share network subnet metadata.
share_network_subnet:delete_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata/{key}
- Scope Types:
system
project
Delete share network subnet metadata.
share_network_subnet:get_metadata
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata
GET
/share-networks/{share_network_id}/subnets/{share_network_subnet_id}/metadata/{key}
- Scope Types:
system
project
Get share network subnet metadata.
security_service:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/security-services
- Scope Types:
project
Create security service.
security_service:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/security-services/{security_service_id}
- Scope Types:
project
Get details of a security service.
security_service:detail
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/security-services/detail?{query}
- Scope Types:
project
Get details of all security services.
security_service:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/security-services?{query}
- Scope Types:
project
Get all security services under a project.
security_service:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/security-services/{security_service_id}
- Scope Types:
project
Update a security service.
security_service:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/security-services/{security_service_id}
- Scope Types:
project
Delete a security service.
security_service:get_all_security_services
- Default:
rule:context_is_admin
- Operations:
GET
/security-services?all_tenants=1
GET
/security-services/detail?all_tenants=1
- Scope Types:
project
Get security services of all projects.
share_export_location:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}/export_locations
- Scope Types:
project
Get all export locations of a given share.
share_export_location:show
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}/export_locations/{export_location_id}
- Scope Types:
project
Get details about the requested export location.
share_export_location:update_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/shares/{share_id}/export_locations/{export_location_id}/metadata
POST
/shares/{share_id}/export_locations/{export_location_id}/metadata/{key}
POST
/shares/{share_id}/export_locations/{export_location_id}/metadata
- Scope Types:
project
Update share export location metadata.
share_export_location:delete_metadata
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/shares/{share_id}/export_locations/{export_location_id}/metadata/{key}
- Scope Types:
project
Delete share export location metadata
share_export_location:get_metadata
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/shares/{share_id}/export_locations/{export_location_id}/metadata
GET
/shares/{share_id}/export_locations/{export_location_id}/metadata/{key}
- Scope Types:
project
Get share export location metadata
share_export_location:update_admin_only_metadata
- Default:
rule:context_is_admin
- Operations:
PUT
/shares/{share_id}/export_locations/{export_location_id}/metadata
- Scope Types:
project
Update metadata items that are considered “admin only” by the service.
share_instance:index
- Default:
rule:context_is_admin
- Operations:
GET
/share_instances
GET
/share_instances?{query}
- Scope Types:
project
Get all share instances.
share_instance:show
- Default:
rule:context_is_admin
- Operations:
GET
/share_instances/{share_instance_id}
- Scope Types:
project
Get details of a share instance.
share_instance:force_delete
- Default:
rule:context_is_admin
- Operations:
POST
/share_instances/{share_instance_id}/action
- Scope Types:
project
Force delete a share instance.
share_instance:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share_instances/{share_instance_id}/action
- Scope Types:
project
Reset share instance’s status.
message:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/messages/{message_id}
- Scope Types:
project
Get details of a given message.
message:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/messages
GET
/messages?{query}
- Scope Types:
project
Get all messages.
message:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/messages/{message_id}
- Scope Types:
project
Delete a message.
share_access_rule:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-access-rules/{share_access_id}
- Scope Types:
project
Get details of a share access rule.
share_access_rule:index
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-access-rules?share_id={share_id}&key1=value1&key2=value2
- Scope Types:
project
List access rules of a given share.
share_access_metadata:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-access-rules/{share_access_id}/metadata
- Scope Types:
project
Set metadata for a share access rule.
share_access_metadata:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-access-rules/{share_access_id}/metadata/{key}
- Scope Types:
project
Delete metadata for a share access rule.
share_transfer:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-transfers
GET
/share-transfers/detail
List share transfers.
share_transfer:get_all_tenant
- Default:
rule:context_is_admin
- Operations:
GET
/share-transfers
GET
/share-transfers/detail
- Scope Types:
project
List share transfers with all tenants.
share_transfer:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-transfers
Create a share transfer.
share_transfer:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-transfers/{transfer_id}
Show one specified share transfer.
share_transfer:accept
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-transfers/{transfer_id}/accept
Accept a share transfer.
share_transfer:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-transfers/{transfer_id}
Delete share transfer.
share_backup:create
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-backups
- Scope Types:
project
Create share backup.
share_backup:get
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-backups/{backup_id}
- Scope Types:
project
Get share backup.
share_backup:get_all
- Default:
(rule:context_is_admin) or (rule:project-reader)
- Operations:
GET
/share-backups
GET
/share-backups/detail
GET
/share-backups/detail?share_id=(share_id}
- Scope Types:
project
Get all share backups.
share_backup:get_all_project
- Default:
rule:context_is_admin
- Operations:
GET
/share-backups?all_tenants=1
GET
/share-backups/detail?all_tenants=1
- Scope Types:
project
Get share backups of all projects.
share_backup:restore
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
POST
/share-backups/{backup_id}/action
- Scope Types:
project
Restore a share backup.
share_backup:reset_status
- Default:
rule:context_is_admin
- Operations:
POST
/share-backups/{backup_id}/action
- Scope Types:
project
Reset status.
share_backup:update
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
PUT
/share-backups/{backup_id}
- Scope Types:
project
Update a share backup.
share_backup:delete
- Default:
(rule:context_is_admin) or (rule:project-member)
- Operations:
DELETE
/share-backups/{backup_id}
- Scope Types:
project
Force Delete a share backup.