Implement secure RBAC for share network subnets
This commit updates the policies for share network subnets to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
# License for the specific language governing permissions and limitations
# under the License.
+from oslo_log import versionutils
from oslo_policy import policy
from manila.policies import base
BASE_POLICY_NAME = 'share_network_subnet:%s'
+DEPRECATED_REASON = """
+The share network subnet API now supports system scope and default roles.
+"""
+
+deprecated_subnet_create = policy.DeprecatedRule(
+ name=BASE_POLICY_NAME % 'create',
+ check_str=base.RULE_DEFAULT
+)
+deprecated_subnet_delete = policy.DeprecatedRule(
+ name=BASE_POLICY_NAME % 'delete',
+ check_str=base.RULE_DEFAULT
+)
+deprecated_subnet_show = policy.DeprecatedRule(
+ name=BASE_POLICY_NAME % 'show',
+ check_str=base.RULE_DEFAULT
+)
+deprecated_subnet_index = policy.DeprecatedRule(
+ name=BASE_POLICY_NAME % 'index',
+ check_str=base.RULE_DEFAULT
+)
+
share_network_subnet_policies = [
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'create',
- check_str=base.RULE_DEFAULT,
+ check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
+ scope_types=['system', 'project'],
description="Create a new share network subnet.",
operations=[
{
'method': 'POST',
'path': '/share-networks/{share_network_id}/subnets'
}
- ]),
+ ],
+ deprecated_rule=deprecated_subnet_create,
+ deprecated_reason=DEPRECATED_REASON,
+ deprecated_since=versionutils.deprecated.WALLABY
+ ),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'delete',
- check_str=base.RULE_DEFAULT,
+ check_str=base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,
+ scope_types=['system', 'project'],
description="Delete a share network subnet.",
operations=[
{
@@ -41,10 +69,15 @@ share_network_subnet_policies = [
'path': '/share-networks/{share_network_id}/subnets/'
'{share_network_subnet_id}'
}
- ]),
+ ],
+ deprecated_rule=deprecated_subnet_delete,
+ deprecated_reason=DEPRECATED_REASON,
+ deprecated_since=versionutils.deprecated.WALLABY
+ ),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'show',
- check_str=base.RULE_DEFAULT,
+ check_str=base.SYSTEM_OR_PROJECT_READER,
+ scope_types=['system', 'project'],
description="Shows a share network subnet.",
operations=[
{
@@ -52,17 +85,26 @@ share_network_subnet_policies = [
'path': '/share-networks/{share_network_id}/subnets/'
'{share_network_subnet_id}'
}
- ]),
+ ],
+ deprecated_rule=deprecated_subnet_show,
+ deprecated_reason=DEPRECATED_REASON,
+ deprecated_since=versionutils.deprecated.WALLABY
+ ),
policy.DocumentedRuleDefault(
name=BASE_POLICY_NAME % 'index',
- check_str=base.RULE_DEFAULT,
+ check_str=base.SYSTEM_OR_PROJECT_READER,
+ scope_types=['system', 'project'],
description="Get all share network subnets.",
operations=[
{
'method': 'GET',
'path': '/share-networks/{share_network_id}/subnets'
}
- ]),
+ ],
+ deprecated_rule=deprecated_subnet_index,
+ deprecated_reason=DEPRECATED_REASON,
+ deprecated_since=versionutils.deprecated.WALLABY
+ ),
]
