Policy Documentation

Warning

JSON formatted policy file is deprecated since Designate 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.

The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.

designate

admin
Default

role:admin or is_admin:True

(no description provided)

primary_zone
Default

target.zone_type:SECONDARY

(no description provided)

owner
Default

tenant:%(tenant_id)s

(no description provided)

admin_or_owner
Default

rule:admin or rule:owner

(no description provided)

default
Default

rule:admin_or_owner

(no description provided)

target
Default

tenant:%(target_tenant_id)s

(no description provided)

owner_or_target
Default

rule:target or rule:owner

(no description provided)

admin_or_owner_or_target
Default

rule:owner_or_target or rule:admin

(no description provided)

admin_or_target
Default

rule:admin or rule:target

(no description provided)

zone_primary_or_admin
Default

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

(no description provided)

create_blacklist
Default

role:admin and system_scope:all

Operations
  • POST /v2/blacklists

Scope Types
  • system

Create blacklist.

find_blacklist
Default

role:reader and system_scope:all

Operations
  • GET /v2/blacklists

Scope Types
  • system

Find blacklist.

find_blacklists
Default

role:reader and system_scope:all

Operations
  • GET /v2/blacklists

Scope Types
  • system

Find blacklists.

get_blacklist
Default

role:reader and system_scope:all

Operations
  • GET /v2/blacklists/{blacklist_id}

Scope Types
  • system

Get blacklist.

update_blacklist
Default

role:admin and system_scope:all

Operations
  • PATCH /v2/blacklists/{blacklist_id}

Scope Types
  • system

Update blacklist.

delete_blacklist
Default

role:admin and system_scope:all

Operations
  • DELETE /v2/blacklists/{blacklist_id}

Scope Types
  • system

Delete blacklist.

use_blacklisted_zone
Default

role:admin and system_scope:all

Operations
  • POST /v2/zones

Scope Types
  • system

Allowed bypass the blacklist.

all_tenants
Default

rule:admin

Action on all tenants.

edit_managed_records
Default

rule:admin

Edit managed records.

use_low_ttl
Default

rule:admin

Use low TTL.

use_sudo
Default

rule:admin

Accept sudo from user to tenant.

diagnostics_ping
Default

rule:admin

Diagnose ping.

diagnostics_sync_zones
Default

rule:admin

Diagnose sync zones.

diagnostics_sync_zone
Default

rule:admin

Diagnose sync zone.

diagnostics_sync_record
Default

rule:admin

Diagnose sync record.

create_pool
Default

role:admin and system_scope:all

Scope Types
  • system

Create pool.

find_pools
Default

role:reader and system_scope:all

Operations
  • GET /v2/pools

Scope Types
  • system

Find pool.

find_pool
Default

role:reader and system_scope:all

Operations
  • GET /v2/pools

Scope Types
  • system

Find pools.

get_pool
Default

role:reader and system_scope:all

Operations
  • GET /v2/pools/{pool_id}

Scope Types
  • system

Get pool.

update_pool
Default

role:admin and system_scope:all

Scope Types
  • system

Update pool.

delete_pool
Default

role:admin and system_scope:all

Scope Types
  • system

Delete pool.

zone_create_forced_pool
Default

role:admin and system_scope:all

Operations
  • POST /v2/zones

Scope Types
  • system

load and set the pool to the one provided in the Zone attributes.

get_quotas
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/quotas

Scope Types
  • system

  • project

View Current Project’s Quotas.

get_quota
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

set_quota
Default

role:admin and system_scope:all

Operations
  • PATCH /v2/quotas/{project_id}

Scope Types
  • system

Set Quotas.

reset_quotas
Default

role:admin and system_scope:all

Operations
  • DELETE /v2/quotas/{project_id}

Scope Types
  • system

Reset Quotas.

find_records
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/reverse/floatingips/{region}:{floatingip_id}

  • GET /v2/reverse/floatingips

Scope Types
  • system

  • project

Find records.

count_records
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

create_recordset
Default

(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations
  • POST /v2/zones/{zone_id}/recordsets

  • PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Scope Types
  • system

  • project

Create Recordset

get_recordsets
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

get_recordset
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/{zone_id}/recordsets/{recordset_id}

  • DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}

  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types
  • system

  • project

Get recordset

update_recordset
Default

(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations
  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

  • PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Scope Types
  • system

  • project

Update recordset

delete_recordset
Default

(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations
  • DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types
  • system

  • project

Delete RecordSet

count_recordset
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

Count recordsets

find_service_status
Default

role:reader and system_scope:all

Operations
  • GET /v2/service_status/{service_id}

Scope Types
  • system

Find a single Service Status

find_service_statuses
Default

role:reader and system_scope:all

Operations
  • GET /v2/service_status

Scope Types
  • system

List service statuses.

update_service_status
Default

role:admin and system_scope:all

Scope Types
  • system

(no description provided)

find_tenants
Default

role:reader and system_scope:all

Scope Types
  • system

Find all Tenants.

get_tenant
Default

role:reader and system_scope:all

Scope Types
  • system

Get all Tenants.

count_tenants
Default

role:reader and system_scope:all

Scope Types
  • system

Count tenants

create_tld
Default

role:admin and system_scope:all

Operations
  • POST /v2/tlds

Scope Types
  • system

Create Tld

find_tlds
Default

role:reader and system_scope:all

Operations
  • GET /v2/tlds

Scope Types
  • system

List Tlds

get_tld
Default

role:reader and system_scope:all

Operations
  • GET /v2/tlds/{tld_id}

Scope Types
  • system

Show Tld

update_tld
Default

role:admin and system_scope:all

Operations
  • PATCH /v2/tlds/{tld_id}

Scope Types
  • system

Update Tld

delete_tld
Default

role:admin and system_scope:all

Operations
  • DELETE /v2/tlds/{tld_id}

Scope Types
  • system

Delete Tld

create_tsigkey
Default

role:admin and system_scope:all

Operations
  • POST /v2/tsigkeys

Scope Types
  • system

Create Tsigkey

find_tsigkeys
Default

role:reader and system_scope:all

Operations
  • GET /v2/tsigkeys

Scope Types
  • system

List Tsigkeys

get_tsigkey
Default

role:reader and system_scope:all

Operations
  • PATCH /v2/tsigkeys/{tsigkey_id}

  • GET /v2/tsigkeys/{tsigkey_id}

Scope Types
  • system

Show a Tsigkey

update_tsigkey
Default

role:admin and system_scope:all

Operations
  • PATCH /v2/tsigkeys/{tsigkey_id}

Scope Types
  • system

Update Tsigkey

delete_tsigkey
Default

role:admin and system_scope:all

Operations
  • DELETE /v2/tsigkeys/{tsigkey_id}

Scope Types
  • system

Delete a Tsigkey

create_zone
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones

Scope Types
  • system

  • project

Create Zone

get_zones
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

get_zone
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/{zone_id}

  • PATCH /v2/zones/{zone_id}

  • PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types
  • system

  • project

Get Zone

get_zone_servers
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

find_zones
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones

Scope Types
  • system

  • project

List existing zones

update_zone
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • PATCH /v2/zones/{zone_id}

Scope Types
  • system

  • project

Update Zone

delete_zone
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • DELETE /v2/zones/{zone_id}

Scope Types
  • system

  • project

Delete Zone

xfr_zone
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/{zone_id}/tasks/xfr

Scope Types
  • system

  • project

Manually Trigger an Update of a Secondary Zone

abandon_zone
Default

role:admin and system_scope:all

Operations
  • POST /v2/zones/{zone_id}/tasks/abandon

Scope Types
  • system

Abandon Zone

count_zones
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

count_zones_pending_notify
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

purge_zones
Default

role:admin and system_scope:all

Scope Types
  • system

(no description provided)

touch_zone
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

zone_export
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/exports/{zone_export_id}/export

Scope Types
  • system

  • project

Retrive a Zone Export from the Designate Datastore

create_zone_export
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/{zone_id}/tasks/export

Scope Types
  • system

  • project

Create Zone Export

find_zone_exports
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/exports

Scope Types
  • system

  • project

List Zone Exports

get_zone_export
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/exports/{zone_export_id}

  • GET /v2/zones/tasks/exports/{zone_export_id}/export

Scope Types
  • system

  • project

Get Zone Exports

update_zone_export
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/{zone_id}/tasks/export

Scope Types
  • system

  • project

Update Zone Exports

create_zone_import
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/tasks/imports

Scope Types
  • system

  • project

Create Zone Import

find_zone_imports
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/imports

Scope Types
  • system

  • project

List all Zone Imports

get_zone_import
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/imports/{zone_import_id}

Scope Types
  • system

  • project

Get Zone Imports

update_zone_import
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/tasks/imports

Scope Types
  • system

  • project

Update Zone Imports

delete_zone_import
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/imports/{zone_import_id}

Scope Types
  • system

  • project

Delete a Zone Import

create_zone_transfer_accept
Default

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s

Operations
  • POST /v2/zones/tasks/transfer_accepts

Create Zone Transfer Accept

get_zone_transfer_accept
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations
  • GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}

Scope Types
  • system

  • project

Get Zone Transfer Accept

find_zone_transfer_accepts
Default

role:reader and system_scope:all

Operations
  • GET /v2/zones/tasks/transfer_accepts

Scope Types
  • system

List Zone Transfer Accepts

find_zone_transfer_accept
Default

role:reader and system_scope:all

Scope Types
  • system

(no description provided)

update_zone_transfer_accept
Default

role:admin and system_scope:all

Operations
  • POST /v2/zones/tasks/transfer_accepts

Scope Types
  • system

Update a Zone Transfer Accept

delete_zone_transfer_accept
Default

role:admin and system_scope:all

Scope Types
  • system

(no description provided)

create_zone_transfer_request
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • POST /v2/zones/{zone_id}/tasks/transfer_requests

Scope Types
  • system

  • project

Create Zone Transfer Accept

get_zone_transfer_request
Default

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s

Operations
  • GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

  • PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Show a Zone Transfer Request

get_zone_transfer_request_detailed
Default

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types
  • system

  • project

(no description provided)

find_zone_transfer_requests
Default

@

Operations
  • GET /v2/zones/tasks/transfer_requests

List Zone Transfer Requests

find_zone_transfer_request
Default

@

(no description provided)

update_zone_transfer_request
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Scope Types
  • system

  • project

Update a Zone Transfer Request

delete_zone_transfer_request
Default

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations
  • DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Scope Types
  • system

  • project

Delete a Zone Transfer Request