The following policies are shipped by default. Glance will assume a policy’s default value if it’s not explicitly overridden in the policy file.
policy.yaml¶
glance¶
default
- Default:
<empty string>
Defines the default rule used for policies that historically had an empty policy in the supplied policy.json file.
context_is_admin
- Default:
role:admin
Defines the rule for the is_admin:True check.
add_image
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)
- Operations:
POST
/v2/images
- Scope Types:
project
Create new image
delete_image
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
DELETE
/v2/images/{image_id}
- Scope Types:
project
Deletes the image
get_image
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))
- Operations:
GET
/v2/images/{image_id}
- Scope Types:
project
Get specified image
get_images
- Default:
rule:context_is_admin or (role:reader and project_id:%(project_id)s)
- Operations:
GET
/v2/images
- Scope Types:
project
Get all available images
modify_image
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
PATCH
/v2/images/{image_id}
- Scope Types:
project
Updates given image
publicize_image
- Default:
rule:context_is_admin
- Operations:
PATCH
/v2/images/{image_id}
- Scope Types:
project
Publicize given image
communitize_image
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
PATCH
/v2/images/{image_id}
- Scope Types:
project
Communitize given image
download_image
- Default:
rule:context_is_admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))
- Operations:
GET
/v2/images/{image_id}/file
- Scope Types:
project
Downloads given image
upload_image
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
PUT
/v2/images/{image_id}/file
- Scope Types:
project
Uploads data to specified image
delete_image_location
- Default:
rule:context_is_admin
- Operations:
PATCH
/v2/images/{image_id}
- Scope Types:
project
Deletes the location of given image
get_image_location
- Default:
rule:context_is_admin or (role:reader and project_id:%(project_id)s)
- Operations:
GET
/v2/images/{image_id}
- Scope Types:
project
Reads the location of the image
set_image_location
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
PATCH
/v2/images/{image_id}
- Scope Types:
project
Sets location URI to given image
add_member
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
POST
/v2/images/{image_id}/members
- Scope Types:
project
Create image member
delete_member
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
DELETE
/v2/images/{image_id}/members/{member_id}
- Scope Types:
project
Delete image member
get_member
- Default:
rule:context_is_admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)
- Operations:
GET
/v2/images/{image_id}/members/{member_id}
- Scope Types:
project
Show image member details
get_members
- Default:
rule:context_is_admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)
- Operations:
GET
/v2/images/{image_id}/members
- Scope Types:
project
List image members
modify_member
- Default:
rule:context_is_admin or (role:member and project_id:%(member_id)s)
- Operations:
PUT
/v2/images/{image_id}/members/{member_id}
- Scope Types:
project
Update image member
manage_image_cache
- Default:
rule:context_is_admin
- Scope Types:
project
Manage image cache
deactivate
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
POST
/v2/images/{image_id}/actions/deactivate
- Scope Types:
project
Deactivate image
reactivate
- Default:
rule:context_is_admin or (role:member and project_id:%(project_id)s)
- Operations:
POST
/v2/images/{image_id}/actions/reactivate
- Scope Types:
project
Reactivate image
copy_image
- Default:
rule:context_is_admin
- Operations:
POST
/v2/images/{image_id}/import
- Scope Types:
project
Copy existing image to other stores
get_task
- Default:
rule:default
- Operations:
GET
/v2/tasks/{task_id}
- Scope Types:
project
Get an image task.
This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.
get_tasks
- Default:
rule:default
- Operations:
GET
/v2/tasks
- Scope Types:
project
List tasks for all images.
This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.
add_task
- Default:
rule:default
- Operations:
POST
/v2/tasks
- Scope Types:
project
List tasks for all images.
This granular policy controls access to tasks, both from the tasks API as well as internal locations in Glance that use tasks (like import). Practically this cannot be more restrictive than the policy that controls import or things will break, and changing it from the default is almost certainly not what you want. Access to the external tasks API should be restricted as desired by the tasks_api_access policy. This may change in the future.
modify_task
- Default:
rule:default
- Operations:
DELETE
/v2/tasks/{task_id}
- Scope Types:
project
This policy is not used.
tasks_api_access
- Default:
rule:context_is_admin
- Operations:
GET
/v2/tasks/{task_id}
GET
/v2/tasks
POST
/v2/tasks
DELETE
/v2/tasks/{task_id}
- Scope Types:
project
This is a generic blanket policy for protecting all task APIs. It is not granular and will not allow you to separate writable and readable task operations into different roles.
metadef_default
- Default:
<empty string>
(no description provided)
metadef_admin
- Default:
rule:context_is_admin
(no description provided)
get_metadef_namespace
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}
- Scope Types:
project
Get a specific namespace.
get_metadef_namespaces
- Default:
rule:context_is_admin or (role:reader and project_id:%(project_id)s)
- Operations:
GET
/v2/metadefs/namespaces
- Scope Types:
project
List namespace.
modify_metadef_namespace
- Default:
rule:metadef_admin
- Operations:
PUT
/v2/metadefs/namespaces/{namespace_name}
- Scope Types:
project
Modify an existing namespace.
add_metadef_namespace
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces
- Scope Types:
project
Create a namespace.
delete_metadef_namespace
- Default:
rule:metadef_admin
- Operations:
DELETE
/v2/metadefs/namespaces/{namespace_name}
- Scope Types:
project
Delete a namespace.
get_metadef_object
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/objects/{object_name}
- Scope Types:
project
Get a specific object from a namespace.
get_metadef_objects
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/objects
- Scope Types:
project
Get objects from a namespace.
modify_metadef_object
- Default:
rule:metadef_admin
- Operations:
PUT
/v2/metadefs/namespaces/{namespace_name}/objects/{object_name}
- Scope Types:
project
Update an object within a namespace.
add_metadef_object
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/objects
- Scope Types:
project
Create an object within a namespace.
delete_metadef_object
- Default:
rule:metadef_admin
- Operations:
DELETE
/v2/metadefs/namespaces/{namespace_name}/objects/{object_name}
- Scope Types:
project
Delete an object within a namespace.
list_metadef_resource_types
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/resource_types
- Scope Types:
project
List meta definition resource types.
get_metadef_resource_type
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/resource_types
- Scope Types:
project
Get meta definition resource types associations.
add_metadef_resource_type_association
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/resource_types
- Scope Types:
project
Create meta definition resource types association.
remove_metadef_resource_type_association
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/resource_types/{name}
- Scope Types:
project
Delete meta definition resource types association.
get_metadef_property
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/properties/{property_name}
- Scope Types:
project
Get a specific meta definition property.
get_metadef_properties
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/properties
- Scope Types:
project
List meta definition properties.
modify_metadef_property
- Default:
rule:metadef_admin
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/properties/{property_name}
- Scope Types:
project
Update meta definition property.
add_metadef_property
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/properties
- Scope Types:
project
Create meta definition property.
remove_metadef_property
- Default:
rule:metadef_admin
- Operations:
DELETE
/v2/metadefs/namespaces/{namespace_name}/properties/{property_name}
- Scope Types:
project
Delete meta definition property.
get_metadef_tag
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}
- Scope Types:
project
Get tag definition.
get_metadef_tags
- Default:
rule:context_is_admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))
- Operations:
GET
/v2/metadefs/namespaces/{namespace_name}/tags
- Scope Types:
project
List tag definitions.
modify_metadef_tag
- Default:
rule:metadef_admin
- Operations:
PUT
/v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}
- Scope Types:
project
Update tag definition.
add_metadef_tag
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}
- Scope Types:
project
Add tag definition.
add_metadef_tags
- Default:
rule:metadef_admin
- Operations:
POST
/v2/metadefs/namespaces/{namespace_name}/tags
- Scope Types:
project
Create tag definitions.
delete_metadef_tag
- Default:
rule:metadef_admin
- Operations:
DELETE
/v2/metadefs/namespaces/{namespace_name}/tags/{tag_name}
- Scope Types:
project
Delete tag definition.
delete_metadef_tags
- Default:
rule:metadef_admin
- Operations:
DELETE
/v2/metadefs/namespaces/{namespace_name}/tags
- Scope Types:
project
Delete tag definitions.
cache_image
- Default:
rule:context_is_admin
- Operations:
PUT
/v2/cache/{image_id}
- Scope Types:
project
Queue image for caching
cache_list
- Default:
rule:context_is_admin
- Operations:
GET
/v2/cache
- Scope Types:
project
List cache status
cache_delete
- Default:
rule:context_is_admin
- Operations:
DELETE
/v2/cache
DELETE
/v2/cache/{image_id}
- Scope Types:
project
Delete image(s) from cache and/or queue
stores_info_detail
- Default:
rule:context_is_admin
- Operations:
GET
/v2/info/stores/detail
- Scope Types:
project
Expose store specific information