# Defines the default rule used for policies that historically had an # empty policy in the supplied policy.json file. #"default": "" # DEPRECATED # "default":"role:admin" has been deprecated since Ussuri in favor of # "default":"". # In order to allow operators to accept the default policies from code # by not defining them in the policy file, while still working with # old policy files that rely on the ``default`` rule for policies that # are not specified in the policy file, the ``default`` rule must now # be explicitly set to ``"role:admin"`` when that is the desired # default for unspecified rules. # Defines the rule for the is_admin:True check. #"context_is_admin": "role:admin" # Create new image # POST /v2/images # Intended scope(s): system, project #"add_image": "role:admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)" # DEPRECATED # "add_image":"rule:default" has been deprecated since W in favor of # "add_image":"role:admin or (role:member and # project_id:%(project_id)s and project_id:%(owner)s)". # The image API now supports roles. # Deletes the image # DELETE /v2/images/{image_id} # Intended scope(s): system, project #"delete_image": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "delete_image":"rule:default" has been deprecated since W in favor # of "delete_image":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Get specified image # GET /v2/images/{image_id} # Intended scope(s): system, project #"get_image": "role:admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))" # DEPRECATED # "get_image":"rule:default" has been deprecated since W in favor of # "get_image":"role:admin or (role:reader and # (project_id:%(project_id)s or project_id:%(member_id)s or # 'community':%(visibility)s or 'public':%(visibility)s or # 'shared':%(visibility)s))". # The image API now supports roles. # Get all available images # GET /v2/images # Intended scope(s): system, project #"get_images": "role:admin or (role:reader and project_id:%(project_id)s)" # DEPRECATED # "get_images":"rule:default" has been deprecated since W in favor of # "get_images":"role:admin or (role:reader and # project_id:%(project_id)s)". # The image API now supports roles. # Updates given image # PATCH /v2/images/{image_id} # Intended scope(s): system, project #"modify_image": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "modify_image":"rule:default" has been deprecated since W in favor # of "modify_image":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Publicize given image # PATCH /v2/images/{image_id} # Intended scope(s): system, project #"publicize_image": "role:admin" # Communitize given image # PATCH /v2/images/{image_id} # Intended scope(s): system, project #"communitize_image": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "communitize_image":"rule:default" has been deprecated since W in # favor of "communitize_image":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Downloads given image # GET /v2/images/{image_id}/file # Intended scope(s): system, project #"download_image": "role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))" # DEPRECATED # "download_image":"rule:default" has been deprecated since W in favor # of "download_image":"role:admin or (role:member and # (project_id:%(project_id)s or project_id:%(member_id)s or # 'community':%(visibility)s or 'public':%(visibility)s or # 'shared':%(visibility)s))". # The image API now supports roles. # Uploads data to specified image # PUT /v2/images/{image_id}/file # Intended scope(s): system, project #"upload_image": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "upload_image":"rule:default" has been deprecated since W in favor # of "upload_image":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Deletes the location of given image # PATCH /v2/images/{image_id} # Intended scope(s): system, project #"delete_image_location": "role:admin" # DEPRECATED # "delete_image_location":"rule:default" has been deprecated since W # in favor of "delete_image_location":"role:admin". # The image API now supports roles. # Reads the location of the image # GET /v2/images/{image_id} # Intended scope(s): system, project #"get_image_location": "role:admin or (role:reader and project_id:%(project_id)s)" # DEPRECATED # "get_image_location":"rule:default" has been deprecated since W in # favor of "get_image_location":"role:admin or (role:reader and # project_id:%(project_id)s)". # The image API now supports roles. # Sets location URI to given image # PATCH /v2/images/{image_id} # Intended scope(s): system, project #"set_image_location": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "set_image_location":"rule:default" has been deprecated since W in # favor of "set_image_location":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Create image member # POST /v2/images/{image_id}/members # Intended scope(s): system, project #"add_member": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "add_member":"rule:default" has been deprecated since W in favor of # "add_member":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Delete image member # DELETE /v2/images/{image_id}/members/{member_id} # Intended scope(s): system, project #"delete_member": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "delete_member":"rule:default" has been deprecated since W in favor # of "delete_member":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Show image member details # GET /v2/images/{image_id}/members/{member_id} # Intended scope(s): system, project #"get_member": "role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)" # DEPRECATED # "get_member":"rule:default" has been deprecated since W in favor of # "get_member":"role:admin or role:reader and # (project_id:%(project_id)s or project_id:%(member_id)s)". # The image API now supports roles. # List image members # GET /v2/images/{image_id}/members # Intended scope(s): system, project #"get_members": "role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)" # DEPRECATED # "get_members":"rule:default" has been deprecated since W in favor of # "get_members":"role:admin or role:reader and # (project_id:%(project_id)s or project_id:%(member_id)s)". # The image API now supports roles. # Update image member # PUT /v2/images/{image_id}/members/{member_id} # Intended scope(s): system, project #"modify_member": "role:admin or (role:member and project_id:%(member_id)s)" # DEPRECATED # "modify_member":"rule:default" has been deprecated since W in favor # of "modify_member":"role:admin or (role:member and # project_id:%(member_id)s)". # The image API now supports roles. # Manage image cache # Intended scope(s): system, project #"manage_image_cache": "role:admin" # Deactivate image # POST /v2/images/{image_id}/actions/deactivate # Intended scope(s): system, project #"deactivate": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "deactivate":"rule:default" has been deprecated since W in favor of # "deactivate":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Reactivate image # POST /v2/images/{image_id}/actions/reactivate # Intended scope(s): system, project #"reactivate": "role:admin or (role:member and project_id:%(project_id)s)" # DEPRECATED # "reactivate":"rule:default" has been deprecated since W in favor of # "reactivate":"role:admin or (role:member and # project_id:%(project_id)s)". # The image API now supports roles. # Copy existing image to other stores # POST /v2/images/{image_id}/import # Intended scope(s): system, project #"copy_image": "role:admin" # Get an image task. # # This granular policy controls access to tasks, both from the tasks # API as well as internal locations in Glance that use tasks (like # import). Practically this cannot be more restrictive than the policy # that controls import or things will break, and changing it from the # default is almost certainly not what you want. Access to the # external tasks API should be restricted as desired by the # tasks_api_access policy. This may change in the future. # GET /v2/tasks/{task_id} # Intended scope(s): system, project #"get_task": "rule:default" # DEPRECATED # "get_task":"rule:default" has been deprecated since X in favor of # "get_task":"rule:default". # From Xena we are enforcing policy checks in the API and policy layer # where task policies were enforcing will be removed. Since task APIs # are already deprecated and `tasks_api_access` is checked for each # API at API layer, there will be no benefit of other having other # task related policies. # List tasks for all images. # # This granular policy controls access to tasks, both from the tasks # API as well as internal locations in Glance that use tasks (like # import). Practically this cannot be more restrictive than the policy # that controls import or things will break, and changing it from the # default is almost certainly not what you want. Access to the # external tasks API should be restricted as desired by the # tasks_api_access policy. This may change in the future. # GET /v2/tasks # Intended scope(s): system, project #"get_tasks": "rule:default" # DEPRECATED # "get_tasks":"rule:default" has been deprecated since X in favor of # "get_tasks":"rule:default". # From Xena we are enforcing policy checks in the API and policy layer # where task policies were enforcing will be removed. Since task APIs # are already deprecated and `tasks_api_access` is checked for each # API at API layer, there will be no benefit of other having other # task related policies. # List tasks for all images. # # This granular policy controls access to tasks, both from the tasks # API as well as internal locations in Glance that use tasks (like # import). Practically this cannot be more restrictive than the policy # that controls import or things will break, and changing it from the # default is almost certainly not what you want. Access to the # external tasks API should be restricted as desired by the # tasks_api_access policy. This may change in the future. # POST /v2/tasks # Intended scope(s): system, project #"add_task": "rule:default" # DEPRECATED # "add_task":"rule:default" has been deprecated since X in favor of # "add_task":"rule:default". # From Xena we are enforcing policy checks in the API and policy layer # where task policies were enforcing will be removed. Since task APIs # are already deprecated and `tasks_api_access` is checked for each # API at API layer, there will be no benefit of other having other # task related policies. # DEPRECATED # "modify_task" has been deprecated since W. # This policy check has never been honored by the API. It will be # removed in a future release. # This policy is not used. # DELETE /v2/tasks/{task_id} # Intended scope(s): system, project #"modify_task": "rule:default" # This is a generic blanket policy for protecting all task APIs. It is # not granular and will not allow you to separate writable and # readable task operations into different roles. # GET /v2/tasks/{task_id} # GET /v2/tasks # POST /v2/tasks # DELETE /v2/tasks/{task_id} # Intended scope(s): system, project #"tasks_api_access": "role:admin" #"metadef_default": "" #"metadef_admin": "role:admin" # Get a specific namespace. # GET /v2/metadefs/namespaces/{namespace_name} # Intended scope(s): system, project #"get_metadef_namespace": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_namespace":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_namespace":"role:admin or # (role:reader and (project_id:%(project_id)s or # 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # List namespace. # GET /v2/metadefs/namespaces # Intended scope(s): system, project #"get_metadef_namespaces": "role:admin or (role:reader and project_id:%(project_id)s)" # DEPRECATED # "get_metadef_namespaces":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_namespaces":"role:admin or # (role:reader and project_id:%(project_id)s)". # The metadata API now supports project scope and default roles. # Modify an existing namespace. # PUT /v2/metadefs/namespaces/{namespace_name} # Intended scope(s): system, project #"modify_metadef_namespace": "rule:metadef_admin" # Create a namespace. # POST /v2/metadefs/namespaces # Intended scope(s): system, project #"add_metadef_namespace": "rule:metadef_admin" # Delete a namespace. # DELETE /v2/metadefs/namespaces/{namespace_name} # Intended scope(s): system, project #"delete_metadef_namespace": "rule:metadef_admin" # Get a specific object from a namespace. # GET /v2/metadefs/namespaces/{namespace_name}/objects/{object_name} # Intended scope(s): system, project #"get_metadef_object": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_object":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_object":"role:admin or (role:reader # and (project_id:%(project_id)s or 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Get objects from a namespace. # GET /v2/metadefs/namespaces/{namespace_name}/objects # Intended scope(s): system, project #"get_metadef_objects": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_objects":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_objects":"role:admin or # (role:reader and (project_id:%(project_id)s or # 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Update an object within a namespace. # PUT /v2/metadefs/namespaces/{namespace_name}/objects/{object_name} # Intended scope(s): system, project #"modify_metadef_object": "rule:metadef_admin" # Create an object within a namespace. # POST /v2/metadefs/namespaces/{namespace_name}/objects # Intended scope(s): system, project #"add_metadef_object": "rule:metadef_admin" # Delete an object within a namespace. # DELETE /v2/metadefs/namespaces/{namespace_name}/objects/{object_name} # Intended scope(s): system, project #"delete_metadef_object": "rule:metadef_admin" # List meta definition resource types. # GET /v2/metadefs/resource_types # Intended scope(s): system, project #"list_metadef_resource_types": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "list_metadef_resource_types":"rule:metadef_default" has been # deprecated since X in favor of # "list_metadef_resource_types":"role:admin or (role:reader and # (project_id:%(project_id)s or 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Get meta definition resource types associations. # GET /v2/metadefs/namespaces/{namespace_name}/resource_types # Intended scope(s): system, project #"get_metadef_resource_type": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_resource_type":"rule:metadef_default" has been # deprecated since X in favor of # "get_metadef_resource_type":"role:admin or (role:reader and # (project_id:%(project_id)s or 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Create meta definition resource types association. # POST /v2/metadefs/namespaces/{namespace_name}/resource_types # Intended scope(s): system, project #"add_metadef_resource_type_association": "rule:metadef_admin" # Delete meta definition resource types association. # POST /v2/metadefs/namespaces/{namespace_name}/resource_types/{name} # Intended scope(s): system, project #"remove_metadef_resource_type_association": "rule:metadef_admin" # Get a specific meta definition property. # GET /v2/metadefs/namespaces/{namespace_name}/properties/{property_name} # Intended scope(s): system, project #"get_metadef_property": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_property":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_property":"role:admin or # (role:reader and (project_id:%(project_id)s or # 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # List meta definition properties. # GET /v2/metadefs/namespaces/{namespace_name}/properties # Intended scope(s): system, project #"get_metadef_properties": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_properties":"rule:metadef_default" has been deprecated # since X in favor of "get_metadef_properties":"role:admin or # (role:reader and (project_id:%(project_id)s or # 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Update meta definition property. # GET /v2/metadefs/namespaces/{namespace_name}/properties/{property_name} # Intended scope(s): system, project #"modify_metadef_property": "rule:metadef_admin" # Create meta definition property. # POST /v2/metadefs/namespaces/{namespace_name}/properties # Intended scope(s): system, project #"add_metadef_property": "rule:metadef_admin" # Delete meta definition property. # DELETE /v2/metadefs/namespaces/{namespace_name}/properties/{property_name} # Intended scope(s): system, project #"remove_metadef_property": "rule:metadef_admin" # Get tag definition. # GET /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name} # Intended scope(s): system, project #"get_metadef_tag": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_tag":"rule:metadef_default" has been deprecated since X # in favor of "get_metadef_tag":"role:admin or (role:reader and # (project_id:%(project_id)s or 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # List tag definitions. # GET /v2/metadefs/namespaces/{namespace_name}/tags # Intended scope(s): system, project #"get_metadef_tags": "role:admin or (role:reader and (project_id:%(project_id)s or 'public':%(visibility)s))" # DEPRECATED # "get_metadef_tags":"rule:metadef_default" has been deprecated since # X in favor of "get_metadef_tags":"role:admin or (role:reader and # (project_id:%(project_id)s or 'public':%(visibility)s))". # The metadata API now supports project scope and default roles. # Update tag definition. # PUT /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name} # Intended scope(s): system, project #"modify_metadef_tag": "rule:metadef_admin" # Add tag definition. # POST /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name} # Intended scope(s): system, project #"add_metadef_tag": "rule:metadef_admin" # Create tag definitions. # POST /v2/metadefs/namespaces/{namespace_name}/tags # Intended scope(s): system, project #"add_metadef_tags": "rule:metadef_admin" # Delete tag definition. # DELETE /v2/metadefs/namespaces/{namespace_name}/tags/{tag_name} # Intended scope(s): system, project #"delete_metadef_tag": "rule:metadef_admin" # Delete tag definitions. # DELETE /v2/metadefs/namespaces/{namespace_name}/tags # Intended scope(s): system, project #"delete_metadef_tags": "rule:metadef_admin" # Queue image for caching # PUT /v2/cache/{image_id} # Intended scope(s): project #"cache_image": "role:admin" # DEPRECATED # "cache_image":"rule:manage_image_cache" has been deprecated since X # in favor of "cache_image":"role:admin". # The image API now supports roles. # List cache status # GET /v2/cache # Intended scope(s): project #"cache_list": "role:admin" # DEPRECATED # "cache_list":"rule:manage_image_cache" has been deprecated since X # in favor of "cache_list":"role:admin". # The image API now supports roles. # Delete image(s) from cache and/or queue # DELETE /v2/cache # DELETE /v2/cache/{image_id} # Intended scope(s): project #"cache_delete": "role:admin" # DEPRECATED # "cache_delete":"rule:manage_image_cache" has been deprecated since X # in favor of "cache_delete":"role:admin". # The image API now supports roles. # Expose store specific information # GET /v2/info/stores/detail # Intended scope(s): system, project #"stores_info_detail": "role:admin"