Policy configuration¶

cinder¶

context_is_admin

Default

role:admin

Decides what is required for the ‘is_admin:True’ check to succeed.

admin_or_owner

Default

is_admin:True or (role:admin and is_admin_project:True) or project_id:%(project_id)s

Default rule for most non-Admin APIs.

admin_api

Default

is_admin:True or (role:admin and is_admin_project:True)

Default rule for most Admin APIs.

system_or_domain_or_project_admin

Default

(role:admin and system_scope:all) or (role:admin and domain_id:%(domain_id)s) or (role:admin and project_id:%(project_id)s)

Default rule for admins of cloud, domain or a project.

volume:attachment_create

Default

<empty string>

Operations

• POST /attachments

Create attachment.

volume:attachment_update

Default

rule:admin_or_owner

Operations

• PUT /attachments/{attachment_id}

Update attachment.

volume:attachment_delete

Default

rule:admin_or_owner

Operations

• DELETE /attachments/{attachment_id}

Delete attachment.

volume:attachment_complete

Default

rule:admin_or_owner

Operations

• POST /attachments/{attachment_id}/action (os-complete)

Mark a volume attachment process as completed (in-use)

volume:multiattach_bootable_volume

Default

rule:admin_or_owner

Operations

• POST /attachments

Allow multiattach of bootable volumes.

message:get_all

Default

rule:admin_or_owner

Operations

• GET /messages

List messages.

message:get

Default

rule:admin_or_owner

Operations

• GET /messages/{message_id}

Show message.

message:delete

Default

rule:admin_or_owner

Operations

• DELETE /messages/{message_id}

Delete message.

clusters:get_all

Default

rule:admin_api

Operations

• GET /clusters

• GET /clusters/detail

List clusters.

clusters:get

Default

rule:admin_api

Operations

• GET /clusters/{cluster_id}

Show cluster.

clusters:update

Default

rule:admin_api

Operations

• PUT /clusters/{cluster_id}

Update cluster.

workers:cleanup

Default

rule:admin_api

Operations

• POST /workers/cleanup

Clean up workers.

volume:get_snapshot_metadata

Default

rule:admin_or_owner

Operations

• GET /snapshots/{snapshot_id}/metadata

• GET /snapshots/{snapshot_id}/metadata/{key}

Show snapshot’s metadata or one specified metadata with a given key.

volume:update_snapshot_metadata

Default

rule:admin_or_owner

Operations

• PUT /snapshots/{snapshot_id}/metadata

• PUT /snapshots/{snapshot_id}/metadata/{key}

Update snapshot’s metadata or one specified metadata with a given key.

volume:delete_snapshot_metadata

Default

rule:admin_or_owner

Operations

• DELETE /snapshots/{snapshot_id}/metadata/{key}

Delete snapshot’s specified metadata with a given key.

volume:get_all_snapshots

Default

rule:admin_or_owner

Operations

• GET /snapshots

• GET /snapshots/detail

List snapshots.

volume_extension:extended_snapshot_attributes

Default

rule:admin_or_owner

Operations

• GET /snapshots/{snapshot_id}

• GET /snapshots/detail

List or show snapshots with extended attributes.

volume:create_snapshot

Default

rule:admin_or_owner

Operations

• POST /snapshots

Create snapshot.

volume:get_snapshot

Default

rule:admin_or_owner

Operations

• GET /snapshots/{snapshot_id}

Show snapshot.

volume:update_snapshot

Default

rule:admin_or_owner

Operations

• PUT /snapshots/{snapshot_id}

Update snapshot.

volume:delete_snapshot

Default

rule:admin_or_owner

Operations

• DELETE /snapshots/{snapshot_id}

Delete snapshot.

volume_extension:snapshot_admin_actions:reset_status

Default

rule:admin_api

Operations

• POST /snapshots/{snapshot_id}/action (os-reset_status)

Reset status of a snapshot.

snapshot_extension:snapshot_actions:update_snapshot_status

Default

<empty string>

Operations

• POST /snapshots/{snapshot_id}/action (update_snapshot_status)

Update database fields of snapshot.

volume_extension:snapshot_admin_actions:force_delete

Default

rule:admin_api

Operations

• POST /snapshots/{snapshot_id}/action (os-force_delete)

Force delete a snapshot.

snapshot_extension:list_manageable

Default

rule:admin_api

Operations

• GET /manageable_snapshots

• GET /manageable_snapshots/detail

List (in detail) of snapshots which are available to manage.

snapshot_extension:snapshot_manage

Default

rule:admin_api

Operations

• POST /manageable_snapshots

Manage an existing snapshot.

snapshot_extension:snapshot_unmanage

Default

rule:admin_api

Operations

• POST /snapshots/{snapshot_id}/action (os-unmanage)

Stop managing a snapshot.

backup:get_all

Default

rule:admin_or_owner

Operations

• GET /backups

• GET /backups/detail

List backups.

backup:backup_project_attribute

Default

rule:admin_api

Operations

• GET /backups/{backup_id}

• GET /backups/detail

List backups or show backup with project attributes.

backup:create

Default

<empty string>

Operations

• POST /backups

Create backup.

backup:get

Default

rule:admin_or_owner

Operations

• GET /backups/{backup_id}

Show backup.

backup:update

Default

rule:admin_or_owner

Operations

• PUT /backups/{backup_id}

Update backup.

backup:delete

Default

rule:admin_or_owner

Operations

• DELETE /backups/{backup_id}

Delete backup.

backup:restore

Default

rule:admin_or_owner

Operations

• POST /backups/{backup_id}/restore

Restore backup.

backup:backup-import

Default

rule:admin_api

Operations

• POST /backups/{backup_id}/import_record

Import backup.

backup:export-import

Default

rule:admin_api

Operations

• POST /backups/{backup_id}/export_record

Export backup.

volume_extension:backup_admin_actions:reset_status

Default

rule:admin_api

Operations

• POST /backups/{backup_id}/action (os-reset_status)

Reset status of a backup.

volume_extension:backup_admin_actions:force_delete

Default

rule:admin_api

Operations

• POST /backups/{backup_id}/action (os-force_delete)

Force delete a backup.

group:get_all

Default

rule:admin_or_owner

Operations

• GET /groups

• GET /groups/detail

List groups.

group:create

Default

<empty string>

Operations

• POST /groups

Create group.

group:get

Default

rule:admin_or_owner

Operations

• GET /groups/{group_id}

Show group.

group:update

Default

rule:admin_or_owner

Operations

• PUT /groups/{group_id}

Update group.

group:group_project_attribute

Default

rule:admin_api

Operations

• GET /groups/{group_id}

• GET /groups/detail

List groups or show group with project attributes.

group:group_types_manage

Default

rule:admin_api

Operations

• POST /group_types/

• PUT /group_types/{group_type_id}

• DELETE /group_types/{group_type_id}

Create, update or delete a group type.

group:access_group_types_specs

Default

rule:admin_api

Operations

• GET /group_types/{group_type_id}

Show group type with type specs attributes.

group:group_types_specs

Default

rule:admin_api

Operations

• GET /group_types/{group_type_id}/group_specs/{g_spec_id}

• GET /group_types/{group_type_id}/group_specs

• POST /group_types/{group_type_id}/group_specs

• PUT /group_types/{group_type_id}/group_specs/{g_spec_id}

• DELETE /group_types/{group_type_id}/group_specs/{g_spec_id}

Create, show, update and delete group type spec.

group:get_all_group_snapshots

Default

rule:admin_or_owner

Operations

• GET /group_snapshots

• GET /group_snapshots/detail

List group snapshots.

group:create_group_snapshot

Default

<empty string>

Operations

• POST /group_snapshots

Create group snapshot.

group:get_group_snapshot

Default

rule:admin_or_owner

Operations

• GET /group_snapshots/{group_snapshot_id}

Show group snapshot.

group:delete_group_snapshot

Default

rule:admin_or_owner

Operations

• DELETE /group_snapshots/{group_snapshot_id}

Delete group snapshot.

group:update_group_snapshot

Default

rule:admin_or_owner

Operations

• PUT /group_snapshots/{group_snapshot_id}

Update group snapshot.

group:group_snapshot_project_attribute

Default

rule:admin_api

Operations

• GET /group_snapshots/{group_snapshot_id}

• GET /group_snapshots/detail

List group snapshots or show group snapshot with project attributes.

group:reset_group_snapshot_status

Default

rule:admin_or_owner

Operations

• POST /group_snapshots/{g_snapshot_id}/action (reset_status)

Reset status of group snapshot.

group:delete

Default

rule:admin_or_owner

Operations

• POST /groups/{group_id}/action (delete)

Delete group.

group:reset_status

Default

rule:admin_api

Operations

• POST /groups/{group_id}/action (reset_status)

Reset status of group.

group:enable_replication

Default

rule:admin_or_owner

Operations

• POST /groups/{group_id}/action (enable_replication)

Enable replication.

group:disable_replication

Default

rule:admin_or_owner

Operations

• POST /groups/{group_id}/action (disable_replication)

Disable replication.

group:failover_replication

Default

rule:admin_or_owner

Operations

• POST /groups/{group_id}/action (failover_replication)

Fail over replication.

group:list_replication_targets

Default

rule:admin_or_owner

Operations

• POST /groups/{group_id}/action (list_replication_targets)

List failover replication.

volume_extension:qos_specs_manage:get_all

Default

rule:admin_api

Operations

• GET /qos-specs

• GET /qos-specs/{qos_id}/associations

List qos specs or list all associations.

volume_extension:qos_specs_manage:get

Default

rule:admin_api

Operations

• GET /qos-specs/{qos_id}

Show qos specs.

volume_extension:qos_specs_manage:create

Default

rule:admin_api

Operations

• POST /qos-specs

Create qos specs.

volume_extension:qos_specs_manage:update

Default

rule:admin_api

Operations

• PUT /qos-specs/{qos_id}

• GET /qos-specs/{qos_id}/disassociate_all

• GET /qos-specs/{qos_id}/associate

• GET /qos-specs/{qos_id}/disassociate

Update qos specs (including updating association).

volume_extension:qos_specs_manage:delete

Default

rule:admin_api

Operations

• DELETE /qos-specs/{qos_id}

• PUT /qos-specs/{qos_id}/delete_keys

delete qos specs or unset one specified qos key.

volume_extension:quota_classes

Default

rule:admin_api

Operations

• GET /os-quota-class-sets/{project_id}

• PUT /os-quota-class-sets/{project_id}

Show or update project quota class.

volume_extension:quotas:show

Default

rule:admin_or_owner

Operations

• GET /os-quota-sets/{project_id}

• GET /os-quota-sets/{project_id}/default

• GET /os-quota-sets/{project_id}?usage=True

Show project quota (including usage and default).

volume_extension:quotas:update

Default

rule:admin_api

Operations

• PUT /os-quota-sets/{project_id}

Update project quota.

volume_extension:quotas:delete

Default

rule:admin_api

Operations

• DELETE /os-quota-sets/{project_id}

Delete project quota.

volume_extension:quota_classes:validate_setup_for_nested_quota_use

Default

rule:admin_api

Operations

• GET /os-quota-sets/validate_setup_for_nested_quota_use

Validate setup for nested quota.

volume_extension:capabilities

Default

rule:admin_api

Operations

• GET /capabilities/{host_name}

Show backend capabilities.

volume_extension:services:index

Default

rule:admin_api

Operations

• GET /os-services

List all services.

volume_extension:services:update

Default

rule:admin_api

Operations

• PUT /os-services/{action}

Update service, including failover_host, thaw, freeze, disable, enable, set-log and get-log actions.

volume:freeze_host

Default

rule:admin_api

Operations

• PUT /os-services/freeze

Freeze a backend host.

volume:thaw_host

Default

rule:admin_api

Operations

• PUT /os-services/thaw

Thaw a backend host.

volume:failover_host

Default

rule:admin_api

Operations

• PUT /os-services/failover_host

Failover a backend host.

scheduler_extension:scheduler_stats:get_pools

Default

rule:admin_api

Operations

• GET /scheduler-stats/get_pools

List all backend pools.

volume_extension:hosts

Default

rule:admin_api

Operations

• GET /os-hosts

• PUT /os-hosts/{host_name}

• GET /os-hosts/{host_id}

List, update or show hosts for a project.

limits_extension:used_limits

Default

rule:admin_or_owner

Operations

• GET /limits

Show limits with used limit attributes.

volume_extension:list_manageable

Default

rule:admin_api

Operations

• GET /manageable_volumes

• GET /manageable_volumes/detail

List (in detail) of volumes which are available to manage.

volume_extension:volume_manage

Default

rule:admin_api

Operations

• POST /manageable_volumes

Manage existing volumes.

volume_extension:volume_unmanage

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-unmanage)

Stop managing a volume.

volume_extension:types_manage

Default

rule:admin_api

Operations

• POST /types

• PUT /types

• DELETE /types

Create, update and delete volume type.

volume_extension:type_get

Default

<empty string>

Operations

• GET /types/{type_id}

Get one specific volume type.

volume_extension:type_get_all

Default

<empty string>

Operations

• GET /types/

List volume types.

volume_extension:volume_type_encryption

Default

rule:admin_api

Operations

• POST /types/{type_id}/encryption

• PUT /types/{type_id}/encryption/{encryption_id}

• GET /types/{type_id}/encryption

• GET /types/{type_id}/encryption/{key}

• DELETE /types/{type_id}/encryption/{encryption_id}

Base policy for all volume type encryption type operations. This can be used to set the policies for a volume type’s encryption type create, show, update, and delete actions in one place, or any of those may be set individually using the following policy targets for finer grained control.

volume_extension:volume_type_encryption:create

Default

rule:volume_extension:volume_type_encryption

Operations

• POST /types/{type_id}/encryption

Create volume type encryption.

volume_extension:volume_type_encryption:get

Default

rule:volume_extension:volume_type_encryption

Operations

• GET /types/{type_id}/encryption

• GET /types/{type_id}/encryption/{key}

Show a volume type’s encryption type, show an encryption specs item.

volume_extension:volume_type_encryption:update

Default

rule:volume_extension:volume_type_encryption

Operations

• PUT /types/{type_id}/encryption/{encryption_id}

Update volume type encryption.

volume_extension:volume_type_encryption:delete

Default

rule:volume_extension:volume_type_encryption

Operations

• DELETE /types/{type_id}/encryption/{encryption_id}

Delete volume type encryption.

volume_extension:access_types_extra_specs

Default

rule:admin_api

Operations

• GET /types/{type_id}

• GET /types

List or show volume type with access type extra specs attribute.

volume_extension:access_types_qos_specs_id

Default

rule:admin_api

Operations

• GET /types/{type_id}

• GET /types

List or show volume type with access type qos specs id attribute.

volume_extension:volume_type_access

Default

rule:admin_or_owner

Operations

• GET /types

• GET /types/detail

• GET /types/{type_id}

• POST /types

Volume type access related APIs.

volume_extension:volume_type_access:addProjectAccess

Default

rule:admin_api

Operations

• POST /types/{type_id}/action (addProjectAccess)

Add volume type access for project.

volume_extension:volume_type_access:removeProjectAccess

Default

rule:admin_api

Operations

• POST /types/{type_id}/action (removeProjectAccess)

Remove volume type access for project.

volume:extend

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-extend)

Extend a volume.

volume:extend_attached_volume

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-extend)

Extend a attached volume.

volume:revert_to_snapshot

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (revert)

Revert a volume to a snapshot.

volume_extension:volume_admin_actions:reset_status

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-reset_status)

Reset status of a volume.

volume:retype

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-retype)

Retype a volume.

volume:update_readonly_flag

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-update_readonly_flag)

Update a volume’s readonly flag.

volume_extension:volume_admin_actions:force_delete

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-force_delete)

Force delete a volume.

volume_extension:volume_actions:upload_public

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-volume_upload_image)

Upload a volume to image with public visibility.

volume_extension:volume_actions:upload_image

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-volume_upload_image)

Upload a volume to image.

volume_extension:volume_admin_actions:force_detach

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-force_detach)

Force detach a volume.

volume_extension:volume_admin_actions:migrate_volume

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-migrate_volume)

migrate a volume to a specified host.

volume_extension:volume_admin_actions:migrate_volume_completion

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-migrate_volume_completion)

Complete a volume migration.

volume_extension:volume_actions:initialize_connection

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-initialize_connection)

Initialize volume attachment.

volume_extension:volume_actions:terminate_connection

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-terminate_connection)

Terminate volume attachment.

volume_extension:volume_actions:roll_detaching

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-roll_detaching)

Roll back volume status to ‘in-use’.

volume_extension:volume_actions:reserve

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-reserve)

Mark volume as reserved.

volume_extension:volume_actions:unreserve

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-unreserve)

Unmark volume as reserved.

volume_extension:volume_actions:begin_detaching

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-begin_detaching)

Begin detach volumes.

volume_extension:volume_actions:attach

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-attach)

Add attachment metadata.

volume_extension:volume_actions:detach

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/action (os-detach)

Clear attachment metadata.

volume:get_all_transfers

Default

rule:admin_or_owner

Operations

• GET /os-volume-transfer

• GET /os-volume-transfer/detail

• GET /volume_transfers

• GET /volume-transfers/detail

List volume transfer.

volume:create_transfer

Default

rule:admin_or_owner

Operations

• POST /os-volume-transfer

• POST /volume_transfers

Create a volume transfer.

volume:get_transfer

Default

rule:admin_or_owner

Operations

• GET /os-volume-transfer/{transfer_id}

• GET /volume-transfers/{transfer_id}

Show one specified volume transfer.

volume:accept_transfer

Default

<empty string>

Operations

• POST /os-volume-transfer/{transfer_id}/accept

• POST /volume-transfers/{transfer_id}/accept

Accept a volume transfer.

volume:delete_transfer

Default

rule:admin_or_owner

Operations

• DELETE /os-volume-transfer/{transfer_id}

• DELETE /volume-transfers/{transfer_id}

Delete volume transfer.

volume:get_volume_metadata

Default

rule:admin_or_owner

Operations

• GET /volumes/{volume_id}/metadata

• GET /volumes/{volume_id}/metadata/{key}

Show volume’s metadata or one specified metadata with a given key.

volume:create_volume_metadata

Default

rule:admin_or_owner

Operations

• POST /volumes/{volume_id}/metadata

Create volume metadata.

volume:update_volume_metadata

Default

rule:admin_or_owner

Operations

• PUT /volumes/{volume_id}/metadata

• PUT /volumes/{volume_id}/metadata/{key}

Update volume’s metadata or one specified metadata with a given key.

volume:delete_volume_metadata

Default

rule:admin_or_owner

Operations

• DELETE /volumes/{volume_id}/metadata/{key}

Delete volume’s specified metadata with a given key.

volume_extension:volume_image_metadata

Default

rule:admin_or_owner

Operations

• GET /volumes/detail

• GET /volumes/{volume_id}

• POST /volumes/{volume_id}/action (os-set_image_metadata)

• POST /volumes/{volume_id}/action (os-unset_image_metadata)

Volume’s image metadata related operation, create, delete, show and list.

volume:update_volume_admin_metadata

Default

rule:admin_api

Operations

• POST /volumes/{volume_id}/action (os-update_readonly_flag)

• POST /volumes/{volume_id}/action (os-attach)

Update volume admin metadata. It’s used in attach and os-update_readonly_flag APIs

volume_extension:types_extra_specs:index

Default

rule:admin_api

Operations

• GET /types/{type_id}/extra_specs

List type extra specs.

volume_extension:types_extra_specs:create

Default

rule:admin_api

Operations

• POST /types/{type_id}/extra_specs

Create type extra specs.

volume_extension:types_extra_specs:show

Default

rule:admin_api

Operations

• GET /types/{type_id}/extra_specs/{extra_spec_key}

Show one specified type extra specs.

volume_extension:types_extra_specs:update

Default

rule:admin_api

Operations

• PUT /types/{type_id}/extra_specs/{extra_spec_key}

Update type extra specs.

volume_extension:types_extra_specs:delete

Default

rule:admin_api

Operations

• DELETE /types/{type_id}/extra_specs/{extra_spec_key}

Delete type extra specs.

volume:create

Default

<empty string>

Operations

• POST /volumes

Create volume.

volume:create_from_image

Default

<empty string>

Operations

• POST /volumes

Create volume from image.

volume:get

Default

rule:admin_or_owner

Operations

• GET /volumes/{volume_id}

Show volume.

volume:get_all

Default

rule:admin_or_owner

Operations

• GET /volumes

• GET /volumes/detail

• GET /volumes/summary

List volumes or get summary of volumes.

volume:update

Default

rule:admin_or_owner

Operations

• PUT /volumes

• POST /volumes/{volume_id}/action (os-set_bootable)

Update volume or update a volume’s bootable status.

volume:delete

Default

rule:admin_or_owner

Operations

• DELETE /volumes/{volume_id}

Delete volume.

volume:force_delete

Default

rule:admin_api

Operations

• DELETE /volumes/{volume_id}

Force Delete a volume.

volume_extension:volume_host_attribute

Default

rule:admin_api

Operations

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with host attribute.

volume_extension:volume_tenant_attribute

Default

rule:admin_or_owner

Operations

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with tenant attribute.

volume_extension:volume_mig_status_attribute

Default

rule:admin_api

Operations

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with migration status attribute.

volume_extension:volume_encryption_metadata

Default

rule:admin_or_owner

Operations

• GET /volumes/{volume_id}/encryption

• GET /volumes/{volume_id}/encryption/{encryption_key}

Show volume’s encryption metadata.

volume:multiattach

Default

rule:admin_or_owner

Operations

• POST /volumes

Create multiattach capable volume.

volume_extension:default_set_or_update

Default

rule:system_or_domain_or_project_admin

Operations

• PUT /default-types

Scope Types

• system

Set or update default volume type.

volume_extension:default_get

Default

rule:system_or_domain_or_project_admin

Operations

• GET /default-types/{project-id}

Scope Types

• system

Get default types.

volume_extension:default_get_all

Default

role:admin and system_scope:all

Operations

• GET /default-types/

Scope Types

• system

Get all default types. WARNING: Changing this might open up too much information regarding cloud deployment.

volume_extension:default_unset

Default

rule:system_or_domain_or_project_admin

Operations

• DELETE /default-types/{project-id}

Scope Types

• system

Unset default type.