c69b666610
bug #1042030 - adds admin-writable, world-readable router:external attribute to the network object if L3 extension is loaded. - prevents floating ips from being created unless network is external - shortens L3 extensions alias from 'os-quantum-router' to 'router' to make attribute extensions more readable. WIP: - Need to add policy logic so non-admin users can always see external networks without requiring that these networks are shared (since VMs can always create ports on shared networks, but provider may want to have externals networks that VMs cannot directly plug into. Random clean-up: - prevent delete_network in plugins from implying it returns something - modify extensions.py so that exceptions during calls to get_extended_resources() will actually be logged if unexpected. - unset executable bit on test_iptables_manager.py to make sure tox actually runs it. Change-Id: I5bbf063927b93458da7cb467d9ad5c92ebabbbf7
44 lines
1.6 KiB
JSON
44 lines
1.6 KiB
JSON
{
|
|
"admin_or_owner": [["role:admin"], ["tenant_id:%(tenant_id)s"]],
|
|
"admin_or_network_owner": [["role:admin"], ["tenant_id:%(network_tenant_id)s"]],
|
|
"admin_only": [["role:admin"]],
|
|
"regular_user": [],
|
|
"default": [["rule:admin_or_owner"]],
|
|
|
|
"extension:provider_network:view": [["rule:admin_only"]],
|
|
"extension:provider_network:set": [["rule:admin_only"]],
|
|
|
|
"extension:router:view": [["rule:regular_user"]],
|
|
"extension:router:set": [["rule:admin_only"]],
|
|
|
|
"networks:private:read": [["rule:admin_or_owner"]],
|
|
"networks:private:write": [["rule:admin_or_owner"]],
|
|
"networks:shared:read": [["rule:regular_user"]],
|
|
"networks:shared:write": [["rule:admin_only"]],
|
|
|
|
"subnets:private:read": [["rule:admin_or_owner"]],
|
|
"subnets:private:write": [["rule:admin_or_owner"]],
|
|
"subnets:shared:read": [["rule:regular_user"]],
|
|
"subnets:shared:write": [["rule:admin_only"]],
|
|
|
|
"create_subnet": [["rule:admin_or_network_owner"]],
|
|
"get_subnet": [],
|
|
"update_subnet": [["rule:admin_or_network_owner"]],
|
|
"delete_subnet": [["rule:admin_or_network_owner"]],
|
|
|
|
"create_network": [],
|
|
"get_network": [],
|
|
"create_network:shared": [["rule:admin_only"]],
|
|
"update_network": [],
|
|
"update_network:shared": [["rule:admin_only"]],
|
|
"delete_network": [],
|
|
|
|
"create_port": [],
|
|
"create_port:mac_address": [["rule:admin_or_network_owner"]],
|
|
"create_port:fixed_ips": [["rule:admin_or_network_owner"]],
|
|
"get_port": [["rule:admin_or_owner"]],
|
|
"update_port": [["rule:admin_or_owner"]],
|
|
"update_port:fixed_ips": [["rule:admin_or_network_owner"]],
|
|
"delete_port": [["rule:admin_or_owner"]]
|
|
}
|