"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "keystone/common/policies/policy_association.py" between
keystone-16.0.1.tar.gz and keystone-17.0.0.tar.gz

About: OpenStack Keystone (Core Service: Identity) provides an authentication and authorization service for other OpenStack services. Provides a catalog of endpoints for all OpenStack services.
The "Ussuri" series (latest release).

policy_association.py  (keystone-16.0.1):policy_association.py  (keystone-17.0.0)
skipping to change at line 22 skipping to change at line 22
from oslo_log import versionutils from oslo_log import versionutils
from oslo_policy import policy from oslo_policy import policy
from keystone.common.policies import base from keystone.common.policies import base
# NOTE(lbragstad): Both endpoints and services are system-level resources. # NOTE(lbragstad): Both endpoints and services are system-level resources.
# System-scoped tokens should be required to manage policy associations to # System-scoped tokens should be required to manage policy associations to
# existing system-level resources. # existing system-level resources.
deprecated_check_policy_association_for_endpoint = policy.DeprecatedRule( deprecated_check_policy_assoc_for_endpoint = policy.DeprecatedRule(
name=base.IDENTITY % 'check_policy_association_for_endpoint', name=base.IDENTITY % 'check_policy_association_for_endpoint',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_check_policy_association_for_service = policy.DeprecatedRule( deprecated_check_policy_assoc_for_service = policy.DeprecatedRule(
name=base.IDENTITY % 'check_policy_association_for_service', name=base.IDENTITY % 'check_policy_association_for_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_check_policy_association_for_region_and_service = policy.DeprecatedRu le( deprecated_check_policy_assoc_for_region_and_service = policy.DeprecatedRule(
name=base.IDENTITY % 'check_policy_association_for_region_and_service', name=base.IDENTITY % 'check_policy_association_for_region_and_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_get_policy_for_endpoint = policy.DeprecatedRule( deprecated_get_policy_for_endpoint = policy.DeprecatedRule(
name=base.IDENTITY % 'get_policy_for_endpoint', name=base.IDENTITY % 'get_policy_for_endpoint',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_list_endpoints_for_policy = policy.DeprecatedRule( deprecated_list_endpoints_for_policy = policy.DeprecatedRule(
name=base.IDENTITY % 'list_endpoints_for_policy', name=base.IDENTITY % 'list_endpoints_for_policy',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_create_policy_association_for_endpoint = policy.DeprecatedRule( deprecated_create_policy_assoc_for_endpoint = policy.DeprecatedRule(
name=base.IDENTITY % 'create_policy_association_for_endpoint', name=base.IDENTITY % 'create_policy_association_for_endpoint',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_delete_policy_association_for_endpoint = policy.DeprecatedRule( deprecated_delete_policy_assoc_for_endpoint = policy.DeprecatedRule(
name=base.IDENTITY % 'delete_policy_association_for_endpoint', name=base.IDENTITY % 'delete_policy_association_for_endpoint',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_create_policy_association_for_service = policy.DeprecatedRule( deprecated_create_policy_assoc_for_service = policy.DeprecatedRule(
name=base.IDENTITY % 'create_policy_association_for_service', name=base.IDENTITY % 'create_policy_association_for_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_delete_policy_association_for_service = policy.DeprecatedRule( deprecated_delete_policy_assoc_for_service = policy.DeprecatedRule(
name=base.IDENTITY % 'delete_policy_association_for_service', name=base.IDENTITY % 'delete_policy_association_for_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_create_policy_association_for_region_and_service = policy.DeprecatedR ule( deprecated_create_policy_assoc_for_region_and_service = policy.DeprecatedRule(
name=base.IDENTITY % 'create_policy_association_for_region_and_service', name=base.IDENTITY % 'create_policy_association_for_region_and_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
deprecated_delete_policy_association_for_region_and_service = policy.DeprecatedR ule( deprecated_delete_policy_assoc_for_region_and_service = policy.DeprecatedRule(
name=base.IDENTITY % 'delete_policy_association_for_region_and_service', name=base.IDENTITY % 'delete_policy_association_for_region_and_service',
check_str=base.RULE_ADMIN_REQUIRED, check_str=base.RULE_ADMIN_REQUIRED,
) )
DEPRECATED_REASON = ( DEPRECATED_REASON = (
"The policy association API is now aware of system scope and default roles." "The policy association API is now aware of system scope and default "
"roles."
) )
policy_association_policies = [ policy_association_policies = [
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'create_policy_association_for_endpoint', name=base.IDENTITY % 'create_policy_association_for_endpoint',
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description='Associate a policy to a specific endpoint.', description='Associate a policy to a specific endpoint.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'endpoints/{endpoint_id}'), 'endpoints/{endpoint_id}'),
'method': 'PUT'}], 'method': 'PUT'}],
deprecated_rule=deprecated_create_policy_association_for_endpoint, deprecated_rule=deprecated_create_policy_assoc_for_endpoint,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'check_policy_association_for_endpoint', name=base.IDENTITY % 'check_policy_association_for_endpoint',
check_str=base.SYSTEM_READER, check_str=base.SYSTEM_READER,
scope_types=['system'], scope_types=['system'],
description='Check policy association for endpoint.', description='Check policy association for endpoint.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'endpoints/{endpoint_id}'), 'endpoints/{endpoint_id}'),
'method': 'GET'}, 'method': 'GET'},
{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'endpoints/{endpoint_id}'), 'endpoints/{endpoint_id}'),
'method': 'HEAD'}], 'method': 'HEAD'}],
deprecated_rule=deprecated_check_policy_association_for_endpoint, deprecated_rule=deprecated_check_policy_assoc_for_endpoint,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'delete_policy_association_for_endpoint', name=base.IDENTITY % 'delete_policy_association_for_endpoint',
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description='Delete policy association for endpoint.', description='Delete policy association for endpoint.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'endpoints/{endpoint_id}'), 'endpoints/{endpoint_id}'),
'method': 'DELETE'}], 'method': 'DELETE'}],
deprecated_rule=deprecated_delete_policy_association_for_endpoint, deprecated_rule=deprecated_delete_policy_assoc_for_endpoint,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'create_policy_association_for_service', name=base.IDENTITY % 'create_policy_association_for_service',
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description='Associate a policy to a specific service.', description='Associate a policy to a specific service.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}'), 'services/{service_id}'),
'method': 'PUT'}], 'method': 'PUT'}],
deprecated_rule=deprecated_create_policy_association_for_service, deprecated_rule=deprecated_create_policy_assoc_for_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'check_policy_association_for_service', name=base.IDENTITY % 'check_policy_association_for_service',
check_str=base.SYSTEM_READER, check_str=base.SYSTEM_READER,
scope_types=['system'], scope_types=['system'],
description='Check policy association for service.', description='Check policy association for service.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}'), 'services/{service_id}'),
'method': 'GET'}, 'method': 'GET'},
{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}'), 'services/{service_id}'),
'method': 'HEAD'}], 'method': 'HEAD'}],
deprecated_rule=deprecated_check_policy_association_for_service, deprecated_rule=deprecated_check_policy_assoc_for_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'delete_policy_association_for_service', name=base.IDENTITY % 'delete_policy_association_for_service',
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description='Delete policy association for service.', description='Delete policy association for service.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}'), 'services/{service_id}'),
'method': 'DELETE'}], 'method': 'DELETE'}],
deprecated_rule=deprecated_delete_policy_association_for_service, deprecated_rule=deprecated_delete_policy_assoc_for_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % ( name=base.IDENTITY % (
'create_policy_association_for_region_and_service'), 'create_policy_association_for_region_and_service'),
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description=('Associate a policy to a specific region and service ' description=('Associate a policy to a specific region and service '
'combination.'), 'combination.'),
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}/regions/{region_id}'), 'services/{service_id}/regions/{region_id}'),
'method': 'PUT'}], 'method': 'PUT'}],
deprecated_rule=deprecated_create_policy_association_for_region_and_serv ice, deprecated_rule=deprecated_create_policy_assoc_for_region_and_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'check_policy_association_for_region_and_service', name=base.IDENTITY % 'check_policy_association_for_region_and_service',
check_str=base.SYSTEM_READER, check_str=base.SYSTEM_READER,
scope_types=['system'], scope_types=['system'],
description='Check policy association for region and service.', description='Check policy association for region and service.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}/regions/{region_id}'), 'services/{service_id}/regions/{region_id}'),
'method': 'GET'}, 'method': 'GET'},
{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}/regions/{region_id}'), 'services/{service_id}/regions/{region_id}'),
'method': 'HEAD'}], 'method': 'HEAD'}],
deprecated_rule=deprecated_check_policy_association_for_region_and_servi ce, deprecated_rule=deprecated_check_policy_assoc_for_region_and_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % ( name=base.IDENTITY % (
'delete_policy_association_for_region_and_service'), 'delete_policy_association_for_region_and_service'),
check_str=base.SYSTEM_ADMIN, check_str=base.SYSTEM_ADMIN,
scope_types=['system'], scope_types=['system'],
description='Delete policy association for region and service.', description='Delete policy association for region and service.',
operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
'services/{service_id}/regions/{region_id}'), 'services/{service_id}/regions/{region_id}'),
'method': 'DELETE'}], 'method': 'DELETE'}],
deprecated_rule=deprecated_delete_policy_association_for_region_and_serv ice, deprecated_rule=deprecated_delete_policy_assoc_for_region_and_service,
deprecated_reason=DEPRECATED_REASON, deprecated_reason=DEPRECATED_REASON,
deprecated_since=versionutils.deprecated.TRAIN), deprecated_since=versionutils.deprecated.TRAIN),
policy.DocumentedRuleDefault( policy.DocumentedRuleDefault(
name=base.IDENTITY % 'get_policy_for_endpoint', name=base.IDENTITY % 'get_policy_for_endpoint',
check_str=base.SYSTEM_READER, check_str=base.SYSTEM_READER,
scope_types=['system'], scope_types=['system'],
description='Get policy for endpoint.', description='Get policy for endpoint.',
operations=[{'path': ('/v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/' operations=[{'path': ('/v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/'
'policy'), 'policy'),
'method': 'GET'}, 'method': 'GET'},
 End of changes. 19 change blocks. 
19 lines changed or deleted 20 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)