kraut security.yml proposal

security.yml

# security.yml
#
# Kraut security limits for operations
#
# FORMAT:
#   {operation} :
#       {operation property 1}: [ "{valid value 1}", ... ]
#       ...
#

# Default permission applied if no other permissions match?
security.default:
  security.user.role:
    - authenticated

# General orchestrate operations
orchestrate.*:
  security.user:
    - *  # wildcard

# UpCloud : start a server
upcloud.server.start:
  # security.user.role : property provided by the security wrapper
  security.user.role: 
    - admin
  # upcloud.server.label : one of the valid --{property} values for the operation
  upcloud.server.label:
    - this-project

# UpCloud : Destroy an UpCloud service
upcloud.server.stop:
  # security.user : property provided by the security wrapper
  security.user: 
    - jamesnesbitt
    - aleksijohansson
    - jannekoponen
  # upcloud.server.label : one of the valid --{property} values for the operation    
  upcloud.server.uuid:
    - AAAAAAA-AAAAAAA-AAAAA
    - BBBBBBB-BBBBBBB-BBBBB