Openstack policy notes

N.B - Cinder implements policy as code. Following snippet will render DocumentedRuleDefault objects:

from importlib import import_module
from pprint import pformat
import sys

from oslo_policy.policy import DocumentedRuleDefault


SVC_MAP = dict(
    keystone='keystone.common.policies',
    cinder='cinder.policies',
    nova='nova.policies',
    heat='heat.policies'
)


def render_policies(service):
    lib = import_module(SVC_MAP.get(service))
    policies = list(filter(
        lambda x: isinstance(x, DocumentedRuleDefault),
        lib.list_rules())
    )

    def render_rule(rule):
        if not isinstance(rule, DocumentedRuleDefault):
            raise ValueError(rule)

        def render_targets():
            for op in rule._operations:
                yield f"{op['method']} {op['path']}"

        return f'{rule.name} {pformat(list(render_targets()))}'

    yield from map(render_rule, sorted(policies, key=lambda x: x.name))


if __name__ == '__main__':
    services = sys.argv[1:] or ('keystone', 'cinder', 'nova', 'heat')
    for svc in services:
        print('===', svc, '===')
        try:
            for policy in render_policies(svc):
                print(policy)
        except Exception as e:
            print(e, file=sys.stderr)

Neutron

Policy Definition: https://github.com/openstack/neutron/blob/stable/rocky/etc/policy.json

Policy Mapping:

extra:

https://github.com/openstack/neutron/blob/stable/rocky/doc/source/admin/archives/auth.rst

Nova

Policy Definition: https://docs.openstack.org/nova/rocky/_downloads/nova.policy.yaml.sample

Policy Mapping: https://docs.openstack.org/nova/rocky/_downloads/nova.policy.yaml.sample

Client API Binding call-to-policy action mappings

Cinder

cinderclient call	policy action
`.quotas.update()`	`volume_extension:quotas:update`
`.quotas.get()`	`volume_extension:quotas:show`
`.backups.list()`	`backup:backup_project_attribute`
	`backup:get_all`
`.volume_snapshots.list()`	`volume:get_all_snapshots`
	`volume_extension:extended_snapshot_attributes`
`.volumes.get()`	`volume:get_all_snapshots`
	`volume_extension:extended_snapshot_attributes`
`.volumes.get().detach()`	`volume_extension:volume_actions:detach`
`.volumes.get().delete()`	`volume:delete`
	`volume:force_delete`
`.volumes.list()`	`volume:get_all`
	`volume_extension:volume_host_attribute`
	`volume_extension:volume_image_metadata`
	`volume_extension:volume_mig_status_attribute`
	`volume_extension:volume_tenant_attribute`
`.volumes.create()`	`volume:create`
	`volume:create_from_image`
	`volume:multiattach`

Glance

glanceclient call	policy action
`.image_members.create()`	`add_member`

Keystone

keystoneclient call	policy action
`.projects.get()`	`identity:get_project`
`.projects.create()`	`identity:create_project`
`.projects.delete()`	`identity:delete_project`
`.projects.list()`	`identity:list_projects`
	`identity:list_user_projects`
`.roles.get()`	`identity:get_domain_role`
	`identity:get_role`
`.roles.grant()`	`identity:create_grant`
`.role_assignments.list()`	`identity:list_role_assignments`
	`identity:list_role_assignments_for_tree`
`.users.get()`	`identity:get_user`
`.users.list()`	`identity:list_users_in_group`
	`identity:list_users`

Neutron

neutronclient call	policy action
`.list_networks()`	`get_network`
	`get_network:provider:network_type`
	`get_network:provider:physical_network`
	`get_network:provider:segmentation_id`
	`get_network:router:external`
`.list_security_groups()`	`get_security_group`
`.create_security_rule()`	`create_security_group_rule`

N.B. why no get_security_groups ?
Appears that one cannot enumerate all security groups w/o admin credentials

See: retrieve_all parameter.

Nova

novaclient call	policy action
`.availability_zones.list()`	`os_compute_api:os-availability-zone:detail`
	`os_compute_api:os-availability-zone:list`
`.flavors.list()`	`os_compute_api:os-flavor-access`
	`os_compute_api:os-flavor-extra-specs:index`
	`os_compute_api:os-flavor-rxtx`
`.flavor_access.add_tenant_access()`	`os_compute_api:os-flavor-access:add_tenant_access`
`.floating_ips.list()`	`DEPRECATED IN ROCKY`
`.floating_ips.find().delete()`	`DEPRECATED IN ROCKY`
`.images.get()`	`DEPRECATED IN ROCKY: see novaclient.glance.find_image()`
`.quotas.get()`	`os_compute_api:os-quota-sets:detail`
	`os_compute_api:os-quota-sets:show`
`.limits.get()`	`os_compute_api:limits`
	`os_compute_api:os-used-limits`
`.quotas.update()`	`os_compute_api:os-quota-sets:update`
`.security_group_rules.create()`	`DEPRECATED IN ROCKY`
`.security_groups.get()`	`DEPRECATED IN ROCKY`
`.servers.get()`	`os_compute_api:os-flavor-extra-specs:index`
	`os_compute_api:os-security-groups`
	`os_compute_api:servers:show`
	`os_compute_api:servers:show:host_status`
`.servers.get().delete()`	`os_compute_api:servers:delete`
`.servers.create()`	`network:attach_external_network`
	`os_compute_api:servers:create`
	`os_compute_api:servers:create:attach_network`
	`os_compute_api:servers:create:attach_volume`
	`os_compute_api:servers:create:forced_host`
	`os_compute_api:servers:create:trusted_certs`
	`os_compute_api:servers:create:zero_disk_flavor`
`.servers.list()`	`os_compute_api:os-config-drive`
	`os_compute_api:os-extended-availability-zone`
	`os_compute_api:os-extended-server-attributes`
	`os_compute_api:os-extended-status`
	`os_compute_api:os-extended-volumes`
	`os_compute_api:os-hide-server-addresses`
	`os_compute_api:os-keypairs`
	`os_compute_api:os-server-usage`
	`os_compute_api:servers:detail`
	`os_compute_api:servers:detail:get_all_tenants`
	`os_compute_api:servers:index`
	`os_compute_api:servers:index:get_all_tenants`
	`os_compute_api:servers:show:host_status`
`.servers.set_meta()`	`os_compute_api:server-metadata:create`

kamidzi/policy_notes.md

Keystone

Glance

Cinder

Neutron

Nova

Client API Binding call-to-policy action mappings

Cinder

Glance

Keystone

Neutron

Nova