From 31db4cff73d09e98948384a9d942259789c2a006 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 1/26] Update README.md --- diff --git a/README.md b/README.md index 6642cbe..a6c9256 100644 --- a/README.md +++ b/README.md @@ -1,35 +1,2 @@ -This is a repository of the files/tools we are developping around -integrating the sevone (monitoring software) into RH-OSP. - -This project includes several areas: -- Add policy files to the overcloud to restrict the 'readonly' role and prevent - update/create/delete operations. - -- Add tooling (OBSOLETE since this will be done through node-payload in the - osp10 templates) to push/update policies on the overcloud. - -- Provide a MOP (Method of procedure) to enable Sevone pre-requisites on - both the undercloud and overcloud. An ASCII version of the MOP is provided - in this repository. - -This work on the 'readonly' role was a request of the VZW HQ Planning group. - -Here is how it works: - -On the undercloud, as the 'stack' user perform the following steps: - - 1) source stackrc - 2) git clone https://gitlab.cee.redhat.com/vcojot/OSP-Readonly-Policies/tree/master - 3) ./policydir/files/push_readonly_policies_to_overcloud.sh - 4) source overcloudrc - 5) openstack role create readonly - -(this will auto-detect the controllers and push the appropriate policies) - -To restrict a user, then simply do add the 'readonly' role to the user, do a: - - openstack role add --project --user readonly - -To lift the restrictions and re-enable modifications to the overcloud, do a: - - openstack role remove --project --user readonly +This repo contains the current ongoing work of attempting to implement a +read-only role via policy.json in OSP10 \ No newline at end of file From 8c06e535f28b875290c8c4d668a526f71c739804 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 2/26] Draft of Glance policy Change-Id: I97c1227e39b77705703a17d3928882c488f49c91 --- diff --git a/etc/glance/policy.json b/etc/glance/policy.json index 0a058c1..161ee6c 100644 --- a/etc/glance/policy.json +++ b/etc/glance/policy.json @@ -1,27 +1,33 @@ { - "context_is_admin": "role:admin", + "readonly": "(project_id:%(project_id)s and role:readonly)", + "global_readonly": "(role:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", + "default": "role:admin", - "add_image": "", - "delete_image": "", - "get_image": "", - "get_images": "", - "modify_image": "", - "publicize_image": "role:admin", - "copy_from": "", + "add_image": "rule:admin or rule:member", + "delete_image": "rule:admin or rule:member or rule:owner", + "get_image": "rule:admin or rule:member or rule:readonly", + "get_images": "rule:admin or rule:member or rule:readonly", + "modify_image": "rule:admin or rule:member", + "publicize_image": "rule:admin", + "copy_from": "rule:admin or rule:member", - "download_image": "", - "upload_image": "", + "download_image": "rule:admin or rule:member", + "upload_image": "rule:admin or rule:member", - "delete_image_location": "", - "get_image_location": "", - "set_image_location": "", + "delete_image_location": "rule:admin or rule:member", + "get_image_location": "rule:admin or rule:member", + "set_image_location": "rule:admin or rule:member", - "add_member": "", - "delete_member": "", - "get_member": "", - "get_members": "", - "modify_member": "", + "add_member": "rule:admin or rule:member", + "delete_member": "rule:admin or rule:member", + "get_member": "rule:admin or rule:member or rule:readonly", + "get_members": "rule:admin or rule:member or rule:readonly", + "modify_member": "rule:admin or rule:member", "manage_image_cache": "role:admin", @@ -30,32 +36,32 @@ "add_task": "role:admin", "modify_task": "role:admin", - "deactivate": "", - "reactivate": "", - - "get_metadef_namespace": "", - "get_metadef_namespaces":"", - "modify_metadef_namespace":"", - "add_metadef_namespace":"", - - "get_metadef_object":"", - "get_metadef_objects":"", - "modify_metadef_object":"", - "add_metadef_object":"", - - "list_metadef_resource_types":"", - "get_metadef_resource_type":"", - "add_metadef_resource_type_association":"", - - "get_metadef_property":"", - "get_metadef_properties":"", - "modify_metadef_property":"", - "add_metadef_property":"", - - "get_metadef_tag":"", - "get_metadef_tags":"", - "modify_metadef_tag":"", - "add_metadef_tag":"", - "add_metadef_tags":"" + "deactivate": "rule:admin or rule:member", + "reactivate": "rule:admin or rule:member", + + "get_metadef_namespace": "rule:admin or rule:member or rule:readonly", + "get_metadef_namespaces":"rule:admin or rule:member or rule:readonly", + "modify_metadef_namespace":"rule:admin or rule:member", + "add_metadef_namespace":"rule:admin or rule:member", + + "get_metadef_object":"rule:admin or rule:member or rule:readonly", + "get_metadef_objects":"rule:admin or rule:member or rule:readonly", + "modify_metadef_object":"rule:admin or rule:member", + "add_metadef_object":"rule:admin or rule:member", + + "list_metadef_resource_types":"rule:admin or rule:member or rule:readonly", + "get_metadef_resource_type":"rule:admin or rule:member or rule:readonly", + "add_metadef_resource_type_association":"rule:admin or rule:member", + + "get_metadef_property":"rule:admin or rule:member or rule:readonly", + "get_metadef_properties":"rule:admin or rule:member or rule:readonly", + "modify_metadef_property":"rule:admin or rule:member", + "add_metadef_property":"rule:admin or rule:member", + + "get_metadef_tag":"rule:admin or rule:member or rule:readonly", + "get_metadef_tags":"rule:admin or rule:member or rule:readonly", + "modify_metadef_tag":"rule:admin or rule:member", + "add_metadef_tag":"rule:admin or rule:member", + "add_metadef_tags":"rule:admin or rule:member" } From 37d92050f376168bb474415ae61c3cd17ad77d6d Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 3/26] Untested draft of gnocchi readonly policy Change-Id: I52bd17655046e48d55bd1cce257583db3ca0eaac --- diff --git a/etc/gnocchi/policy.json b/etc/gnocchi/policy.json index 00aaedd..d0689b7 100644 --- a/etc/gnocchi/policy.json +++ b/etc/gnocchi/policy.json @@ -1,42 +1,49 @@ { - "admin_or_creator": "role:admin or project_id:%(created_by_project_id)s", - "resource_owner": "project_id:%(project_id)s", - "metric_owner": "project_id:%(resource.project_id)s", - - "get status": "role:admin", - - "create resource": "", - "get resource": "rule:admin_or_creator or rule:resource_owner", - "update resource": "rule:admin_or_creator", - "delete resource": "rule:admin_or_creator", - "delete resources": "rule:admin_or_creator", - "list resource": "rule:admin_or_creator or rule:resource_owner", - "search resource": "rule:admin_or_creator or rule:resource_owner", - - "create resource type": "role:admin", - "delete resource type": "role:admin", - "update resource type": "role:admin", - "list resource type": "", - "get resource type": "", - - "get archive policy": "", - "list archive policy": "", - "create archive policy": "role:admin", - "update archive policy": "role:admin", - "delete archive policy": "role:admin", - - "create archive policy rule": "role:admin", - "get archive policy rule": "", - "list archive policy rule": "", - "delete archive policy rule": "role:admin", - - "create metric": "", - "delete metric": "rule:admin_or_creator", - "get metric": "rule:admin_or_creator or rule:metric_owner", - "search metric": "rule:admin_or_creator or rule:metric_owner", - "list metric": "", - "list all metric": "role:admin", - - "get measures": "rule:admin_or_creator or rule:metric_owner", - "post measures": "rule:admin_or_creator" + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", + + "creator": "(project_id:%(created_by_project_id)s and (rule:_member_role or role:service))", + "resource_owner": "(project_id:%(project_id)s and (rule:_member_role or role:service))", + "metric_owner": "(project_id:%(resource.project_id)s and (rule:_member_role or role:service))", + + "get status": "rule:admin or rule:readonly", + + "create resource": "rule:admin or rule:member or rule:resource_owner", + "get resource": "rule:creator or rule:resource_owner or rule:readonly", + "update resource": "rule:admin or rule:creator", + "delete resource": "rule:admin or rule:creator", + "delete resources": "rule:admin or rule:creator", + "list resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", + "search resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", + + "create resource type": "rule:admin", + "delete resource type": "rule:admin", + "update resource type": "rule:admin", + "list resource type": "rule:admin or rule:member or rule:readonly", + "get resource type": "rule:admin or rule:member or rule:readonly", + + "get archive policy": "rule:admin or rule:member or rule:readonly", + "list archive policy": "rule:admin or rule:member or rule:readonly", + "create archive policy": "rule:admin", + "update archive policy": "rule:admin", + "delete archive policy": "rule:admin", + + "create archive policy rule": "rule:admin", + "get archive policy rule": "rule:admin or rule:member or rule:readonly", + "list archive policy rule": "rule:admin or rule:member or rule:readonly", + "delete archive policy rule": "rule:admin", + + "create metric": "rule:admin or rule:member or rule:metric_owner", + "delete metric": "rule:admin or rule:creator", + "get metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", + "search metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", + "list metric": "rule:admin or rule:member or rule:readonly", + "list all metric": "rule:admin or rule:readonly", + + "get measures": "rule:creator or rule:metric_owner or rule:readonly", + "post measures": "rule:creator" } From e870c68a720f684d8acb74c83c9363d88b75eeed Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 4/26] Untested drafts of modifications to all other policies Change-Id: I150ddcf2d0d104c8e3e066b4adb25814b3bb0246 --- diff --git a/etc/aodh/policy.json b/etc/aodh/policy.json index 4fd873e..444f1d5 100644 --- a/etc/aodh/policy.json +++ b/etc/aodh/policy.json @@ -1,20 +1,26 @@ { - "context_is_admin": "role:admin", - "segregation": "rule:context_is_admin", - "admin_or_owner": "rule:context_is_admin or project_id:%(project_id)s", - "default": "rule:admin_or_owner", + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", - "telemetry:get_alarm": "rule:admin_or_owner", - "telemetry:get_alarms": "rule:admin_or_owner", - "telemetry:query_alarm": "rule:admin_or_owner", + "segregation": "rule:admin", - "telemetry:create_alarm": "", - "telemetry:change_alarm": "rule:admin_or_owner", - "telemetry:delete_alarm": "rule:admin_or_owner", + "default": "rule:admin or rule:member", - "telemetry:get_alarm_state": "rule:admin_or_owner", - "telemetry:change_alarm_state": "rule:admin_or_owner", + "telemetry:get_alarm": "rule:admin or rule:member", + "telemetry:get_alarms": "rule:admin or rule:member", + "telemetry:query_alarm": "rule:admin or rule:member", - "telemetry:alarm_history": "rule:admin_or_owner", - "telemetry:query_alarm_history": "rule:admin_or_owner" + "telemetry:create_alarm": "rule:admin or rule: member", + "telemetry:change_alarm": "rule:admin or rule:member", + "telemetry:delete_alarm": "rule:admin or rule:member", + + "telemetry:get_alarm_state": "rule:admin or rule:member", + "telemetry:change_alarm_state": "rule:admin or rule:member", + + "telemetry:alarm_history": "rule:admin or rule:member", + "telemetry:query_alarm_history": "rule:admin or rule:member" } diff --git a/etc/ceilometer/policy.json b/etc/ceilometer/policy.json index a5e836a..2b13529 100644 --- a/etc/ceilometer/policy.json +++ b/etc/ceilometer/policy.json @@ -1,18 +1,25 @@ { + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", + "context_is_admin": "role:admin", "segregation": "rule:context_is_admin", - "telemetry:get_samples": "", - "telemetry:get_sample": "", - "telemetry:query_sample": "", - "telemetry:create_samples": "", + "telemetry:get_samples": "rule:admin or rule: member", + "telemetry:get_sample": "rule:admin or rule: member", + "telemetry:query_sample": "rule:admin or rule: member", + "telemetry:create_samples": "rule:admin or rule: member", - "telemetry:compute_statistics": "", - "telemetry:get_meters": "", + "telemetry:compute_statistics": "rule:admin or rule: member", + "telemetry:get_meters": "rule:admin or rule: member", - "telemetry:get_resource": "", - "telemetry:get_resources": "", + "telemetry:get_resource": "rule:admin or rule: member", + "telemetry:get_resources": "rule:admin or rule: member", - "telemetry:events:index": "", - "telemetry:events:show": "" + "telemetry:events:index": "rule:admin or rule: member", + "telemetry:events:show": "rule:admin or rule: member" } diff --git a/etc/heat/policy.json b/etc/heat/policy.json index c093f33..acb0d7e 100644 --- a/etc/heat/policy.json +++ b/etc/heat/policy.json @@ -1,3 +1,98 @@ { - "context_is_admin": "role:admin","project_admin": "role:admin","deny_stack_user": "not role:heat_stack_user","deny_everybody": "!","cloudformation:ListStacks": "rule:deny_stack_user","cloudformation:CreateStack": "rule:deny_stack_user","cloudformation:DescribeStacks": "rule:deny_stack_user","cloudformation:DeleteStack": "rule:deny_stack_user","cloudformation:UpdateStack": "rule:deny_stack_user","cloudformation:CancelUpdateStack": "rule:deny_stack_user","cloudformation:DescribeStackEvents": "rule:deny_stack_user","cloudformation:ValidateTemplate": "rule:deny_stack_user","cloudformation:GetTemplate": "rule:deny_stack_user","cloudformation:EstimateTemplateCost": "rule:deny_stack_user","cloudformation:DescribeStackResource": "","cloudformation:DescribeStackResources": "rule:deny_stack_user","cloudformation:ListStackResources": "rule:deny_stack_user","cloudwatch:DeleteAlarms": "rule:deny_stack_user","cloudwatch:DescribeAlarmHistory": "rule:deny_stack_user","cloudwatch:DescribeAlarms": "rule:deny_stack_user","cloudwatch:DescribeAlarmsForMetric": "rule:deny_stack_user","cloudwatch:DisableAlarmActions": "rule:deny_stack_user","cloudwatch:EnableAlarmActions": "rule:deny_stack_user","cloudwatch:GetMetricStatistics": "rule:deny_stack_user","cloudwatch:ListMetrics": "rule:deny_stack_user","cloudwatch:PutMetricAlarm": "rule:deny_stack_user","cloudwatch:PutMetricData": "","cloudwatch:SetAlarmState": "rule:deny_stack_user","actions:action": "rule:deny_stack_user","build_info:build_info": "rule:deny_stack_user","events:index": "rule:deny_stack_user","events:show": "rule:deny_stack_user","resource:index": "rule:deny_stack_user","resource:metadata": "","resource:signal": "","resource:mark_unhealthy": "rule:deny_stack_user","resource:show": "rule:deny_stack_user","stacks:abandon": "rule:deny_stack_user","stacks:create": "rule:deny_stack_user","stacks:delete": "rule:deny_stack_user","stacks:detail": "rule:deny_stack_user","stacks:export": "rule:deny_stack_user","stacks:generate_template": "rule:deny_stack_user","stacks:global_index": "rule:deny_everybody","stacks:index": "rule:deny_stack_user","stacks:list_resource_types": "rule:deny_stack_user","stacks:list_template_versions": "rule:deny_stack_user","stacks:list_template_functions": "rule:deny_stack_user","stacks:lookup": "","stacks:preview": "rule:deny_stack_user","stacks:resource_schema": "rule:deny_stack_user","stacks:show": "rule:deny_stack_user","stacks:template": "rule:deny_stack_user","stacks:environment": "rule:deny_stack_user","stacks:files": "rule:deny_stack_user","stacks:update": "rule:deny_stack_user","stacks:update_patch": "rule:deny_stack_user","stacks:preview_update": "rule:deny_stack_user","stacks:preview_update_patch": "rule:deny_stack_user","stacks:validate_template": "rule:deny_stack_user","stacks:snapshot": "rule:deny_stack_user","stacks:show_snapshot": "rule:deny_stack_user","stacks:delete_snapshot": "rule:deny_stack_user","stacks:list_snapshots": "rule:deny_stack_user","stacks:restore_snapshot": "rule:deny_stack_user","stacks:list_outputs": "rule:deny_stack_user","stacks:show_output": "rule:deny_stack_user","software_configs:global_index": "rule:deny_everybody","software_configs:index": "rule:deny_stack_user","software_configs:create": "rule:deny_stack_user","software_configs:show": "rule:deny_stack_user","software_configs:delete": "rule:deny_stack_user","software_deployments:index": "rule:deny_stack_user","software_deployments:create": "rule:deny_stack_user","software_deployments:show": "rule:deny_stack_user","software_deployments:update": "rule:deny_stack_user","software_deployments:delete": "rule:deny_stack_user","software_deployments:metadata": "","service:index": "rule:context_is_admin","resource_types:OS::Nova::Flavor": "rule:project_admin","resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin","resource_types:OS::Cinder::VolumeType": "rule:project_admin","resource_types:OS::Cinder::Quota": "rule:project_admin","resource_types:OS::Manila::ShareType": "rule:project_admin","resource_types:OS::Neutron::QoSPolicy": "rule:project_admin","resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin","resource_types:OS::Nova::HostAggregate": "rule:project_admin","resource_types:OS::Cinder::QoSSpecs": "rule:project_admin" + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", + + "context_is_admin": "role:admin", + "project_admin": "role:admin", + "deny_stack_user": "not role:heat_stack_user", + "deny_everybody": "!", + + "cloudformation:ListStacks": "rule:deny_stack_user", + "cloudformation:CreateStack": "rule:deny_stack_user", + "cloudformation:DescribeStacks": "rule:deny_stack_user", + "cloudformation:DeleteStack": "rule:deny_stack_user", + "cloudformation:UpdateStack": "rule:deny_stack_user", + "cloudformation:CancelUpdateStack": "rule:deny_stack_user", + "cloudformation:DescribeStackEvents": "rule:deny_stack_user", + "cloudformation:ValidateTemplate": "rule:deny_stack_user", + "cloudformation:GetTemplate": "rule:deny_stack_user", + "cloudformation:EstimateTemplateCost": "rule:deny_stack_user", + "cloudformation:DescribeStackResource": "", + "cloudformation:DescribeStackResources": "rule:deny_stack_user", + "cloudformation:ListStackResources": "rule:deny_stack_user", + "cloudwatch:DeleteAlarms": "rule:deny_stack_user", + "cloudwatch:DescribeAlarmHistory": "rule:deny_stack_user", + "cloudwatch:DescribeAlarms": "rule:deny_stack_user", + "cloudwatch:DescribeAlarmsForMetric": "rule:deny_stack_user", + "cloudwatch:DisableAlarmActions": "rule:deny_stack_user", + "cloudwatch:EnableAlarmActions": "rule:deny_stack_user", + "cloudwatch:GetMetricStatistics": "rule:deny_stack_user", + "cloudwatch:ListMetrics": "rule:deny_stack_user", + "cloudwatch:PutMetricAlarm": "rule:deny_stack_user", + "cloudwatch:PutMetricData": "", + "cloudwatch:SetAlarmState": "rule:deny_stack_user", + "actions:action": "rule:deny_stack_user", + "build_info:build_info": "rule:deny_stack_user", + "events:index": "rule:deny_stack_user", + "events:show": "rule:deny_stack_user", + "resource:index": "rule:deny_stack_user", + "resource:metadata": "", + "resource:signal": "", + "resource:mark_unhealthy": "rule:deny_stack_user", + "resource:show": "rule:deny_stack_user", + "stacks:abandon": "rule:deny_stack_user", + "stacks:create": "rule:deny_stack_user", + "stacks:delete": "rule:deny_stack_user", + "stacks:detail": "rule:deny_stack_user", + "stacks:export": "rule:deny_stack_user", + "stacks:generate_template": "rule:deny_stack_user", + "stacks:global_index": "rule:deny_everybody", + "stacks:index": "rule:deny_stack_user", + "stacks:list_resource_types": "rule:deny_stack_user", + "stacks:list_template_versions": "rule:deny_stack_user", + "stacks:list_template_functions": "rule:deny_stack_user", + "stacks:lookup": "", + "stacks:preview": "rule:deny_stack_user", + "stacks:resource_schema": "rule:deny_stack_user", + "stacks:show": "rule:deny_stack_user", + "stacks:template": "rule:deny_stack_user", + "stacks:environment": "rule:deny_stack_user", + "stacks:files": "rule:deny_stack_user", + "stacks:update": "rule:deny_stack_user", + "stacks:update_patch": "rule:deny_stack_user", + "stacks:preview_update": "rule:deny_stack_user", + "stacks:preview_update_patch": "rule:deny_stack_user", + "stacks:validate_template": "rule:deny_stack_user", + "stacks:snapshot": "rule:deny_stack_user", + "stacks:show_snapshot": "rule:deny_stack_user", + "stacks:delete_snapshot": "rule:deny_stack_user", + "stacks:list_snapshots": "rule:deny_stack_user", + "stacks:restore_snapshot": "rule:deny_stack_user", + "stacks:list_outputs": "rule:deny_stack_user", + "stacks:show_output": "rule:deny_stack_user", + "software_configs:global_index": "rule:deny_everybody", + "software_configs:index": "rule:deny_stack_user", + "software_configs:create": "rule:deny_stack_user", + "software_configs:show": "rule:deny_stack_user", + "software_configs:delete": "rule:deny_stack_user", + "software_deployments:index": "rule:deny_stack_user", + "software_deployments:create": "rule:deny_stack_user", + "software_deployments:show": "rule:deny_stack_user", + "software_deployments:update": "rule:deny_stack_user", + "software_deployments:delete": "rule:deny_stack_user", + "software_deployments:metadata": "", + "service:index": "rule:context_is_admin", + "resource_types:OS::Nova::Flavor": "rule:project_admin", + "resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin", + "resource_types:OS::Cinder::VolumeType": "rule:project_admin", + "resource_types:OS::Cinder::Quota": "rule:project_admin", + "resource_types:OS::Manila::ShareType": "rule:project_admin", + "resource_types:OS::Neutron::QoSPolicy": "rule:project_admin", + "resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin", + "resource_types:OS::Nova::HostAggregate": "rule:project_admin", + "resource_types:OS::Cinder::QoSSpecs": "rule:project_admin" } diff --git a/etc/keystone/policy.json b/etc/keystone/policy.json index 2c801c2..223a651 100644 --- a/etc/keystone/policy.json +++ b/etc/keystone/policy.json @@ -1,6 +1,6 @@ { - "readonly": "(project_id:%(project_id)s and role:readonly)", "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", "_member_role": "(role:member or role:_member_)", "member": "(project_id:%(project_id)s and rule:_member_role)", "admin": "(is_admin:True or role:admin)", diff --git a/etc/manila/policy.json b/etc/manila/policy.json index d8188f6..a0b6df6 100644 --- a/etc/manila/policy.json +++ b/etc/manila/policy.json @@ -1,27 +1,30 @@ { - "context_is_admin": "role:admin", - "admin_or_owner": "is_admin:True or project_id:%(project_id)s", - "default": "rule:admin_or_owner", + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", - "admin_api": "is_admin:True", + "default": "rule:admin or rule:member", "availability_zone:index": "rule:default", - "quota_set:update": "rule:admin_api", + "quota_set:update": "rule:admin", "quota_set:show": "rule:default", - "quota_set:delete": "rule:admin_api", + "quota_set:delete": "rule:admin", "quota_class_set:show": "rule:default", - "quota_class_set:update": "rule:admin_api", + "quota_class_set:update": "rule:admin", - "service:index": "rule:admin_api", - "service:update": "rule:admin_api", + "service:index": "rule:admin", + "service:update": "rule:admin", - "share:create": "", + "share:create": "rule:admin or rule: member", "share:delete": "rule:default", "share:get": "rule:default", "share:get_all": "rule:default", - "share:list_by_share_server_id": "rule:admin_api", + "share:list_by_share_server_id": "rule:admin", "share:update": "rule:default", "share:access_get": "rule:default", "share:access_get_all": "rule:default", @@ -32,54 +35,54 @@ "share:get_share_metadata": "rule:default", "share:delete_share_metadata": "rule:default", "share:update_share_metadata": "rule:default", - "share:migration_start": "rule:admin_api", - "share:migration_complete": "rule:admin_api", - "share:migration_cancel": "rule:admin_api", - "share:migration_get_progress": "rule:admin_api", - "share:reset_task_state": "rule:admin_api", - "share:manage": "rule:admin_api", - "share:unmanage": "rule:admin_api", - "share:force_delete": "rule:admin_api", - "share:reset_status": "rule:admin_api", + "share:migration_start": "rule:admin", + "share:migration_complete": "rule:admin", + "share:migration_cancel": "rule:admin", + "share:migration_get_progress": "rule:admin", + "share:reset_task_state": "rule:admin", + "share:manage": "rule:admin", + "share:unmanage": "rule:admin", + "share:force_delete": "rule:admin", + "share:reset_status": "rule:admin", "share_export_location:index": "rule:default", "share_export_location:show": "rule:default", - "share_instance:index": "rule:admin_api", - "share_instance:show": "rule:admin_api", - "share_instance:force_delete": "rule:admin_api", - "share_instance:reset_status": "rule:admin_api", - "share_instance_export_location:index": "rule:admin_api", - "share_instance_export_location:show": "rule:admin_api", + "share_instance:index": "rule:admin", + "share_instance:show": "rule:admin", + "share_instance:force_delete": "rule:admin", + "share_instance:reset_status": "rule:admin", + "share_instance_export_location:index": "rule:admin", + "share_instance_export_location:show": "rule:admin", "share_snapshot:create_snapshot": "rule:default", "share_snapshot:delete_snapshot": "rule:default", "share_snapshot:get_snapshot": "rule:default", "share_snapshot:get_all_snapshots": "rule:default", "share_snapshot:snapshot_update": "rule:default", - "share_snapshot:manage_snapshot": "rule:admin_api", - "share_snapshot:unmanage_snapshot": "rule:admin_api", - "share_snapshot:force_delete": "rule:admin_api", - "share_snapshot:reset_status": "rule:admin_api", + "share_snapshot:manage_snapshot": "rule:admin", + "share_snapshot:unmanage_snapshot": "rule:admin", + "share_snapshot:force_delete": "rule:admin", + "share_snapshot:reset_status": "rule:admin", - "share_snapshot_instance:detail": "rule:admin_api", - "share_snapshot_instance:index": "rule:admin_api", - "share_snapshot_instance:show": "rule:admin_api", - "share_snapshot_instance:reset_status": "rule:admin_api", + "share_snapshot_instance:detail": "rule:admin", + "share_snapshot_instance:index": "rule:admin", + "share_snapshot_instance:show": "rule:admin", + "share_snapshot_instance:reset_status": "rule:admin", "share_type:index": "rule:default", "share_type:show": "rule:default", "share_type:default": "rule:default", - "share_type:create": "rule:admin_api", - "share_type:delete": "rule:admin_api", - "share_type:add_project_access": "rule:admin_api", - "share_type:list_project_access": "rule:admin_api", - "share_type:remove_project_access": "rule:admin_api", - - "share_types_extra_spec:create": "rule:admin_api", - "share_types_extra_spec:update": "rule:admin_api", - "share_types_extra_spec:show": "rule:admin_api", - "share_types_extra_spec:index": "rule:admin_api", - "share_types_extra_spec:delete": "rule:admin_api", + "share_type:create": "rule:admin", + "share_type:delete": "rule:admin", + "share_type:add_project_access": "rule:admin", + "share_type:list_project_access": "rule:admin", + "share_type:remove_project_access": "rule:admin", + + "share_types_extra_spec:create": "rule:admin", + "share_types_extra_spec:update": "rule:admin", + "share_types_extra_spec:show": "rule:admin", + "share_types_extra_spec:index": "rule:admin", + "share_types_extra_spec:delete": "rule:admin", "security_service:create": "rule:default", "security_service:delete": "rule:default", @@ -87,12 +90,12 @@ "security_service:show": "rule:default", "security_service:index": "rule:default", "security_service:detail": "rule:default", - "security_service:get_all_security_services": "rule:admin_api", + "security_service:get_all_security_services": "rule:admin", - "share_server:index": "rule:admin_api", - "share_server:show": "rule:admin_api", - "share_server:details": "rule:admin_api", - "share_server:delete": "rule:admin_api", + "share_server:index": "rule:admin", + "share_server:show": "rule:admin", + "share_server:details": "rule:admin", + "share_server:delete": "rule:admin", "share_network:create": "rule:default", "share_network:delete": "rule:default", @@ -102,21 +105,21 @@ "share_network:show": "rule:default", "share_network:add_security_service": "rule:default", "share_network:remove_security_service": "rule:default", - "share_network:get_all_share_networks": "rule:admin_api", + "share_network:get_all_share_networks": "rule:admin", - "scheduler_stats:pools:index": "rule:admin_api", - "scheduler_stats:pools:detail": "rule:admin_api", + "scheduler_stats:pools:index": "rule:admin", + "scheduler_stats:pools:detail": "rule:admin", "consistency_group:create" : "rule:default", "consistency_group:delete": "rule:default", "consistency_group:update": "rule:default", "consistency_group:get": "rule:default", "consistency_group:get_all": "rule:default", - "consistency_group:force_delete": "rule:admin_api", - "consistency_group:reset_status": "rule:admin_api", + "consistency_group:force_delete": "rule:admin", + "consistency_group:reset_status": "rule:admin", - "cgsnapshot:force_delete": "rule:admin_api", - "cgsnapshot:reset_status": "rule:admin_api", + "cgsnapshot:force_delete": "rule:admin", + "cgsnapshot:reset_status": "rule:admin", "cgsnapshot:create" : "rule:default", "cgsnapshot:update" : "rule:default", "cgsnapshot:delete": "rule:default", @@ -128,8 +131,8 @@ "share_replica:create" : "rule:default", "share_replica:delete": "rule:default", "share_replica:promote": "rule:default", - "share_replica:resync": "rule:admin_api", - "share_replica:reset_status": "rule:admin_api", - "share_replica:force_delete": "rule:admin_api", - "share_replica:reset_replica_state": "rule:admin_api" + "share_replica:resync": "rule:admin", + "share_replica:reset_status": "rule:admin", + "share_replica:force_delete": "rule:admin", + "share_replica:reset_replica_state": "rule:admin" } diff --git a/etc/mistral/policy.json b/etc/mistral/policy.json index 3278023..774d22a 100644 --- a/etc/mistral/policy.json +++ b/etc/mistral/policy.json @@ -1,64 +1,69 @@ { - "admin_only": "is_admin:True", - "admin_or_owner": "is_admin:True or project_id:%(project_id)s", - "default": "rule:admin_or_owner", + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", - "action_executions:delete": "rule:admin_or_owner", - "action_execution:create": "rule:admin_or_owner", - "action_executions:get": "rule:admin_or_owner", - "action_executions:list": "rule:admin_or_owner", - "action_executions:update": "rule:admin_or_owner", + "default": "rule:admin or rule:member", - "actions:create": "rule:admin_or_owner", - "actions:delete": "rule:admin_or_owner", - "actions:get": "rule:admin_or_owner", - "actions:list": "rule:admin_or_owner", - "actions:update": "rule:admin_or_owner", + "action_executions:delete": "rule:admin or rule:member", + "action_execution:create": "rule:admin or rule:member", + "action_executions:get": "rule:admin or rule:member", + "action_executions:list": "rule:admin or rule:member", + "action_executions:update": "rule:admin or rule:member", - "cron_triggers:create": "rule:admin_or_owner", - "cron_triggers:delete": "rule:admin_or_owner", - "cron_triggers:get": "rule:admin_or_owner", - "cron_triggers:list": "rule:admin_or_owner", + "actions:create": "rule:admin or rule:member", + "actions:delete": "rule:admin or rule:member", + "actions:get": "rule:admin or rule:member", + "actions:list": "rule:admin or rule:member", + "actions:update": "rule:admin or rule:member", - "environments:create": "rule:admin_or_owner", - "environments:delete": "rule:admin_or_owner", - "environments:get": "rule:admin_or_owner", - "environments:list": "rule:admin_or_owner", - "environments:update": "rule:admin_or_owner", + "cron_triggers:create": "rule:admin or rule:member", + "cron_triggers:delete": "rule:admin or rule:member", + "cron_triggers:get": "rule:admin or rule:member", + "cron_triggers:list": "rule:admin or rule:member", - "executions:create": "rule:admin_or_owner", - "executions:delete": "rule:admin_or_owner", - "executions:get": "rule:admin_or_owner", - "executions:list": "rule:admin_or_owner", - "executions:update": "rule:admin_or_owner", + "environments:create": "rule:admin or rule:member", + "environments:delete": "rule:admin or rule:member", + "environments:get": "rule:admin or rule:member", + "environments:list": "rule:admin or rule:member", + "environments:update": "rule:admin or rule:member", - "members:create": "rule:admin_or_owner", - "members:delete": "rule:admin_or_owner", - "members:get": "rule:admin_or_owner", - "members:list": "rule:admin_or_owner", - "members:update": "rule:admin_or_owner", + "executions:create": "rule:admin or rule:member", + "executions:delete": "rule:admin or rule:member", + "executions:get": "rule:admin or rule:member", + "executions:list": "rule:admin or rule:member", + "executions:update": "rule:admin or rule:member", - "services:list": "rule:admin_or_owner", + "members:create": "rule:admin or rule:member", + "members:delete": "rule:admin or rule:member", + "members:get": "rule:admin or rule:member", + "members:list": "rule:admin or rule:member", + "members:update": "rule:admin or rule:member", - "tasks:get": "rule:admin_or_owner", - "tasks:list": "rule:admin_or_owner", - "tasks:update": "rule:admin_or_owner", + "services:list": "rule:admin or rule:member", - "workbooks:create": "rule:admin_or_owner", - "workbooks:delete": "rule:admin_or_owner", - "workbooks:get": "rule:admin_or_owner", - "workbooks:list": "rule:admin_or_owner", - "workbooks:update": "rule:admin_or_owner", + "tasks:get": "rule:admin or rule:member", + "tasks:list": "rule:admin or rule:member", + "tasks:update": "rule:admin or rule:member", - "workflows:create": "rule:admin_or_owner", - "workflows:delete": "rule:admin_or_owner", - "workflows:get": "rule:admin_or_owner", - "workflows:list": "rule:admin_or_owner", - "workflows:update": "rule:admin_or_owner", + "workbooks:create": "rule:admin or rule:member", + "workbooks:delete": "rule:admin or rule:member", + "workbooks:get": "rule:admin or rule:member", + "workbooks:list": "rule:admin or rule:member", + "workbooks:update": "rule:admin or rule:member", - "event_triggers:create": "rule:admin_or_owner", - "event_triggers:delete": "rule:admin_or_owner", - "event_triggers:get": "rule:admin_or_owner", - "event_triggers:list": "rule:admin_or_owner", - "event_triggers:update": "rule:admin_or_owner" + "workflows:create": "rule:admin or rule:member", + "workflows:delete": "rule:admin or rule:member", + "workflows:get": "rule:admin or rule:member", + "workflows:list": "rule:admin or rule:member", + "workflows:update": "rule:admin or rule:member", + + "event_triggers:create": "rule:admin or rule:member", + "event_triggers:delete": "rule:admin or rule:member", + "event_triggers:get": "rule:admin or rule:member", + "event_triggers:list": "rule:admin or rule:member", + "event_triggers:update": "rule:admin or rule:member" } diff --git a/etc/sahara/policy.json b/etc/sahara/policy.json index 789dafc..15eeb69 100644 --- a/etc/sahara/policy.json +++ b/etc/sahara/policy.json @@ -1,73 +1,79 @@ { - "context_is_admin": "role:admin", - "default": "", + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", - "data-processing:clusters:get_all": "", - "data-processing:clusters:create": "", - "data-processing:clusters:scale": "", - "data-processing:clusters:get": "", - "data-processing:clusters:delete": "", - "data-processing:clusters:modify": "", + "default": "rule:admin or rule:member", - "data-processing:cluster-templates:get_all": "", - "data-processing:cluster-templates:create": "", - "data-processing:cluster-templates:get": "", - "data-processing:cluster-templates:modify": "", - "data-processing:cluster-templates:delete": "", + "data-processing:clusters:get_all": "rule:admin or rule:member", + "data-processing:clusters:create": "rule:admin or rule:member", + "data-processing:clusters:scale": "rule:admin or rule:member", + "data-processing:clusters:get": "rule:admin or rule:member", + "data-processing:clusters:delete": "rule:admin or rule:member", + "data-processing:clusters:modify": "rule:admin or rule:member", - "data-processing:node-group-templates:get_all": "", - "data-processing:node-group-templates:create": "", - "data-processing:node-group-templates:get": "", - "data-processing:node-group-templates:modify": "", - "data-processing:node-group-templates:delete": "", + "data-processing:cluster-templates:get_all": "rule:admin or rule:member", + "data-processing:cluster-templates:create": "rule:admin or rule:member", + "data-processing:cluster-templates:get": "rule:admin or rule:member", + "data-processing:cluster-templates:modify": "rule:admin or rule:member", + "data-processing:cluster-templates:delete": "rule:admin or rule:member", - "data-processing:plugins:get_all": "", - "data-processing:plugins:get": "", - "data-processing:plugins:get_version": "", - "data-processing:plugins:convert_config": "", - "data-processing:plugins:patch": "role:admin", + "data-processing:node-group-templates:get_all": "rule:admin or rule:member", + "data-processing:node-group-templates:create": "rule:admin or rule:member", + "data-processing:node-group-templates:get": "rule:admin or rule:member", + "data-processing:node-group-templates:modify": "rule:admin or rule:member", + "data-processing:node-group-templates:delete": "rule:admin or rule:member", - "data-processing:images:get_all": "", - "data-processing:images:get": "", - "data-processing:images:register": "", - "data-processing:images:unregister": "", - "data-processing:images:add_tags": "", - "data-processing:images:remove_tags": "", + "data-processing:plugins:get_all": "rule:admin or rule:member", + "data-processing:plugins:get": "rule:admin or rule:member", + "data-processing:plugins:get_version": "rule:admin or rule:member", + "data-processing:plugins:convert_config": "rule:admin or rule:member", + "data-processing:plugins:patch": "rule:admin", - "data-processing:job-executions:get_all": "", - "data-processing:job-executions:get": "", - "data-processing:job-executions:refresh_status": "", - "data-processing:job-executions:cancel": "", - "data-processing:job-executions:delete": "", - "data-processing:job-executions:modify": "", + "data-processing:images:get_all": "rule:admin or rule:member", + "data-processing:images:get": "rule:admin or rule:member", + "data-processing:images:register": "rule:admin or rule:member", + "data-processing:images:unregister": "rule:admin or rule:member", + "data-processing:images:add_tags": "rule:admin or rule:member", + "data-processing:images:remove_tags": "rule:admin or rule:member", - "data-processing:data-sources:get_all": "", - "data-processing:data-sources:get": "", - "data-processing:data-sources:register": "", - "data-processing:data-sources:delete": "", - "data-processing:data-sources:modify": "", + "data-processing:job-executions:get_all": "rule:admin or rule:member", + "data-processing:job-executions:get": "rule:admin or rule:member", + "data-processing:job-executions:refresh_status": "rule:admin or rule:member", + "data-processing:job-executions:cancel": "rule:admin or rule:member", + "data-processing:job-executions:delete": "rule:admin or rule:member", + "data-processing:job-executions:modify": "rule:admin or rule:member", - "data-processing:jobs:get_all": "", - "data-processing:jobs:create": "", - "data-processing:jobs:get": "", - "data-processing:jobs:delete": "", - "data-processing:jobs:get_config_hints": "", - "data-processing:jobs:execute": "", - "data-processing:jobs:modify": "", + "data-processing:data-sources:get_all": "rule:admin or rule:member", + "data-processing:data-sources:get": "rule:admin or rule:member", + "data-processing:data-sources:register": "rule:admin or rule:member", + "data-processing:data-sources:delete": "rule:admin or rule:member", + "data-processing:data-sources:modify": "rule:admin or rule:member", - "data-processing:job-binaries:get_all": "", - "data-processing:job-binaries:create": "", - "data-processing:job-binaries:get": "", - "data-processing:job-binaries:delete": "", - "data-processing:job-binaries:get_data": "", - "data-processing:job-binaries:modify": "", + "data-processing:jobs:get_all": "rule:admin or rule:member", + "data-processing:jobs:create": "rule:admin or rule:member", + "data-processing:jobs:get": "rule:admin or rule:member", + "data-processing:jobs:delete": "rule:admin or rule:member", + "data-processing:jobs:get_config_hints": "rule:admin or rule:member", + "data-processing:jobs:execute": "rule:admin or rule:member", + "data-processing:jobs:modify": "rule:admin or rule:member", - "data-processing:job-binary-internals:get_all": "", - "data-processing:job-binary-internals:create": "", - "data-processing:job-binary-internals:get": "", - "data-processing:job-binary-internals:delete": "", - "data-processing:job-binary-internals:get_data": "", - "data-processing:job-binary-internals:modify": "", + "data-processing:job-binaries:get_all": "rule:admin or rule:member", + "data-processing:job-binaries:create": "rule:admin or rule:member", + "data-processing:job-binaries:get": "rule:admin or rule:member", + "data-processing:job-binaries:delete": "rule:admin or rule:member", + "data-processing:job-binaries:get_data": "rule:admin or rule:member", + "data-processing:job-binaries:modify": "rule:admin or rule:member", - "data-processing:job-types:get_all": "" + "data-processing:job-binary-internals:get_all": "rule:admin or rule:member", + "data-processing:job-binary-internals:create": "rule:admin or rule:member", + "data-processing:job-binary-internals:get": "rule:admin or rule:member", + "data-processing:job-binary-internals:delete": "rule:admin or rule:member", + "data-processing:job-binary-internals:get_data": "rule:admin or rule:member", + "data-processing:job-binary-internals:modify": "rule:admin or rule:member", + + "data-processing:job-types:get_all": "rule:admin or rule:member" } diff --git a/etc/zaqar/policy.json b/etc/zaqar/policy.json index 89d5076..1a6c49e 100644 --- a/etc/zaqar/policy.json +++ b/etc/zaqar/policy.json @@ -1,46 +1,53 @@ { + "global_readonly": "(role:global_readonly)", + "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", + "_member_role": "(role:member or role:_member_)", + "member": "(project_id:%(project_id)s and rule:_member_role)", + "admin": "(is_admin:True or role:admin)", + "owner": "(user_id:%(user_id)s and rule:_member_role)", + "context_is_admin": "role:admin", - "admin_or_owner": "is_admin:True or project_id:%(project_id)s", - "default": "rule:admin_or_owner", - - "queues:get_all": "", - "queues:create": "", - "queues:get": "", - "queues:delete": "", - "queues:update": "", - "queues:stats": "", - - "messages:get_all": "", - "messages:create": "", - "messages:get": "", - "messages:delete": "", - "messages:delete_all": "", - - "claims:get_all": "", - "claims:create": "", - "claims:get": "", - "claims:delete": "", - "claims:update": "", - - "subscription:get_all": "", - "subscription:create": "", - "subscription:get": "", - "subscription:delete": "", - "subscription:update": "", - "subscription:confirm": "", - - "pools:get_all": "rule:context_is_admin", - "pools:create": "rule:context_is_admin", - "pools:get": "rule:context_is_admin", - "pools:delete": "rule:context_is_admin", - "pools:update": "rule:context_is_admin", - - "flavors:get_all": "", - "flavors:create": "rule:context_is_admin", - "flavors:get": "", - "flavors:delete": "rule:context_is_admin", - "flavors:update": "rule:context_is_admin", - - "ping:get": "", - "health:get": "rule:context_is_admin" + + "default": "rule:admin or rule:member", + + "queues:get_all": "rule:admin or rule:member", + "queues:create": "rule:admin or rule:member", + "queues:get": "rule:admin or rule:member", + "queues:delete": "rule:admin or rule:member", + "queues:update": "rule:admin or rule:member", + "queues:stats": "rule:admin or rule:member", + + "messages:get_all": "rule:admin or rule:member", + "messages:create": "rule:admin or rule:member", + "messages:get": "rule:admin or rule:member", + "messages:delete": "rule:admin or rule:member", + "messages:delete_all": "rule:admin or rule:member", + + "claims:get_all": "rule:admin or rule:member", + "claims:create": "rule:admin or rule:member", + "claims:get": "rule:admin or rule:member", + "claims:delete": "rule:admin or rule:member", + "claims:update": "rule:admin or rule:member", + + "subscription:get_all": "rule:admin or rule:member", + "subscription:create": "rule:admin or rule:member", + "subscription:get": "rule:admin or rule:member", + "subscription:delete": "rule:admin or rule:member", + "subscription:update": "rule:admin or rule:member", + "subscription:confirm": "rule:admin or rule:member", + + "pools:get_all": "rule:admin or rule:member", + "pools:create": "rule:admin or rule:member", + "pools:get": "rule:admin or rule:member", + "pools:delete": "rule:admin or rule:member", + "pools:update": "rule:admin or rule:member", + + "flavors:get_all": "rule:admin or rule:member", + "flavors:create": "rule:admin or rule:member", + "flavors:get": "rule:admin or rule:member", + "flavors:delete": "rule:admin or rule:member", + "flavors:update": "rule:admin or rule:member", + + "ping:get": "rule:admin or rule:member", + "health:get": "rule:admin or rule:member" } From 4da46f447bafef858f4380b72b5bd0573a2e3dff Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 5/26] Added admin to gnocchi get/post measures Change-Id: I950735924e6442a76f66ccdfe8e105b31e8b8ae3 --- diff --git a/etc/gnocchi/policy.json b/etc/gnocchi/policy.json index d0689b7..15cde5e 100644 --- a/etc/gnocchi/policy.json +++ b/etc/gnocchi/policy.json @@ -44,6 +44,6 @@ "list metric": "rule:admin or rule:member or rule:readonly", "list all metric": "rule:admin or rule:readonly", - "get measures": "rule:creator or rule:metric_owner or rule:readonly", - "post measures": "rule:creator" + "get measures": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", + "post measures": "rule:admin or rule:creator" } From 9a3d3ffaf25579a1b2dea3b5754df4d73c1acd84 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 6/26] Added admin to the last rule in gnocchi, oops Change-Id: I1df91530c35dd6ec173d925a21386a3da18727a1 --- diff --git a/etc/gnocchi/policy.json b/etc/gnocchi/policy.json index 15cde5e..638edb5 100644 --- a/etc/gnocchi/policy.json +++ b/etc/gnocchi/policy.json @@ -13,7 +13,7 @@ "get status": "rule:admin or rule:readonly", "create resource": "rule:admin or rule:member or rule:resource_owner", - "get resource": "rule:creator or rule:resource_owner or rule:readonly", + "get resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", "update resource": "rule:admin or rule:creator", "delete resource": "rule:admin or rule:creator", "delete resources": "rule:admin or rule:creator", From 7e9ab54ad43f77a4eec09b6f8ef5505ec12d7290 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 7/26] Draft of heat policy, super unsure on this one Change-Id: I388b7aed9717d8754ad94c160de73e2b5cad8a60 --- diff --git a/etc/heat/policy.json b/etc/heat/policy.json index acb0d7e..4554918 100644 --- a/etc/heat/policy.json +++ b/etc/heat/policy.json @@ -6,10 +6,7 @@ "admin": "(is_admin:True or role:admin)", "owner": "(user_id:%(user_id)s and rule:_member_role)", - "context_is_admin": "role:admin", - "project_admin": "role:admin", - "deny_stack_user": "not role:heat_stack_user", - "deny_everybody": "!", + "deny_stack_user": "(rule:admin or rule:member) and (not role:heat_stack_user)", "cloudformation:ListStacks": "rule:deny_stack_user", "cloudformation:CreateStack": "rule:deny_stack_user", @@ -21,7 +18,7 @@ "cloudformation:ValidateTemplate": "rule:deny_stack_user", "cloudformation:GetTemplate": "rule:deny_stack_user", "cloudformation:EstimateTemplateCost": "rule:deny_stack_user", - "cloudformation:DescribeStackResource": "", + "cloudformation:DescribeStackResource": "rule:admin or rule:member", "cloudformation:DescribeStackResources": "rule:deny_stack_user", "cloudformation:ListStackResources": "rule:deny_stack_user", "cloudwatch:DeleteAlarms": "rule:deny_stack_user", @@ -33,15 +30,15 @@ "cloudwatch:GetMetricStatistics": "rule:deny_stack_user", "cloudwatch:ListMetrics": "rule:deny_stack_user", "cloudwatch:PutMetricAlarm": "rule:deny_stack_user", - "cloudwatch:PutMetricData": "", + "cloudwatch:PutMetricData": "rule:admin or rule:member", "cloudwatch:SetAlarmState": "rule:deny_stack_user", "actions:action": "rule:deny_stack_user", "build_info:build_info": "rule:deny_stack_user", "events:index": "rule:deny_stack_user", "events:show": "rule:deny_stack_user", "resource:index": "rule:deny_stack_user", - "resource:metadata": "", - "resource:signal": "", + "resource:metadata": "rule:admin or rule:member", + "resource:signal": "rule:admin or rule:member", "resource:mark_unhealthy": "rule:deny_stack_user", "resource:show": "rule:deny_stack_user", "stacks:abandon": "rule:deny_stack_user", @@ -50,12 +47,12 @@ "stacks:detail": "rule:deny_stack_user", "stacks:export": "rule:deny_stack_user", "stacks:generate_template": "rule:deny_stack_user", - "stacks:global_index": "rule:deny_everybody", + "stacks:global_index": "rule:admin", "stacks:index": "rule:deny_stack_user", "stacks:list_resource_types": "rule:deny_stack_user", "stacks:list_template_versions": "rule:deny_stack_user", "stacks:list_template_functions": "rule:deny_stack_user", - "stacks:lookup": "", + "stacks:lookup": "rule:admin or rule:member", "stacks:preview": "rule:deny_stack_user", "stacks:resource_schema": "rule:deny_stack_user", "stacks:show": "rule:deny_stack_user", @@ -74,7 +71,7 @@ "stacks:restore_snapshot": "rule:deny_stack_user", "stacks:list_outputs": "rule:deny_stack_user", "stacks:show_output": "rule:deny_stack_user", - "software_configs:global_index": "rule:deny_everybody", + "software_configs:global_index": "rule:admin", "software_configs:index": "rule:deny_stack_user", "software_configs:create": "rule:deny_stack_user", "software_configs:show": "rule:deny_stack_user", @@ -84,15 +81,15 @@ "software_deployments:show": "rule:deny_stack_user", "software_deployments:update": "rule:deny_stack_user", "software_deployments:delete": "rule:deny_stack_user", - "software_deployments:metadata": "", - "service:index": "rule:context_is_admin", - "resource_types:OS::Nova::Flavor": "rule:project_admin", - "resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin", - "resource_types:OS::Cinder::VolumeType": "rule:project_admin", - "resource_types:OS::Cinder::Quota": "rule:project_admin", - "resource_types:OS::Manila::ShareType": "rule:project_admin", - "resource_types:OS::Neutron::QoSPolicy": "rule:project_admin", - "resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin", - "resource_types:OS::Nova::HostAggregate": "rule:project_admin", - "resource_types:OS::Cinder::QoSSpecs": "rule:project_admin" + "software_deployments:metadata": "rule:admin or rule:member", + "service:index": "rule:admin", + "resource_types:OS::Nova::Flavor": "rule:admin", + "resource_types:OS::Cinder::EncryptedVolumeType": "rule:admin", + "resource_types:OS::Cinder::VolumeType": "rule:admin", + "resource_types:OS::Cinder::Quota": "rule:admin", + "resource_types:OS::Manila::ShareType": "rule:admin", + "resource_types:OS::Neutron::QoSPolicy": "rule:admin", + "resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:admin", + "resource_types:OS::Nova::HostAggregate": "rule:admin", + "resource_types:OS::Cinder::QoSSpecs": "rule:admin" } From 21dd40e790767fde2e326ec60afe87107dc46249 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 8/26] Fixed grouping of deny_stack_user Change-Id: Ib646d9e795834749cebe18223f743be987920185 --- diff --git a/etc/heat/policy.json b/etc/heat/policy.json index 4554918..5357479 100644 --- a/etc/heat/policy.json +++ b/etc/heat/policy.json @@ -6,7 +6,7 @@ "admin": "(is_admin:True or role:admin)", "owner": "(user_id:%(user_id)s and rule:_member_role)", - "deny_stack_user": "(rule:admin or rule:member) and (not role:heat_stack_user)", + "deny_stack_user": "((rule:admin or rule:member) and (not role:heat_stack_user))", "cloudformation:ListStacks": "rule:deny_stack_user", "cloudformation:CreateStack": "rule:deny_stack_user", From 2ffe1ccc57361a84cf9f0ed6df4c2c178bb7851e Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 9/26] Attempted rewrite of policy.json for all services Now services have policy.yaml, and should be easier to comment Change-Id: I89c6b148bc2355ddb777a633729c66aae8da59a1 --- diff --git a/etc/aodh/policy.json b/etc/aodh/policy.json deleted file mode 100644 index 444f1d5..0000000 --- a/etc/aodh/policy.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "segregation": "rule:admin", - - "default": "rule:admin or rule:member", - - "telemetry:get_alarm": "rule:admin or rule:member", - "telemetry:get_alarms": "rule:admin or rule:member", - "telemetry:query_alarm": "rule:admin or rule:member", - - "telemetry:create_alarm": "rule:admin or rule: member", - "telemetry:change_alarm": "rule:admin or rule:member", - "telemetry:delete_alarm": "rule:admin or rule:member", - - "telemetry:get_alarm_state": "rule:admin or rule:member", - "telemetry:change_alarm_state": "rule:admin or rule:member", - - "telemetry:alarm_history": "rule:admin or rule:member", - "telemetry:query_alarm_history": "rule:admin or rule:member" -} diff --git a/etc/aodh/policy.yaml b/etc/aodh/policy.yaml new file mode 100644 index 0000000..ca325ce --- /dev/null +++ b/etc/aodh/policy.yaml @@ -0,0 +1,62 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +# Get an alarm. +# GET /v2/alarms/{alarm_id} +"telemetry:get_alarm": "rule:admin or rule:member or rule:reader" + +# Get all alarms, based on the query provided. +# GET /v2/alarms +"telemetry:get_alarms": "rule:admin or rule:member or rule:reader" + +# Get all alarms, based on the query provided. +# POST /v2/query/alarms +"telemetry:query_alarm": "rule:admin or rule:member" + +# Create a new alarm. +# POST /v2/alarms +"telemetry:create_alarm": "rule:admin or rule:member" + +# Modify this alarm. +# PUT /v2/alarms/{alarm_id} +"telemetry:change_alarm": "rule:admin or rule:member" + +# Delete this alarm. +# DELETE /v2/alarms/{alarm_id} +"telemetry:delete_alarm": "rule:admin or rule:member" + +# Get the state of this alarm. +# GET /v2/alarms/{alarm_id}/state +"telemetry:get_alarm_state": "rule:admin or rule:member or rule:reader" + +# Set the state of this alarm. +# PUT /v2/alarms/{alarm_id}/state +"telemetry:change_alarm_state": "rule:admin or rule:member" + +# Assembles the alarm history requested. +# GET /v2/alarms/{alarm_id}/history +"telemetry:alarm_history": "rule:admin or rule:member or rule:reader" + +# Define query for retrieving AlarmChange data. +# POST /v2/query/alarms/history +"telemetry:query_alarm_history": "rule:admin or rule:member" diff --git a/etc/ceilometer/policy.json b/etc/ceilometer/policy.json deleted file mode 100644 index 2b13529..0000000 --- a/etc/ceilometer/policy.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "context_is_admin": "role:admin", - "segregation": "rule:context_is_admin", - - "telemetry:get_samples": "rule:admin or rule: member", - "telemetry:get_sample": "rule:admin or rule: member", - "telemetry:query_sample": "rule:admin or rule: member", - "telemetry:create_samples": "rule:admin or rule: member", - - "telemetry:compute_statistics": "rule:admin or rule: member", - "telemetry:get_meters": "rule:admin or rule: member", - - "telemetry:get_resource": "rule:admin or rule: member", - "telemetry:get_resources": "rule:admin or rule: member", - - "telemetry:events:index": "rule:admin or rule: member", - "telemetry:events:show": "rule:admin or rule: member" -} diff --git a/etc/cinder/policy.json b/etc/cinder/policy.json deleted file mode 100644 index 3d23c3c..0000000 --- a/etc/cinder/policy.json +++ /dev/null @@ -1,142 +0,0 @@ -{ - - "readonly": "(project_id:%(project_id)s and role:readonly)", - "global_readonly": "(role:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "default": "rule:admin or rule:member", - - "volume:create": "rule:admin or rule:member", - "volume:delete": "rule:admin or rule:member", - "volume:get": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:get_all": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:get_volume_metadata": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:create_volume_metadata": "rule:admin or rule:member", - "volume:delete_volume_metadata": "rule:admin or rule:member", - "volume:update_volume_metadata": "rule:admin or rule:member", - "volume:get_volume_admin_metadata": "rule:admin", - "volume:update_volume_admin_metadata": "rule:admin", - "volume:get_snapshot": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:get_all_snapshots": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:create_snapshot": "rule:admin or rule:member", - "volume:delete_snapshot": "rule:admin or rule:member", - "volume:update_snapshot": "rule:admin or rule:member", - "volume:get_snapshot_metadata": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:delete_snapshot_metadata": "rule:admin or rule:member", - "volume:update_snapshot_metadata": "rule:admin or rule:member", - "volume:extend": "rule:admin or rule:member", - "volume:update_readonly_flag": "rule:admin or rule:member", - "volume:retype": "rule:admin or rule:member", - "volume:update": "rule:admin or rule:member", - - "volume_extension:types_manage": "rule:admin", - "volume_extension:types_extra_specs": "rule:admin", - "volume_extension:access_types_qos_specs_id": "rule:admin", - "volume_extension:access_types_extra_specs": "rule:admin", - "volume_extension:volume_type_access": "rule:admin or rule:member", - "volume_extension:volume_type_access:addProjectAccess": "rule:admin", - "volume_extension:volume_type_access:removeProjectAccess": "rule:admin", - "volume_extension:volume_type_encryption": "rule:admin", - "volume_extension:volume_encryption_metadata": "rule:admin or rule:member", - "volume_extension:extended_snapshot_attributes": "rule:admin or rule:member", - "volume_extension:volume_image_metadata": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - - "volume_extension:quotas:show": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume_extension:quotas:update": "rule:admin", - "volume_extension:quotas:delete": "rule:admin", - "volume_extension:quota_classes": "rule:admin", - "volume_extension:quota_classes:validate_setup_for_nested_quota_use": "rule:admin", - - "volume_extension:volume_admin_actions:reset_status": "rule:admin", - "volume_extension:snapshot_admin_actions:reset_status": "rule:admin", - "volume_extension:backup_admin_actions:reset_status": "rule:admin", - "volume_extension:volume_admin_actions:force_delete": "rule:admin", - "volume_extension:volume_admin_actions:force_detach": "rule:admin", - "volume_extension:snapshot_admin_actions:force_delete": "rule:admin", - "volume_extension:backup_admin_actions:force_delete": "rule:admin", - "volume_extension:volume_admin_actions:migrate_volume": "rule:admin", - "volume_extension:volume_admin_actions:migrate_volume_completion": "rule:admin", - - "volume_extension:volume_actions:upload_public": "rule:admin", - "volume_extension:volume_actions:upload_image": "rule:admin or rule:member", - - "volume_extension:volume_host_attribute": "rule:admin", - "volume_extension:volume_tenant_attribute": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume_extension:volume_mig_status_attribute": "rule:admin", - "volume_extension:hosts": "rule:admin or rule:readonly or rule:global_readonly", - "volume_extension:services:index": "rule:admin or rule:readonly or rule:global_readonly", - "volume_extension:services:update" : "rule:admin", - - "volume_extension:volume_manage": "rule:admin", - "volume_extension:volume_unmanage": "rule:admin", - "volume_extension:list_manageable": "rule:admin", - - "volume_extension:capabilities": "rule:admin or rule:readonly or rule:global_readonly", - - "volume:create_transfer": "rule:admin or rule:member", - "volume:accept_transfer": "rule:admin or rule:member", - "volume:delete_transfer": "rule:admin or rule:member", - "volume:get_transfer": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "volume:get_all_transfers": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - - "volume_extension:replication:promote": "rule:admin", - "volume_extension:replication:reenable": "rule:admin", - - "volume:failover_host": "rule:admin", - "volume:freeze_host": "rule:admin", - "volume:thaw_host": "rule:admin", - - "backup:create" : "rule:admin or rule:member", - "backup:delete": "rule:admin or rule:member", - "backup:get": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "backup:get_all": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "backup:restore": "rule:admin or rule:member", - "backup:backup-import": "rule:admin", - "backup:backup-export": "rule:admin", - "backup:update": "rule:admin or rule:member", - - "snapshot_extension:snapshot_actions:update_snapshot_status": "rule:admin", - "snapshot_extension:snapshot_manage": "rule:admin", - "snapshot_extension:snapshot_unmanage": "rule:admin", - "snapshot_extension:list_manageable": "rule:admin", - - "consistencygroup:create" : "group:nobody", - "consistencygroup:delete": "group:nobody", - "consistencygroup:update": "group:nobody", - "consistencygroup:get": "group:nobody", - "consistencygroup:get_all": "group:nobody", - - "consistencygroup:create_cgsnapshot" : "group:nobody", - "consistencygroup:delete_cgsnapshot": "group:nobody", - "consistencygroup:get_cgsnapshot": "group:nobody", - "consistencygroup:get_all_cgsnapshots": "group:nobody", - - "group:group_types_manage": "rule:admin", - "group:group_types_specs": "rule:admin", - "group:access_group_types_specs": "rule:admin", - "group:group_type_access": "rule:admin or rule:member", - - "group:create" : "rule:admin or rule:member", - "group:delete": "rule:admin or rule:member", - "group:update": "rule:admin or rule:member", - "group:get": "rule:admin or rule:member", - "group:get_all": "rule:admin or rule:member", - - "group:create_group_snapshot": "rule:admin or rule:member", - "group:delete_group_snapshot": "rule:admin or rule:member", - "group:update_group_snapshot": "rule:admin or rule:member", - "group:get_group_snapshot": "rule:admin or rule:member", - "group:get_all_group_snapshots": "rule:admin or rule:member", - - "scheduler_extension:scheduler_stats:get_pools" : "rule:admin or rule:readonly or rule:global_readonly", - "message:delete": "rule:admin or rule:member", - "message:get": "rule:admin or rule:member", - "message:get_all": "rule:admin or rule:member", - - "clusters:get": "rule:admin", - "clusters:get_all": "rule:admin", - "clusters:update": "rule:admin" -} diff --git a/etc/cinder/policy.yaml b/etc/cinder/policy.yaml new file mode 100644 index 0000000..137a510 --- /dev/null +++ b/etc/cinder/policy.yaml @@ -0,0 +1,623 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# Decides what is required for the 'is_admin:True' check to succeed. +# "context_is_admin": "role:admin" + +# RULES + + +# Create attachment. +# POST /attachments +"volume:attachment_create": "rule:admin or rule:member" + +# Update attachment. +# PUT /attachments/{attachment_id} +"volume:attachment_update": "rule:admin or rule:member" + +# Delete attachment. +# DELETE /attachments/{attachment_id} +"volume:attachment_delete": "rule:admin or rule:member" + +# Mark a volume attachment process as completed (in-use) +# POST /attachments/{attachment_id}/action (os-complete) +"volume:attachment_complete": "rule:admin or rule:member" + +# Allow multiattach of bootable volumes. +# POST /attachments +"volume:multiattach_bootable_volume": "rule:admin or rule:member" + +# List messages. +# GET /messages +"message:get_all": "rule:admin or rule:member or rule:reader" + +# Show message. +# GET /messages/{message_id} +"message:get": "rule:admin or rule:member or rule:reader" + +# Delete message. +# DELETE /messages/{message_id} +"message:delete": "rule:admin or rule:member" + +# List clusters. +# GET /clusters +# GET /clusters/detail +"clusters:get_all": "rule:admin or rule:reader" + +# Show cluster. +# GET /clusters/{cluster_id} +"clusters:get": "rule:admin or rule:reader" + +# Update cluster. +# PUT /clusters/{cluster_id} +"clusters:update": "rule:admin" + +# Clean up workers. +# POST /workers/cleanup +"workers:cleanup": "rule:admin" + +# Show snapshot's metadata or one specified metadata with a given key. +# GET /snapshots/{snapshot_id}/metadata +# GET /snapshots/{snapshot_id}/metadata/{key} +"volume:get_snapshot_metadata": "rule:admin or rule:member or rule:reader" + +# Update snapshot's metadata or one specified metadata with a given +# key. +# PUT /snapshots/{snapshot_id}/metadata +# PUT /snapshots/{snapshot_id}/metadata/{key} +"volume:update_snapshot_metadata": "rule:admin or rule:member" + +# Delete snapshot's specified metadata with a given key. +# DELETE /snapshots/{snapshot_id}/metadata/{key} +"volume:delete_snapshot_metadata": "rule:admin or rule:member" + +# List snapshots. +# GET /snapshots +# GET /snapshots/detail +"volume:get_all_snapshots": "rule:admin or rule:member or rule:reader" + +# List or show snapshots with extended attributes. +# GET /snapshots/{snapshot_id} +# GET /snapshots/detail +"volume_extension:extended_snapshot_attributes": "rule:admin or rule:member or rule:reader" + +# Create snapshot. +# POST /snapshots +"volume:create_snapshot": "rule:admin or rule:member" + +# Show snapshot. +# GET /snapshots/{snapshot_id} +"volume:get_snapshot": "rule:admin or rule:member or rule:reader" + +# Update snapshot. +# PUT /snapshots/{snapshot_id} +"volume:update_snapshot": "rule:admin or rule:member" + +# Delete snapshot. +# DELETE /snapshots/{snapshot_id} +"volume:delete_snapshot": "rule:admin or rule:member" + +# Reset status of a snapshot. +# POST /snapshots/{snapshot_id}/action (os-reset_status) +"volume_extension:snapshot_admin_actions:reset_status": "rule:admin" + +# Update database fields of snapshot. +# POST /snapshots/{snapshot_id}/action (update_snapshot_status) +"snapshot_extension:snapshot_actions:update_snapshot_status": "rule:admin or rule:member" + +# Force delete a snapshot. +# POST /snapshots/{snapshot_id}/action (os-force_delete) +"volume_extension:snapshot_admin_actions:force_delete": "rule:admin" + +# List (in detail) of snapshots which are available to manage. +# GET /manageable_snapshots +# GET /manageable_snapshots/detail +"snapshot_extension:list_manageable": "rule:admin or rule:reader" + +# Manage an existing snapshot. +# POST /manageable_snapshots +"snapshot_extension:snapshot_manage": "rule:admin" + +# Stop managing a snapshot. +# POST /snapshots/{snapshot_id}/action (os-unmanage) +"snapshot_extension:snapshot_unmanage": "rule:admin" + +# List backups. +# GET /backups +# GET /backups/detail +"backup:get_all": "rule:admin or rule:member or rule:reader" + +# List backups or show backup with project attributes. +# GET /backups/{backup_id} +# GET /backups/detail +"backup:backup_project_attribute": "rule:admin or rule:reader" + +# Create backup. +# POST /backups +"backup:create": "rule:admin or rule:member" + +# Show backup. +# GET /backups/{backup_id} +"backup:get": "rule:admin or rule:member or rule:reader" + +# Update backup. +# PUT /backups/{backup_id} +"backup:update": "rule:admin or rule:member" + +# Delete backup. +# DELETE /backups/{backup_id} +"backup:delete": "rule:admin or rule:member" + +# Restore backup. +# POST /backups/{backup_id}/restore +"backup:restore": "rule:admin or rule:member" + +# Import backup. +# POST /backups/{backup_id}/import_record +"backup:backup-import": "rule:admin" + +# Export backup. +# POST /backups/{backup_id}/export_record +"backup:export-import": "rule:admin" + +# Reset status of a backup. +# POST /backups/{backup_id}/action (os-reset_status) +"volume_extension:backup_admin_actions:reset_status": "rule:admin" + +# Force delete a backup. +# POST /backups/{backup_id}/action (os-force_delete) +"volume_extension:backup_admin_actions:force_delete": "rule:admin" + +# List groups. +# GET /groups +# GET /groups/detail +"group:get_all": "rule:admin or rule:member or rule:reader" + +# Create group. +# POST /groups +"group:create": "rule:admin or rule:member" + +# Show group. +# GET /groups/{group_id} +"group:get": "rule:admin or rule:member or rule:reader" + +# Update group. +# PUT /groups/{group_id} +"group:update": "rule:admin or rule:member" + +# Create, update or delete a group type. +# POST /group_types/ +# PUT /group_types/{group_type_id} +# DELETE /group_types/{group_type_id} +"group:group_types_manage": "rule:admin" + +# Show group type with type specs attributes. +# GET /group_types/{group_type_id} +"group:access_group_types_specs": "rule:admin or rule:reader" + +# Create, show, update and delete group type spec. +# GET /group_types/{group_type_id}/group_specs/{g_spec_id} +# GET /group_types/{group_type_id}/group_specs +# POST /group_types/{group_type_id}/group_specs +# PUT /group_types/{group_type_id}/group_specs/{g_spec_id} +# DELETE /group_types/{group_type_id}/group_specs/{g_spec_id} +"group:group_types_specs": "rule:admin" + +# List group snapshots. +# GET /group_snapshots +# GET /group_snapshots/detail +"group:get_all_group_snapshots": "rule:admin or rule:member or rule:reader" + +# Create group snapshot. +# POST /group_snapshots +"group:create_group_snapshot": "rule:admin or rule:member" + +# Show group snapshot. +# GET /group_snapshots/{group_snapshot_id} +"group:get_group_snapshot": "rule:admin or rule:member or rule:reader" + +# Delete group snapshot. +# DELETE /group_snapshots/{group_snapshot_id} +"group:delete_group_snapshot": "rule:admin or rule:member" + +# Update group snapshot. +# PUT /group_snapshots/{group_snapshot_id} +"group:update_group_snapshot": "rule:admin or rule:member or rule:reader" + +# Reset status of group snapshot. +# POST /group_snapshots/{g_snapshot_id}/action (reset_status) +"group:reset_group_snapshot_status": "rule:admin or rule:member" + +# Delete group. +# POST /groups/{group_id}/action (delete) +"group:delete": "rule:admin or rule:member" + +# Reset status of group. +# POST /groups/{group_id}/action (reset_status) +"group:reset_status": "rule:admin" + +# Enable replication. +# POST /groups/{group_id}/action (enable_replication) +"group:enable_replication": "rule:admin or rule:member" + +# Disable replication. +# POST /groups/{group_id}/action (disable_replication) +"group:disable_replication": "rule:admin or rule:member" + +# Fail over replication. +# POST /groups/{group_id}/action (failover_replication) +"group:failover_replication": "rule:admin or rule:member" + +# List failover replication. +# POST /groups/{group_id}/action (list_replication_targets) +"group:list_replication_targets": "rule:admin or rule:member" + +# List qos specs or list all associations. +# GET /qos-specs +# GET /qos-specs/{qos_id}/associations +"volume_extension:qos_specs_manage:get_all": "rule:admin or rule:reader" + +# Show qos specs. +# GET /qos-specs/{qos_id} +"volume_extension:qos_specs_manage:get": "rule:admin or rule:reader" + +# Create qos specs. +# POST /qos-specs +"volume_extension:qos_specs_manage:create": "rule:admin" + +# Update qos specs (including updating association). +# PUT /qos-specs/{qos_id} +# GET /qos-specs/{qos_id}/disassociate_all +# GET /qos-specs/{qos_id}/associate +# GET /qos-specs/{qos_id}/disassociate +"volume_extension:qos_specs_manage:update": "rule:admin or rule:reader" + +# delete qos specs or unset one specified qos key. +# DELETE /qos-specs/{qos_id} +# PUT /qos-specs/{qos_id}/delete_keys +"volume_extension:qos_specs_manage:delete": "rule:admin" + +# Show or update project quota class. +# GET /os-quota-class-sets/{project_id} +# PUT /os-quota-class-sets/{project_id} +"volume_extension:quota_classes": "rule:admin" + +# Show project quota (including usage and default). +# GET /os-quota-sets/{project_id} +# GET /os-quota-sets/{project_id}/default +# GET /os-quota-sets/{project_id}?usage=True +"volume_extension:quotas:show": "rule:admin or rule:member or rule:reader" + +# Update project quota. +# PUT /os-quota-sets/{project_id} +"volume_extension:quotas:update": "rule:admin" + +# Delete project quota. +# DELETE /os-quota-sets/{project_id} +"volume_extension:quotas:delete": "rule:admin" + +# Validate setup for nested quota. +# GET /os-quota-sets/validate_setup_for_nested_quota_use +"volume_extension:quota_classes:validate_setup_for_nested_quota_use": "rule:admin or rule:reader" + +# Show backend capabilities. +# GET /capabilities/{host_name} +"volume_extension:capabilities": "rule:admin or rule:reader" + +# List all services. +# GET /os-services +"volume_extension:services:index": "rule:admin or rule:reader" + +# Update service, including failover_host, thaw, freeze, disable, +# enable, set-log and get-log actions. +# PUT /os-services/{action} +"volume_extension:services:update": "rule:admin" + +# Freeze a backend host. +# PUT /os-services/freeze +"volume:freeze_host": "rule:admin" + +# Thaw a backend host. +# PUT /os-services/thaw +"volume:thaw_host": "rule:admin" + +# Failover a backend host. +# PUT /os-services/failover_host +"volume:failover_host": "rule:admin" + +# List all backend pools. +# GET /scheduler-stats/get_pools +"scheduler_extension:scheduler_stats:get_pools": "rule:admin or rule:reader" + +# List, update or show hosts for a project. +# GET /os-hosts +# PUT /os-hosts/{host_name} +# GET /os-hosts/{host_id} +"volume_extension:hosts": "rule:admin" + +# Show limits with used limit attributes. +# GET /limits +"limits_extension:used_limits": "rule:admin or rule:member or rule:reader" + +# List (in detail) of volumes which are available to manage. +# GET /manageable_volumes +# GET /manageable_volumes/detail +"volume_extension:list_manageable": "rule:admin or rule:reader" + +# Manage existing volumes. +# POST /manageable_volumes +"volume_extension:volume_manage": "rule:admin" + +# Stop managing a volume. +# POST /volumes/{volume_id}/action (os-unmanage) +"volume_extension:volume_unmanage": "rule:admin" + +# Create, update and delete volume type. +# POST /types +# PUT /types +# DELETE /types +"volume_extension:types_manage": "rule:admin" + +# List, show, create, update and delete volume type encryption. +# POST /types/{type_id}/encryption +# PUT /types/{type_id}/encryption/{encryption_id} +# GET /types/{type_id}/encryption +# GET /types/{type_id}/encryption/{encryption_id} +# DELETE /types/{type_id}/encryption/{encryption_id} +"volume_extension:volume_type_encryption": "rule:admin" + +# List or show volume type with access type extra specs attribute. +# GET /types/{type_id} +# GET /types +"volume_extension:access_types_extra_specs": "rule:admin or rule:reader" + +# List or show volume type with access type qos specs id attribute. +# GET /types/{type_id} +# GET /types +"volume_extension:access_types_qos_specs_id": "rule:admin or rule:reader" + +# Volume type access related APIs. +# GET /types +# GET /types/detail +# GET /types/{type_id} +# POST /types +"volume_extension:volume_type_access": "rule:admin or rule:member" + +# Add volume type access for project. +# POST /types/{type_id}/action (addProjectAccess) +"volume_extension:volume_type_access:addProjectAccess": "rule:admin" + +# Remove volume type access for project. +# POST /types/{type_id}/action (removeProjectAccess) +"volume_extension:volume_type_access:removeProjectAccess": "rule:admin" + +# Extend a volume. +# POST /volumes/{volume_id}/action (os-extend) +"volume:extend": "rule:admin or rule:member" + +# Extend a attached volume. +# POST /volumes/{volume_id}/action (os-extend) +"volume:extend_attached_volume": "rule:admin or rule:member" + +# Revert a volume to a snapshot. +# POST /volumes/{volume_id}/action (revert) +"volume:revert_to_snapshot": "rule:admin or rule:member" + +# Reset status of a volume. +# POST /volumes/{volume_id}/action (os-reset_status) +"volume_extension:volume_admin_actions:reset_status": "rule:admin" + +# Retype a volume. +# POST /volumes/{volume_id}/action (os-retype) +"volume:retype": "rule:admin or rule:member" + +# Update a volume's readonly flag. +# POST /volumes/{volume_id}/action (os-update_readonly_flag) +"volume:update_readonly_flag": "rule:admin or rule:member" + +# Force delete a volume. +# POST /volumes/{volume_id}/action (os-force_delete) +"volume_extension:volume_admin_actions:force_delete": "rule:admin" + +# Upload a volume to image with public visibility. +# POST /volumes/{volume_id}/action (os-volume_upload_image) +"volume_extension:volume_actions:upload_public": "rule:admin" + +# Upload a volume to image. +# POST /volumes/{volume_id}/action (os-volume_upload_image) +"volume_extension:volume_actions:upload_image": "rule:admin or rule:member" + +# Force detach a volume. +# POST /volumes/{volume_id}/action (os-force_detach) +"volume_extension:volume_admin_actions:force_detach": "rule:admin" + +# migrate a volume to a specified host. +# POST /volumes/{volume_id}/action (os-migrate_volume) +"volume_extension:volume_admin_actions:migrate_volume": "rule:admin" + +# Complete a volume migration. +# POST /volumes/{volume_id}/action (os-migrate_volume_completion) +"volume_extension:volume_admin_actions:migrate_volume_completion": "rule:admin" + +# Initialize volume attachment. +# POST /volumes/{volume_id}/action (os-initialize_connection) +"volume_extension:volume_actions:initialize_connection": "rule:admin or rule:member" + +# Terminate volume attachment. +# POST /volumes/{volume_id}/action (os-terminate_connection) +"volume_extension:volume_actions:terminate_connection": "rule:admin or rule:member" + +# Roll back volume status to 'in-use'. +# POST /volumes/{volume_id}/action (os-roll_detaching) +"volume_extension:volume_actions:roll_detaching": "rule:admin or rule:member" + +# Mark volume as reserved. +# POST /volumes/{volume_id}/action (os-reserve) +"volume_extension:volume_actions:reserve": "rule:admin or rule:member" + +# Unmark volume as reserved. +# POST /volumes/{volume_id}/action (os-unreserve) +"volume_extension:volume_actions:unreserve": "rule:admin or rule:member" + +# Begin detach volumes. +# POST /volumes/{volume_id}/action (os-begin_detaching) +"volume_extension:volume_actions:begin_detaching": "rule:admin or rule:member" + +# Add attachment metadata. +# POST /volumes/{volume_id}/action (os-attach) +"volume_extension:volume_actions:attach": "rule:admin or rule:member" + +# Clear attachment metadata. +# POST /volumes/{volume_id}/action (os-detach) +"volume_extension:volume_actions:detach": "rule:admin or rule:member" + +# List volume transfer. +# GET /os-volume-transfer +# GET /os-volume-transfer/detail +# GET /volume_transfers +# GET /volume_transfers/detail +"volume:get_all_transfers": "rule:admin or rule:member or rule:reader" + +# Create a volume transfer. +# POST /os-volume-transfer +# POST /volume_transfers +"volume:create_transfer": "rule:admin or rule:member" + +# Show one specified volume transfer. +# GET /os-volume-transfer/{transfer_id} +# GET /volume_transfers/{transfer_id} +"volume:get_transfer": "rule:admin or rule:member or rule:reader" + +# Accept a volume transfer. +# POST /os-volume-transfer/{transfer_id}/accept +# POST /volume_transfers/{transfer_id}/accept +"volume:accept_transfer": "rule:admin or rule:member" + +# Delete volume transfer. +# DELETE /os-volume-transfer/{transfer_id} +# DELETE /volume_transfers/{transfer_id} +"volume:delete_transfer": "rule:admin or rule:member" + +# Show volume's metadata or one specified metadata with a given key. +# GET /volumes/{volume_id}/metadata +# GET /volumes/{volume_id}/metadata/{key} +"volume:get_volume_metadata": "rule:admin or rule:member or rule:reader" + +# Create volume metadata. +# POST /volumes/{volume_id}/metadata +"volume:create_volume_metadata": "rule:admin or rule:member" + +# Update volume's metadata or one specified metadata with a given key. +# PUT /volumes/{volume_id}/metadata +# PUT /volumes/{volume_id}/metadata/{key} +"volume:update_volume_metadata": "rule:admin or rule:member" + +# Delete volume's specified metadata with a given key. +# DELETE /volumes/{volume_id}/metadata/{key} +"volume:delete_volume_metadata": "rule:admin or rule:member" + +# Volume's image metadata related operation, create, delete, show and +# list. +# GET /volumes/detail +# GET /volumes/{volume_id} +# POST /volumes/{volume_id}/action (os-set_image_metadata) +# POST /volumes/{volume_id}/action (os-unset_image_metadata) +"volume_extension:volume_image_metadata": "rule:admin or rule:member" + +# Update volume admin metadata. It's used in `attach` and `os- +# update_readonly_flag` APIs +# POST /volumes/{volume_id}/action (os-update_readonly_flag) +# POST /volumes/{volume_id}/action (os-attach) +"volume:update_volume_admin_metadata": "rule:admin" + +# List type extra specs. +# GET /types/{type_id}/extra_specs +"volume_extension:types_extra_specs:index": "rule:admin or rule:reader" + +# Create type extra specs. +# POST /types/{type_id}/extra_specs +"volume_extension:types_extra_specs:create": "rule:admin" + +# Show one specified type extra specs. +# GET /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:show": "rule:admin or rule:reader" + +# Update type extra specs. +# PUT /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:update": "rule:admin" + +# Delete type extra specs. +# DELETE /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:delete": "rule:admin" + +# Create volume. +# POST /volumes +"volume:create": "rule:admin or rule:member" + +# Create volume from image. +# POST /volumes +"volume:create_from_image": "rule:admin or rule:member" + +# Show volume. +# GET /volumes/{volume_id} +"volume:get": "rule:admin or rule:member or rule:reader" + +# List volumes or get summary of volumes. +# GET /volumes +# GET /volumes/detail +# GET /volumes/summary +"volume:get_all": "rule:admin or rule:member or rule:reader" + +# Update volume. +# PUT /volumes +"volume:update": "rule:admin or rule:member" + +# Delete volume. +# DELETE /volumes/{volume_id} +"volume:delete": "rule:admin or rule:member" + +# Force Delete a volume. +# DELETE /volumes/{volume_id} +"volume:force_delete": "rule:admin" + +# List or show volume with host attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_host_attribute": "rule:admin or rule:reader" + +# List or show volume with tenant attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_tenant_attribute": "rule:admin or rule:member or rule:reader" + +# List or show volume with migration status attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_mig_status_attribute": "rule:admin or rule:reader" + +# Show volume's encryption metadata. +# GET /volumes/{volume_id}/encryption +# GET /volumes/{volume_id}/encryption/{encryption_key} +"volume_extension:volume_encryption_metadata": "rule:admin or rule:member or rule:reader" + +# Create multiattach capable volume. +# POST /volumes +"volume:multiattach": "rule:admin or rule:member" diff --git a/etc/glance/policy.json b/etc/glance/policy.json deleted file mode 100644 index 161ee6c..0000000 --- a/etc/glance/policy.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "readonly": "(project_id:%(project_id)s and role:readonly)", - "global_readonly": "(role:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "default": "role:admin", - - "add_image": "rule:admin or rule:member", - "delete_image": "rule:admin or rule:member or rule:owner", - "get_image": "rule:admin or rule:member or rule:readonly", - "get_images": "rule:admin or rule:member or rule:readonly", - "modify_image": "rule:admin or rule:member", - "publicize_image": "rule:admin", - "copy_from": "rule:admin or rule:member", - - "download_image": "rule:admin or rule:member", - "upload_image": "rule:admin or rule:member", - - "delete_image_location": "rule:admin or rule:member", - "get_image_location": "rule:admin or rule:member", - "set_image_location": "rule:admin or rule:member", - - "add_member": "rule:admin or rule:member", - "delete_member": "rule:admin or rule:member", - "get_member": "rule:admin or rule:member or rule:readonly", - "get_members": "rule:admin or rule:member or rule:readonly", - "modify_member": "rule:admin or rule:member", - - "manage_image_cache": "role:admin", - - "get_task": "role:admin", - "get_tasks": "role:admin", - "add_task": "role:admin", - "modify_task": "role:admin", - - "deactivate": "rule:admin or rule:member", - "reactivate": "rule:admin or rule:member", - - "get_metadef_namespace": "rule:admin or rule:member or rule:readonly", - "get_metadef_namespaces":"rule:admin or rule:member or rule:readonly", - "modify_metadef_namespace":"rule:admin or rule:member", - "add_metadef_namespace":"rule:admin or rule:member", - - "get_metadef_object":"rule:admin or rule:member or rule:readonly", - "get_metadef_objects":"rule:admin or rule:member or rule:readonly", - "modify_metadef_object":"rule:admin or rule:member", - "add_metadef_object":"rule:admin or rule:member", - - "list_metadef_resource_types":"rule:admin or rule:member or rule:readonly", - "get_metadef_resource_type":"rule:admin or rule:member or rule:readonly", - "add_metadef_resource_type_association":"rule:admin or rule:member", - - "get_metadef_property":"rule:admin or rule:member or rule:readonly", - "get_metadef_properties":"rule:admin or rule:member or rule:readonly", - "modify_metadef_property":"rule:admin or rule:member", - "add_metadef_property":"rule:admin or rule:member", - - "get_metadef_tag":"rule:admin or rule:member or rule:readonly", - "get_metadef_tags":"rule:admin or rule:member or rule:readonly", - "modify_metadef_tag":"rule:admin or rule:member", - "add_metadef_tag":"rule:admin or rule:member", - "add_metadef_tags":"rule:admin or rule:member" - -} diff --git a/etc/glance/policy.yaml b/etc/glance/policy.yaml new file mode 100644 index 0000000..642bb7c --- /dev/null +++ b/etc/glance/policy.yaml @@ -0,0 +1,101 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +# We add here a check for if the image is public, allowing a member to use public images on the cloud +member: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + + +# List available image entities +# GET /v1/images +# GET /v1/images/detail +# GET /v2/images +"get_images": "rule:admin or rule:member or rule:reader" + +# Retrieve a specific image entity +# HEAD /v1/images/ +# GET /v1/images/ +# GET /v2/images/ +"get_image": "rule:admin or rule:member or rule:reader" + +# Download binary image data +# GET /v1/images/ +# GET /v2/images//file +"download_image": "rule:admin or rule:member or rule:reader" + +# Upload binary image data +# POST /v1/images +# PUT /v1/images/ +# PUT /v2/images//file +"upload_image": "rule:admin or rule:member" + +# Copy binary image data from URL +# POST /v1/images +# PUT /v1/images/ +"copy_from": "rule:admin or rule:member" + +# Create an image entity +# POST /v1/images +# POST /v2/images +"add_image": "rule:admin or rule:member" + +# Update an image entity +# PUT /v1/images/ +# PUT /v2/images/ +"modify_image": "rule:admin or rule:member" + +# Create or update public images +# POST /v1/images with attribute is_public = true +# PUT /v1/images/ with attribute is_public = true +# POST /v2/images with attribute visibility = public +# PUT /v2/images/ with attribute visibility = public +"publicize_image": "rule:admin or rule:member" + +# Create or update community images +# POST /v2/images with attribute visibility = community +# PUT /v2/images/ with attribute visibility = community +"communitize_image": "rule:admin or rule:member" + +# Delete an image entity and associated binary data +# DELETE /v1/images/ +# DELETE /v2/images/ +"delete_image": "rule:admin or rule:member" + +# Add a membership to the member repo of an image +# POST /v2/images//members +"add_member": "rule:admin or rule:member" + +# List the members of an image +# GET /v1/images//members +# GET /v2/images//members +"get_members": "rule:admin or rule:member or rule:reader" + +# Delete a membership of an image +# DELETE /v1/images//members/ +# DELETE /v2/images//members/ +"delete_member": "rule:admin or rule:member" + +# Create or update the membership of an image +# PUT /v1/images//members/ +# PUT /v1/images//members +# POST /v2/images//members +# PUT /v2/images//members/ +"modify_member": "rule:admin or rule:member" + +# Allowed to use the image cache management API +"manage_image_cache": "rule:admin or rule:member" diff --git a/etc/gnocchi/policy.json b/etc/gnocchi/policy.json deleted file mode 100644 index 638edb5..0000000 --- a/etc/gnocchi/policy.json +++ /dev/null @@ -1,49 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "creator": "(project_id:%(created_by_project_id)s and (rule:_member_role or role:service))", - "resource_owner": "(project_id:%(project_id)s and (rule:_member_role or role:service))", - "metric_owner": "(project_id:%(resource.project_id)s and (rule:_member_role or role:service))", - - "get status": "rule:admin or rule:readonly", - - "create resource": "rule:admin or rule:member or rule:resource_owner", - "get resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", - "update resource": "rule:admin or rule:creator", - "delete resource": "rule:admin or rule:creator", - "delete resources": "rule:admin or rule:creator", - "list resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", - "search resource": "rule:admin or rule:creator or rule:resource_owner or rule:readonly", - - "create resource type": "rule:admin", - "delete resource type": "rule:admin", - "update resource type": "rule:admin", - "list resource type": "rule:admin or rule:member or rule:readonly", - "get resource type": "rule:admin or rule:member or rule:readonly", - - "get archive policy": "rule:admin or rule:member or rule:readonly", - "list archive policy": "rule:admin or rule:member or rule:readonly", - "create archive policy": "rule:admin", - "update archive policy": "rule:admin", - "delete archive policy": "rule:admin", - - "create archive policy rule": "rule:admin", - "get archive policy rule": "rule:admin or rule:member or rule:readonly", - "list archive policy rule": "rule:admin or rule:member or rule:readonly", - "delete archive policy rule": "rule:admin", - - "create metric": "rule:admin or rule:member or rule:metric_owner", - "delete metric": "rule:admin or rule:creator", - "get metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", - "search metric": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", - "list metric": "rule:admin or rule:member or rule:readonly", - "list all metric": "rule:admin or rule:readonly", - - "get measures": "rule:admin or rule:creator or rule:metric_owner or rule:readonly", - "post measures": "rule:admin or rule:creator" -} diff --git a/etc/gnocchi/policy.yaml b/etc/gnocchi/policy.yaml new file mode 100644 index 0000000..2f30ea1 --- /dev/null +++ b/etc/gnocchi/policy.yaml @@ -0,0 +1,61 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +# For gnocchi, this also adds a check to who created the resource +_member_role: "(role:member or role:_member_ or user:%(creator)s)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +# For gnocchi, this also adds a check for the resource to be part of the user's project +member: "(rule:_member_role and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +"get status": "rule:admin or rule:reader" + +"create resource": "rule:admin or rule:member" +"get resource": "rule:admin or rule:member or rule:reader" +"update resource": "rule:admin or rule:member" +"delete resource": "rule:admin or rule:member" +"delete resources": "rule:admin or rule:member" +"list resource": "rule:admin or rule:member or rule:reader" +"search resource": "rule:admin or rule:member or rule:reader" + +"create resource type": "rule:admin" +"delete resource type": "rule:admin" +"update resource type": "rule:admin" +"list resource type": "rule:admin or rule:member or rule:reader" +"get resource type": "rule:admin or rule:member or rule:reader" + +"get archive policy": "rule:admin or rule:member or rule:reader" +"list archive policy": "rule:admin or rule:member or rule:reader" +"create archive policy": "rule:admin" +"update archive policy": "rule:admin" +"delete archive policy": "rule:admin" + +"create archive policy rule": "rule:admin" +"get archive policy rule": "rule:admin or rule:member or rule:reader" +"list archive policy rule": "rule:admin or rule:member or rule:reader" +"update archive policy rule": "rule:admin" +"delete archive policy rule": "rule:admin" + +"create metric": "rule:admin or rule:member" +"delete metric": "rule:admin or rule:member" +"get metric": "rule:admin or rule:member or rule:reader" +"search metric": "rule:admin or rule:member or rule:reader" +"list metric": "rule:admin or rule:member or rule:reader" + +"get measures": "rule:admin or rule:member or rule:reader" +"post measures": "rule:admin or rule:member" diff --git a/etc/heat/policy.json b/etc/heat/policy.json deleted file mode 100644 index 5357479..0000000 --- a/etc/heat/policy.json +++ /dev/null @@ -1,95 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "deny_stack_user": "((rule:admin or rule:member) and (not role:heat_stack_user))", - - "cloudformation:ListStacks": "rule:deny_stack_user", - "cloudformation:CreateStack": "rule:deny_stack_user", - "cloudformation:DescribeStacks": "rule:deny_stack_user", - "cloudformation:DeleteStack": "rule:deny_stack_user", - "cloudformation:UpdateStack": "rule:deny_stack_user", - "cloudformation:CancelUpdateStack": "rule:deny_stack_user", - "cloudformation:DescribeStackEvents": "rule:deny_stack_user", - "cloudformation:ValidateTemplate": "rule:deny_stack_user", - "cloudformation:GetTemplate": "rule:deny_stack_user", - "cloudformation:EstimateTemplateCost": "rule:deny_stack_user", - "cloudformation:DescribeStackResource": "rule:admin or rule:member", - "cloudformation:DescribeStackResources": "rule:deny_stack_user", - "cloudformation:ListStackResources": "rule:deny_stack_user", - "cloudwatch:DeleteAlarms": "rule:deny_stack_user", - "cloudwatch:DescribeAlarmHistory": "rule:deny_stack_user", - "cloudwatch:DescribeAlarms": "rule:deny_stack_user", - "cloudwatch:DescribeAlarmsForMetric": "rule:deny_stack_user", - "cloudwatch:DisableAlarmActions": "rule:deny_stack_user", - "cloudwatch:EnableAlarmActions": "rule:deny_stack_user", - "cloudwatch:GetMetricStatistics": "rule:deny_stack_user", - "cloudwatch:ListMetrics": "rule:deny_stack_user", - "cloudwatch:PutMetricAlarm": "rule:deny_stack_user", - "cloudwatch:PutMetricData": "rule:admin or rule:member", - "cloudwatch:SetAlarmState": "rule:deny_stack_user", - "actions:action": "rule:deny_stack_user", - "build_info:build_info": "rule:deny_stack_user", - "events:index": "rule:deny_stack_user", - "events:show": "rule:deny_stack_user", - "resource:index": "rule:deny_stack_user", - "resource:metadata": "rule:admin or rule:member", - "resource:signal": "rule:admin or rule:member", - "resource:mark_unhealthy": "rule:deny_stack_user", - "resource:show": "rule:deny_stack_user", - "stacks:abandon": "rule:deny_stack_user", - "stacks:create": "rule:deny_stack_user", - "stacks:delete": "rule:deny_stack_user", - "stacks:detail": "rule:deny_stack_user", - "stacks:export": "rule:deny_stack_user", - "stacks:generate_template": "rule:deny_stack_user", - "stacks:global_index": "rule:admin", - "stacks:index": "rule:deny_stack_user", - "stacks:list_resource_types": "rule:deny_stack_user", - "stacks:list_template_versions": "rule:deny_stack_user", - "stacks:list_template_functions": "rule:deny_stack_user", - "stacks:lookup": "rule:admin or rule:member", - "stacks:preview": "rule:deny_stack_user", - "stacks:resource_schema": "rule:deny_stack_user", - "stacks:show": "rule:deny_stack_user", - "stacks:template": "rule:deny_stack_user", - "stacks:environment": "rule:deny_stack_user", - "stacks:files": "rule:deny_stack_user", - "stacks:update": "rule:deny_stack_user", - "stacks:update_patch": "rule:deny_stack_user", - "stacks:preview_update": "rule:deny_stack_user", - "stacks:preview_update_patch": "rule:deny_stack_user", - "stacks:validate_template": "rule:deny_stack_user", - "stacks:snapshot": "rule:deny_stack_user", - "stacks:show_snapshot": "rule:deny_stack_user", - "stacks:delete_snapshot": "rule:deny_stack_user", - "stacks:list_snapshots": "rule:deny_stack_user", - "stacks:restore_snapshot": "rule:deny_stack_user", - "stacks:list_outputs": "rule:deny_stack_user", - "stacks:show_output": "rule:deny_stack_user", - "software_configs:global_index": "rule:admin", - "software_configs:index": "rule:deny_stack_user", - "software_configs:create": "rule:deny_stack_user", - "software_configs:show": "rule:deny_stack_user", - "software_configs:delete": "rule:deny_stack_user", - "software_deployments:index": "rule:deny_stack_user", - "software_deployments:create": "rule:deny_stack_user", - "software_deployments:show": "rule:deny_stack_user", - "software_deployments:update": "rule:deny_stack_user", - "software_deployments:delete": "rule:deny_stack_user", - "software_deployments:metadata": "rule:admin or rule:member", - "service:index": "rule:admin", - "resource_types:OS::Nova::Flavor": "rule:admin", - "resource_types:OS::Cinder::EncryptedVolumeType": "rule:admin", - "resource_types:OS::Cinder::VolumeType": "rule:admin", - "resource_types:OS::Cinder::Quota": "rule:admin", - "resource_types:OS::Manila::ShareType": "rule:admin", - "resource_types:OS::Neutron::QoSPolicy": "rule:admin", - "resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:admin", - "resource_types:OS::Nova::HostAggregate": "rule:admin", - "resource_types:OS::Cinder::QoSSpecs": "rule:admin" -} diff --git a/etc/heat/policy.yaml b/etc/heat/policy.yaml new file mode 100644 index 0000000..dfcc9c5 --- /dev/null +++ b/etc/heat/policy.yaml @@ -0,0 +1,343 @@ +# An additional rule that prevents users created via stack from creating additional stacks +"deny_stack_user": "(not role:heat_stack_user)" + +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader and rule:deny_stack_user)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) and rule:deny_stack_user)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "((rule:_member_role and project_id:%(project_id)s) and rule:deny_stack_user)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "((is_admin:True or role:admin) and rule:deny_stack_user)" + +# This rule is specific for a user's own objects +owner: "((rule:_member_role and user_id:%(user_id)s) and rule:deny_stack_user)" + +# Decides what is required for the 'is_admin:True' check to succeed. +"context_is_admin": "role:admin" + +### Policy Rules defined in heat.policies.base + +# Default rule for deny everybody. +# +"deny_everybody": "!" + +# Default rule for allow everybody. +# +"allow_everybody": "" + +### Policy Rules defined in heat.policies.actions + +# Performs non-lifecycle operations on the stack (Snapshot, Resume, Cancel update, or check stack resources). +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions +"actions:action": "rule:admin or rule:member" + +### Policy Rules defined in heat.policies.build_info + +# Show build information. +# GET /v1/{tenant_id}/build_info +"build_info:build_info": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.cloudformation + +# +"cloudformation:ListStacks": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:CreateStack": "rule:admin or rule:member" + +# +"cloudformation:DescribeStacks": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DeleteStack": "rule:admin or rule:member" + +# +"cloudformation:UpdateStack": "rule:admin or rule:member" + +# +"cloudformation:CancelUpdateStack": "rule:admin or rule:member" + +# +"cloudformation:DescribeStackEvents": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:ValidateTemplate": "rule:admin or rule:member" + +# +"cloudformation:GetTemplate": "rule:admin or rule:member" + +# +"cloudformation:EstimateTemplateCost": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DescribeStackResource": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DescribeStackResources": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:ListStackResources": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.events + +# List events. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/events +"events:index": "rule:admin or rule:member or rule:reader" + +# Show event. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/events/{event_id} +"events:show": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.resource + +# List resources. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources +"resource:index": "rule:admin or rule:member or rule:reader" + +# Show resource metadata. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/metadata +"resource:metadata": "rule:admin or rule:member or rule:reader" + +# Signal resource. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/signal +"resource:signal": "rule:admin or rule:member or rule:reader" + +# Mark resource as unhealthy. +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name_or_physical_id} +"resource:mark_unhealthy": "rule:admin or rule:member" + +# Show resource. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name} +"resource:show": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.resource_types + +# +"resource_types:OS::Nova::Flavor": "rule:admin" + +# +"resource_types:OS::Cinder::EncryptedVolumeType": "rule:admin" + +# +"resource_types:OS::Cinder::VolumeType": "rule:admin" + +# +"resource_types:OS::Cinder::Quota": "rule:admin" + +# +"resource_types:OS::Neutron::Quota": "rule:admin" + +# +"resource_types:OS::Nova::Quota": "rule:admin" + +# +"resource_types:OS::Manila::ShareType": "rule:admin" + +# +"resource_types:OS::Neutron::ProviderNet": "rule:admin" + +# +"resource_types:OS::Neutron::QoSPolicy": "rule:admin" + +# +"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:admin" + +# +"resource_types:OS::Neutron::Segment": "rule:admin" + +# +"resource_types:OS::Nova::HostAggregate": "rule:admin" + +# +"resource_types:OS::Cinder::QoSSpecs": "rule:admin" + +# +"resource_types:OS::Cinder::QoSAssociation": "rule:admin" + +# +"resource_types:OS::Keystone::*": "rule:admin" + +### Policy Rules defined in heat.policies.service + +# +"service:index": "rule:admin or rule:reader" + +### Policy Rules defined in heat.policies.software_configs + +# List configs globally. +# GET /v1/{tenant_id}/software_configs +"software_configs:global_index": "rule:deny_everybody" + +# List configs. +# GET /v1/{tenant_id}/software_configs +"software_configs:index": "rule:admin or rule:member or rule:reader" + +# Create config. +# POST /v1/{tenant_id}/software_configs +"software_configs:create": "rule:admin or rule:member" + +# Show config details. +# GET /v1/{tenant_id}/software_configs/{config_id} +"software_configs:show": "rule:admin or rule:member or rule:reader" + +# Delete config. +# DELETE /v1/{tenant_id}/software_configs/{config_id} +"software_configs:delete": "rule:admin or rule:member" + +### Policy Rules defined in heat.policies.software_deployments + +# List deployments. +# GET /v1/{tenant_id}/software_deployments +"software_deployments:index": "rule:admin or rule:member or rule:reader" + +# Create deployment. +# POST /v1/{tenant_id}/software_deployments +"software_deployments:create": "rule:admin or rule:member" + +# Show deployment details. +# GET /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:show": "rule:admin or rule:member or rule:reader" + +# Update deployment. +# PUT /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:update": "rule:admin or rule:member" + +# Delete deployment. +# DELETE /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:delete": "rule:admin or rule:member" + +# Show server configuration metadata. +# GET /v1/{tenant_id}/software_deployments/metadata/{server_id} +"software_deployments:metadata": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.stacks + +# Abandon stack. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/abandon +"stacks:abandon": "rule:admin or rule:member" + +# Create stack. +# POST /v1/{tenant_id}/stacks +"stacks:create": "rule:admin or rule:member" + +# Delete stack. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:delete": "rule:admin or rule:member" + +# List stacks in detail. +# GET /v1/{tenant_id}/stacks +"stacks:detail": "rule:admin or rule:member or rule:reader" + +# Export stack. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/export +"stacks:export": "rule:admin or rule:member or rule:reader" + +# Generate stack template. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template +"stacks:generate_template": "rule:admin or rule:member or rule:reader" + +# List stacks globally. +# GET /v1/{tenant_id}/stacks +"stacks:global_index": "rule:deny_everybody" + +# List stacks. +# GET /v1/{tenant_id}/stacks +"stacks:index": "rule:admin or rule:member or rule:reader" + +# List resource types. +# GET /v1/{tenant_id}/resource_types +"stacks:list_resource_types": "rule:admin or rule:member or rule:reader" + +# List template versions. +# GET /v1/{tenant_id}/template_versions +"stacks:list_template_versions": "rule:admin or rule:member or rule:reader" + +# List template functions. +# GET /v1/{tenant_id}/template_versions/{template_version}/functions +"stacks:list_template_functions": "rule:admin or rule:member or rule:reader" + +# Find stack. +# GET /v1/{tenant_id}/stacks/{stack_identity} +"stacks:lookup": "rule:admin or rule:member or rule:reader" + +# Preview stack. +# POST /v1/{tenant_id}/stacks/preview +"stacks:preview": "rule:admin or rule:member" + +# Show resource type schema. +# GET /v1/{tenant_id}/resource_types/{type_name} +"stacks:resource_schema": "rule:admin or rule:member or rule:reader" + +# Show stack. +# GET /v1/{tenant_id}/stacks/{stack_identity} +"stacks:show": "rule:admin or rule:member or rule:reader" + +# Get stack template. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template +"stacks:template": "rule:admin or rule:member" + +# Get stack environment. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/environment +"stacks:environment": "rule:admin or rule:member" + +# Get stack files. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/files +"stacks:files": "rule:admin or rule:member" + +# Update stack. +# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:update": "rule:admin or rule:member" + +# Update stack (PATCH). +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:update_patch": "rule:admin or rule:member" + +# Preview update stack. +# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview +"stacks:preview_update": "rule:admin or rule:member" + +# Preview update stack (PATCH). +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview +"stacks:preview_update_patch": "rule:admin or rule:member" + +# Validate template. +# POST /v1/{tenant_id}/validate +"stacks:validate_template": "rule:admin or rule:member" + +# Snapshot Stack. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots +"stacks:snapshot": "rule:admin or rule:member" + +# Show snapshot. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} +"stacks:show_snapshot": "rule:admin or rule:member or rule:reader" + +# Delete snapshot. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} +"stacks:delete_snapshot": "rule:admin or rule:member" + +# List snapshots. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots +"stacks:list_snapshots": "rule:admin or rule:member or rule:reader" + +# Restore snapshot. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id}/restore +"stacks:restore_snapshot": "rule:admin or rule:member" + +# List outputs. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs +"stacks:list_outputs": "rule:admin or rule:member" + +# Show outputs. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs/{output_key} +"stacks:show_output": "rule:admin or rule:member" diff --git a/etc/ironic/policy.json b/etc/ironic/policy.json deleted file mode 100644 index 1ae73ec..0000000 --- a/etc/ironic/policy.json +++ /dev/null @@ -1,5 +0,0 @@ -# Beginning with the Newton release, you may leave this file empty -# to use default policy defined in code. -{ - -} diff --git a/etc/keystone/policy.json b/etc/keystone/policy.json deleted file mode 100644 index 223a651..0000000 --- a/etc/keystone/policy.json +++ /dev/null @@ -1,200 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "service": "role:service", - "token_subject": "user_id:%(target.token.user_id)s", - - - "default": "rule:admin", - - "identity:get_region": "", - "identity:list_regions": "", - "identity:create_region": "rule:admin", - "identity:update_region": "rule:admin", - "identity:delete_region": "rule:admin", - - "identity:get_service": "rule:admin", - "identity:list_services": "rule:admin", - "identity:create_service": "rule:admin", - "identity:update_service": "rule:admin", - "identity:delete_service": "rule:admin", - - "identity:get_endpoint": "rule:admin", - "identity:list_endpoints": "rule:admin or rule:readonly or rule:global_readonly", - "identity:create_endpoint": "rule:admin", - "identity:update_endpoint": "rule:admin", - "identity:delete_endpoint": "rule:admin", - - "identity:get_domain": "rule:admin or token.project.domain.id:%(target.domain.id)s or rule:readonly or rule:global_readonly", - "identity:list_domains": "rule:admin or rule:readonly or rule:global_readonly", - "identity:create_domain": "rule:admin", - "identity:update_domain": "rule:admin", - "identity:delete_domain": "rule:admin", - - "identity:get_project": "rule:admin or project_id:%(target.project.id)s", - "identity:list_projects": "rule:admin or rule:readonly or rule:global_readonly", - "identity:list_user_projects": "rule:admin or rule:owner or rule:readonly or rule:global_readonly", - "identity:create_project": "rule:admin", - "identity:update_project": "rule:admin", - "identity:delete_project": "rule:admin", - - "identity:get_user": "rule:admin or rule:owner or rule:readonly or rule:global_readonly", - "identity:list_users": "rule:admin or rule:readonly or rule:global_readonly", - "identity:create_user": "rule:admin", - "identity:update_user": "rule:admin", - "identity:delete_user": "rule:admin", - "identity:change_password": "rule:admin or rule:owner", - - "identity:get_group": "rule:admin", - "identity:list_groups": "rule:admin or rule:readonly or rule:global_readonly", - "identity:list_groups_for_user": "rule:admin or rule:owner or rule:readonly or rule:global_readonly", - "identity:create_group": "rule:admin", - "identity:update_group": "rule:admin", - "identity:delete_group": "rule:admin", - "identity:list_users_in_group": "rule:admin or rule:readonly or rule:global_readonly", - "identity:remove_user_from_group": "rule:admin", - "identity:check_user_in_group": "rule:admin", - "identity:add_user_to_group": "rule:admin", - - "identity:get_credential": "rule:admin", - "identity:list_credentials": "rule:admin", - "identity:create_credential": "rule:admin", - "identity:update_credential": "rule:admin", - "identity:delete_credential": "rule:admin", - - "identity:ec2_get_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s)", - "identity:ec2_list_credentials": "rule:admin or rule:owner", - "identity:ec2_create_credential": "rule:admin or rule:owner", - "identity:ec2_delete_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s)", - - "identity:get_role": "rule:admin", - "identity:list_roles": "rule:admin", - "identity:create_role": "rule:admin", - "identity:update_role": "rule:admin", - "identity:delete_role": "rule:admin", - "identity:get_domain_role": "rule:admin", - "identity:list_domain_roles": "rule:admin", - "identity:create_domain_role": "rule:admin", - "identity:update_domain_role": "rule:admin", - "identity:delete_domain_role": "rule:admin", - - "identity:get_implied_role": "rule:admin ", - "identity:list_implied_roles": "rule:admin", - "identity:create_implied_role": "rule:admin", - "identity:delete_implied_role": "rule:admin", - "identity:list_role_inference_rules": "rule:admin", - "identity:check_implied_role": "rule:admin", - - "identity:check_grant": "rule:admin", - "identity:list_grants": "rule:admin or rule:readonly or rule:global_readonly", - "identity:create_grant": "rule:admin", - "identity:revoke_grant": "rule:admin", - - "identity:list_role_assignments": "rule:admin", - "identity:list_role_assignments_for_tree": "rule:admin", - - "identity:get_policy": "rule:admin", - "identity:list_policies": "rule:admin", - "identity:create_policy": "rule:admin", - "identity:update_policy": "rule:admin", - "identity:delete_policy": "rule:admin", - - "identity:check_token": "rule:admin or rule:token_subject", - "identity:validate_token": "rule:service or rule:admin or rule:token_subject", - "identity:validate_token_head": "rule:service or rule:admin", - "identity:revocation_list": "rule:service or rule:admin", - "identity:revoke_token": "rule:admin or rule:token_subject", - - "identity:create_trust": "user_id:%(trust.trustor_user_id)s", - "identity:list_trusts": "", - "identity:list_roles_for_trust": "", - "identity:get_role_for_trust": "", - "identity:delete_trust": "", - - "identity:create_consumer": "rule:admin", - "identity:get_consumer": "rule:admin", - "identity:list_consumers": "rule:admin", - "identity:delete_consumer": "rule:admin", - "identity:update_consumer": "rule:admin", - - "identity:authorize_request_token": "rule:admin", - "identity:list_access_token_roles": "rule:admin", - "identity:get_access_token_role": "rule:admin", - "identity:list_access_tokens": "rule:admin", - "identity:get_access_token": "rule:admin", - "identity:delete_access_token": "rule:admin", - - "identity:list_projects_for_endpoint": "rule:admin or rule:readonly or rule:global_readonly", - "identity:add_endpoint_to_project": "rule:admin", - "identity:check_endpoint_in_project": "rule:admin", - "identity:list_endpoints_for_project": "rule:admin or rule:readonly or rule:global_readonly", - "identity:remove_endpoint_from_project": "rule:admin", - - "identity:create_endpoint_group": "rule:admin", - "identity:list_endpoint_groups": "rule:admin or rule:readonly or rule:global_readonly", - "identity:get_endpoint_group": "rule:admin", - "identity:update_endpoint_group": "rule:admin", - "identity:delete_endpoint_group": "rule:admin", - "identity:list_projects_associated_with_endpoint_group": "rule:admin", - "identity:list_endpoints_associated_with_endpoint_group": "rule:admin", - "identity:get_endpoint_group_in_project": "rule:admin", - "identity:list_endpoint_groups_for_project": "rule:admin", - "identity:add_endpoint_group_to_project": "rule:admin", - "identity:remove_endpoint_group_from_project": "rule:admin", - - "identity:create_identity_provider": "rule:admin", - "identity:list_identity_providers": "rule:admin", - "identity:get_identity_providers": "rule:admin", - "identity:update_identity_provider": "rule:admin", - "identity:delete_identity_provider": "rule:admin", - - "identity:create_protocol": "rule:admin", - "identity:update_protocol": "rule:admin", - "identity:get_protocol": "rule:admin", - "identity:list_protocols": "rule:admin", - "identity:delete_protocol": "rule:admin", - - "identity:create_mapping": "rule:admin", - "identity:get_mapping": "rule:admin", - "identity:list_mappings": "rule:admin", - "identity:delete_mapping": "rule:admin", - "identity:update_mapping": "rule:admin", - - "identity:create_service_provider": "rule:admin", - "identity:list_service_providers": "rule:admin", - "identity:get_service_provider": "rule:admin", - "identity:update_service_provider": "rule:admin", - "identity:delete_service_provider": "rule:admin", - - "identity:get_auth_catalog": "", - "identity:get_auth_projects": "", - "identity:get_auth_domains": "", - - "identity:list_projects_for_user": "", - "identity:list_domains_for_user": "", - - "identity:list_revoke_events": "", - - "identity:create_policy_association_for_endpoint": "rule:admin", - "identity:check_policy_association_for_endpoint": "rule:admin", - "identity:delete_policy_association_for_endpoint": "rule:admin", - "identity:create_policy_association_for_service": "rule:admin", - "identity:check_policy_association_for_service": "rule:admin", - "identity:delete_policy_association_for_service": "rule:admin", - "identity:create_policy_association_for_region_and_service": "rule:admin", - "identity:check_policy_association_for_region_and_service": "rule:admin", - "identity:delete_policy_association_for_region_and_service": "rule:admin", - "identity:get_policy_for_endpoint": "rule:admin", - "identity:list_endpoints_for_policy": "rule:admin", - - "identity:create_domain_config": "rule:admin", - "identity:get_domain_config": "rule:admin", - "identity:update_domain_config": "rule:admin", - "identity:delete_domain_config": "rule:admin", - "identity:get_domain_config_default": "rule:admin" -} diff --git a/etc/keystone/policy.yaml b/etc/keystone/policy.yaml new file mode 100644 index 0000000..68d2f21 --- /dev/null +++ b/etc/keystone/policy.yaml @@ -0,0 +1,1081 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# The role used by openstack services +"service_role": "(role:service)" + +# +"token_subject": "user_id:%(target.token.user_id)s" + +# RULES: + +# Show application credential details. +# GET /v3/users/{user_id}/application_credentials/{application_credential_id} +# HEAD /v3/users/{user_id}/application_credentials/{application_credential_id} +"identity:get_application_credential": "rule:admin or rule:owner or rule:reader" + +# List application credentials for a user. +# GET /v3/users/{user_id}/application_credentials +# HEAD /v3/users/{user_id}/application_credentials +"identity:list_application_credentials": "rule:admin or rule:owner or rule:reader" + +# Create an application credential. +# POST /v3/users/{user_id}/application_credentials +"identity:create_application_credential": "rule:admin or rule:owner" + +# Delete an application credential. +# DELETE /v3/users/{user_id}/application_credentials/{application_credential_id} +"identity:delete_application_credential": "rule:admin or rule:owner" + +# Authorize OAUTH1 request token. +# PUT /v3/OS-OAUTH1/authorize/{request_token_id} +# Intended scope(s): project +"identity:authorize_request_token": "rule:admin" + +# Get OAUTH1 access token for user by access token ID. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +"identity:get_access_token": "rule:admin" + +# Get role for user OAUTH1 access token. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id} +# Intended scope(s): project +"identity:get_access_token_role": "rule:admin" + +# List OAUTH1 access tokens for user. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens +# Intended scope(s): project +"identity:list_access_tokens": "rule:admin" + +# List OAUTH1 access token roles. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles +# Intended scope(s): project +"identity:list_access_token_roles": "rule:admin" + +# Delete OAUTH1 access token. +# DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +"identity:delete_access_token": "rule:admin" + +# Get service catalog. +# GET /v3/auth/catalog +# HEAD /v3/auth/catalog +"identity:get_auth_catalog": "rule:admin or rule:member" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +# HEAD /v3/auth/projects +"identity:get_auth_projects": "rule:admin or rule:member" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +# HEAD /v3/auth/domains +"identity:get_auth_domains": "rule:admin or rule:member" + +# List systems a user has access to via role assignments. +# GET /v3/auth/system +# HEAD /v3/auth/system +"identity:get_auth_system": "rule:admin or rule:member" + +# Show OAUTH1 consumer details. +# GET /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:get_consumer": "rule:admin" + +# List OAUTH1 consumers. +# GET /v3/OS-OAUTH1/consumers +# Intended scope(s): system +"identity:list_consumers": "rule:admin" + +# Create OAUTH1 consumer. +# POST /v3/OS-OAUTH1/consumers +# Intended scope(s): system +"identity:create_consumer": "rule:admin" + +# Update OAUTH1 consumer. +# PATCH /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:update_consumer": "rule:admin" + +# Delete OAUTH1 consumer. +# DELETE /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:delete_consumer": "rule:admin" + +# Show credentials details. +# GET /v3/credentials/{credential_id} +"identity:get_credential": "rule:admin" + +# List credentials. +# GET /v3/credentials +"identity:list_credentials": "rule:admin" + +# Create credential. +# POST /v3/credentials +"identity:create_credential": "rule:admin" + +# Update credential. +# PATCH /v3/credentials/{credential_id} +"identity:update_credential": "rule:admin" + +# Delete credential. +# DELETE /v3/credentials/{credential_id} +"identity:delete_credential": "rule:admin" + +# Show domain details. +# GET /v3/domains/{domain_id} +# Intended scope(s): system +"identity:get_domain": "rule:admin or token.project.domain.id:%(target.domain.id)s or rule:reader" + +# List domains. +# GET /v3/domains +# Intended scope(s): system +"identity:list_domains": "rule:admin or rule:reader" + +# Create domain. +# POST /v3/domains +# Intended scope(s): system +"identity:create_domain": "rule:admin" + +# Update domain. +# PATCH /v3/domains/{domain_id} +# Intended scope(s): system +"identity:update_domain": "rule:admin" + +# Delete domain. +# DELETE /v3/domains/{domain_id} +# Intended scope(s): system +"identity:delete_domain": "rule:admin" + +# Create domain configuration. +# PUT /v3/domains/{domain_id}/config +# Intended scope(s): system +"identity:create_domain_config": "rule:admin" + +# Get the entire domain configuration for a domain, an option group +# within a domain, or a specific configuration option within a group +# for a domain. +# GET /v3/domains/{domain_id}/config +# HEAD /v3/domains/{domain_id}/config +# GET /v3/domains/{domain_id}/config/{group} +# HEAD /v3/domains/{domain_id}/config/{group} +# GET /v3/domains/{domain_id}/config/{group}/{option} +# HEAD /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:get_domain_config": "rule:admin or rule:reader" + +# Get security compliance domain configuration for either a domain or +# a specific option in a domain. +# GET /v3/domains/{domain_id}/config/security_compliance +# HEAD /v3/domains/{domain_id}/config/security_compliance +# GET v3/domains/{domain_id}/config/security_compliance/{option} +# HEAD v3/domains/{domain_id}/config/security_compliance/{option} +# Intended scope(s): system, project +"identity:get_security_compliance_domain_config": "rule:admin or rule:member" + +# Update domain configuration for either a domain, specific group or a +# specific option in a group. +# PATCH /v3/domains/{domain_id}/config +# PATCH /v3/domains/{domain_id}/config/{group} +# PATCH /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:update_domain_config": "rule:admin" + +# Delete domain configuration for either a domain, specific group or a +# specific option in a group. +# DELETE /v3/domains/{domain_id}/config +# DELETE /v3/domains/{domain_id}/config/{group} +# DELETE /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:delete_domain_config": "rule:admin" + +# Get domain configuration default for either a domain, specific group +# or a specific option in a group. +# GET /v3/domains/config/default +# HEAD /v3/domains/config/default +# GET /v3/domains/config/{group}/default +# HEAD /v3/domains/config/{group}/default +# GET /v3/domains/config/{group}/{option}/default +# HEAD /v3/domains/config/{group}/{option}/default +# Intended scope(s): system +"identity:get_domain_config_default": "rule:admin or rule:reader" + +# Show ec2 credential details. +# GET /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +"identity:ec2_get_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s) or rule:reader" + +# List ec2 credentials. +# GET /v3/users/{user_id}/credentials/OS-EC2 +"identity:ec2_list_credentials": "rule:admin or rule:owner" + +# Create ec2 credential. +# POST /v3/users/{user_id}/credentials/OS-EC2 +"identity:ec2_create_credential": "rule:admin or rule:owner" + +# Delete ec2 credential. +# DELETE /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +"identity:ec2_delete_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s)" + +# Show endpoint details. +# GET /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:get_endpoint": "rule:admin or rule:reader" + +# List endpoints. +# GET /v3/endpoints +# Intended scope(s): system +"identity:list_endpoints": "rule:admin or rule:reader" + +# Create endpoint. +# POST /v3/endpoints +# Intended scope(s): system +"identity:create_endpoint": "rule:admin" + +# Update endpoint. +# PATCH /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:update_endpoint": "rule:admin" + +# Delete endpoint. +# DELETE /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:delete_endpoint": "rule:admin" + +# Create endpoint group. +# POST /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +"identity:create_endpoint_group": "rule:admin" + +# List endpoint groups. +# GET /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +"identity:list_endpoint_groups": "rule:admin or rule:reader" + +# Get endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:get_endpoint_group": "rule:admin or rule:reader" + +# Update endpoint group. +# PATCH /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:update_endpoint_group": "rule:admin" + +# Delete endpoint group. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:delete_endpoint_group": "rule:admin" + +# List all projects associated with a specific endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects +# Intended scope(s): system +"identity:list_projects_associated_with_endpoint_group": "rule:admin or rule:reader" + +# List all endpoints associated with an endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints +# Intended scope(s): system +"identity:list_endpoints_associated_with_endpoint_group": "rule:admin or rule:reader" + +# Check if an endpoint group is associated with a project. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:get_endpoint_group_in_project": "rule:admin or rule:reader" + +# List endpoint groups associated with a specific project. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoint_groups +# Intended scope(s): system +"identity:list_endpoint_groups_for_project": "rule:admin or rule:reader" + +# Allow a project to access an endpoint group. +# PUT /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:add_endpoint_group_to_project": "rule:admin" + +# Remove endpoint group from project. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:remove_endpoint_group_from_project": "rule:admin" + +# Check a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# HEAD /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# GET /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# GET /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:check_grant": "rule:admin or rule:reader" + +# List roles granted to an actor on a target. A target can be either a +# domain or a project. An actor can be either a user or a group. For +# the OS-INHERIT APIs, it is possible to list inherited role grants +# for actors on domains, where grants are inherited to all projects in +# the specified domain. +# GET /v3/projects/{project_id}/users/{user_id}/roles +# HEAD /v3/projects/{project_id}/users/{user_id}/roles +# GET /v3/projects/{project_id}/groups/{group_id}/roles +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles +# GET /v3/domains/{domain_id}/users/{user_id}/roles +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles +# GET /v3/domains/{domain_id}/groups/{group_id}/roles +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects +# Intended scope(s): system +"identity:list_grants": "rule:admin or rule:reader" + +# Create a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:create_grant": "rule:admin" + +# Revoke a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. In that case, revoking the role grant in the target +# would remove the logical effect of inheriting it to the target's +# projects subtree. +# DELETE /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:revoke_grant": "rule:admin" + +# List all grants a specific user has on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles +# Intended scope(s): system +"identity:list_system_grants_for_user": "rule:admin or rule:reader" + +# Check if a user has a role on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:check_system_grant_for_user": "rule:admin or rule:reader" + +# Grant a user a role on the system. +# ['PUT'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:create_system_grant_for_user": "rule:admin" + +# Remove a role from a user on the system. +# ['DELETE'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:revoke_system_grant_for_user": "rule:admin" + +# List all grants a specific group has on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles +# Intended scope(s): system +"identity:list_system_grants_for_group": "rule:admin or rule:reader" + +# Check if a group has a role on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:check_system_grant_for_group": "rule:admin or rule:reader" + +# Grant a group a role on the system. +# ['PUT'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:create_system_grant_for_group": "rule:admin" + +# Remove a role from a group on the system. +# ['DELETE'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:revoke_system_grant_for_group": "rule:admin" + +# Show group details. +# GET /v3/groups/{group_id} +# HEAD /v3/groups/{group_id} +# Intended scope(s): system +"identity:get_group": "rule:admin or rule:reader" + +# List groups. +# GET /v3/groups +# HEAD /v3/groups +# Intended scope(s): system +"identity:list_groups": "rule:admin or rule:reader" + +# List groups to which a user belongs. +# GET /v3/users/{user_id}/groups +# HEAD /v3/users/{user_id}/groups +# Intended scope(s): system +"identity:list_groups_for_user": "rule:admin or rule:owner or rule:reader" + +# Create group. +# POST /v3/groups +# Intended scope(s): system +"identity:create_group": "rule:admin" + +# Update group. +# PATCH /v3/groups/{group_id} +# Intended scope(s): system +"identity:update_group": "rule:admin" + +# Delete group. +# DELETE /v3/groups/{group_id} +# Intended scope(s): system +"identity:delete_group": "rule:admin" + +# List members of a specific group. +# GET /v3/groups/{group_id}/users +# HEAD /v3/groups/{group_id}/users +# Intended scope(s): system +"identity:list_users_in_group": "rule:admin or rule:reader" + +# Remove user from group. +# DELETE /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:remove_user_from_group": "rule:admin" + +# Check whether a user is a member of a group. +# HEAD /v3/groups/{group_id}/users/{user_id} +# GET /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:check_user_in_group": "rule:admin or rule:reader" + +# Add user to group. +# PUT /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:add_user_to_group": "rule:admin" + +# Create identity provider. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:create_identity_provider": "rule:admin" + +# List identity providers. +# GET /v3/OS-FEDERATION/identity_providers +# HEAD /v3/OS-FEDERATION/identity_providers +# Intended scope(s): system +"identity:list_identity_providers": "rule:admin or rule:reader" + +# Get identity provider. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id} +# HEAD /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:get_identity_provider": "rule:admin or rule:reader" + +# Update identity provider. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:update_identity_provider": "rule:admin" + +# Delete identity provider. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:delete_identity_provider": "rule:admin" + +# Get information about an association between two roles. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:get_implied_role": "rule:admin or rule:reader" + +# List associations between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. This +# will return all the implied roles that would be assumed by the user +# who gets the specified prior role. +# GET /v3/roles/{prior_role_id}/implies +# HEAD /v3/roles/{prior_role_id}/implies +# Intended scope(s): system +"identity:list_implied_roles": "rule:admin or rule:reader" + +# Create an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# PUT /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:create_implied_role": "rule:admin" + +# Delete the association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. Removing +# the association will cause that effect to be eliminated. +# DELETE /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:delete_implied_role": "rule:admin" + +# List all associations between two roles in the system. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/role_inferences +# HEAD /v3/role_inferences +# Intended scope(s): system +"identity:list_role_inference_rules": "rule:admin or rule:reader" + +# Check an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# HEAD /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:check_implied_role": "rule:admin or rule:reader" + +# Get limit enforcement model. +# GET /v3/limits/model +# HEAD /v3/limits/model +# Intended scope(s): system, project +"identity:get_limit_model": "rule:admin or rule:member" + +# Show limit details. +# GET /v3/limits/{limit_id} +# HEAD /v3/limits/{limit_id} +# Intended scope(s): system, project +"identity:get_limit": "rule:admin or rule:member" + +# List limits. +# GET /v3/limits +# HEAD /v3/limits +# Intended scope(s): system, project +"identity:list_limits": "rule:admin or rule:member" + +# Create limits. +# POST /v3/limits +# Intended scope(s): system +"identity:create_limits": "rule:admin" + +# Update limit. +# PATCH /v3/limits/{limit_id} +# Intended scope(s): system +"identity:update_limit": "rule:admin" + +# Delete limit. +# DELETE /v3/limits/{limit_id} +# Intended scope(s): system +"identity:delete_limit": "rule:admin" + +# Create a new federated mapping containing one or more sets of rules. +# PUT /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:create_mapping": "rule:admin" + +# Get a federated mapping. +# GET /v3/OS-FEDERATION/mappings/{mapping_id} +# HEAD /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:get_mapping": "rule:admin or rule:reader" + +# List federated mappings. +# GET /v3/OS-FEDERATION/mappings +# HEAD /v3/OS-FEDERATION/mappings +# Intended scope(s): system +"identity:list_mappings": "rule:admin or rule:reader" + +# Delete a federated mapping. +# DELETE /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:delete_mapping": "rule:admin" + +# Update a federated mapping. +# PATCH /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:update_mapping": "rule:admin" + +# Show policy details. +# GET /v3/policy/{policy_id} +# Intended scope(s): system +"identity:get_policy": "rule:admin or rule:reader" + +# List policies. +# GET /v3/policies +# Intended scope(s): system +"identity:list_policies": "rule:admin or rule:reader" + +# Create policy. +# POST /v3/policies +# Intended scope(s): system +"identity:create_policy": "rule:admin" + +# Update policy. +# PATCH /v3/policies/{policy_id} +# Intended scope(s): system +"identity:update_policy": "rule:admin" + +# Delete policy. +# DELETE /v3/policies/{policy_id} +# Intended scope(s): system +"identity:delete_policy": "rule:admin" + +# Associate a policy to a specific endpoint. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:create_policy_association_for_endpoint": "rule:admin" + +# Check policy association for endpoint. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:check_policy_association_for_endpoint": "rule:admin or rule:reader" + +# Delete policy association for endpoint. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:delete_policy_association_for_endpoint": "rule:admin" + +# Associate a policy to a specific service. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:create_policy_association_for_service": "rule:admin" + +# Check policy association for service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:check_policy_association_for_service": "rule:admin or rule:reader" + +# Delete policy association for service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:delete_policy_association_for_service": "rule:admin" + +# Associate a policy to a specific region and service combination. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:create_policy_association_for_region_and_service": "rule:admin" + +# Check policy association for region and service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:check_policy_association_for_region_and_service": "rule:admin or rule:reader" + +# Delete policy association for region and service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:delete_policy_association_for_region_and_service": "rule:admin" + +# Get policy for endpoint. +# GET /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# HEAD /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# Intended scope(s): system +"identity:get_policy_for_endpoint": "rule:admin or rule:reader" + +# List endpoints for policy. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints +# Intended scope(s): system +"identity:list_endpoints_for_policy": "rule:admin or rule:reader" + +# Show project details. +# GET /v3/projects/{project_id} +"identity:get_project": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# List projects. +# GET /v3/projects +# Intended scope(s): system +"identity:list_projects": "rule:admin or rule:reader" + +# List projects for user. +# GET /v3/users/{user_id}/projects +"identity:list_user_projects": "rule:admin or rule:owner or rule:reader" + +# Create project. +# POST /v3/projects +# Intended scope(s): system +"identity:create_project": "rule:admin" + +# Update project. +# PATCH /v3/projects/{project_id} +# Intended scope(s): system +"identity:update_project": "rule:admin" + +# Delete project. +# DELETE /v3/projects/{project_id} +# Intended scope(s): system +"identity:delete_project": "rule:admin" + +# List tags for a project. +# GET /v3/projects/{project_id}/tags +# HEAD /v3/projects/{project_id}/tags +"identity:list_project_tags": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# Check if project contains a tag. +# GET /v3/projects/{project_id}/tags/{value} +# HEAD /v3/projects/{project_id}/tags/{value} +"identity:get_project_tag": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# Replace all tags on a project with the new set of tags. +# PUT /v3/projects/{project_id}/tags +# Intended scope(s): system +"identity:update_project_tags": "rule:admin" + +# Add a single tag to a project. +# PUT /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +"identity:create_project_tag": "rule:admin" + +# Remove all tags from a project. +# DELETE /v3/projects/{project_id}/tags +# Intended scope(s): system +"identity:delete_project_tags": "rule:admin" + +# Delete a specified tag from project. +# DELETE /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +"identity:delete_project_tag": "rule:admin" + +# List projects allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/endpoints/{endpoint_id}/projects +# Intended scope(s): system +"identity:list_projects_for_endpoint": "rule:admin or rule:reader" + +# Allow project to access an endpoint. +# PUT /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:add_endpoint_to_project": "rule:admin" + +# Check if a project is allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# HEAD /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:check_endpoint_in_project": "rule:admin or rule:reader" + +# List the endpoints a project is allowed to access. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints +# Intended scope(s): system +"identity:list_endpoints_for_project": "rule:admin or rule:reader" + +# Remove access to an endpoint from a project that has previously been +# given explicit access. +# DELETE /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:remove_endpoint_from_project": "rule:admin" + +# Create federated protocol. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:create_protocol": "rule:admin" + +# Update federated protocol. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:update_protocol": "rule:admin" + +# Get federated protocol. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:get_protocol": "rule:admin or rule:reader" + +# List federated protocols. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols +# Intended scope(s): system +"identity:list_protocols": "rule:admin or rule:reader" + +# Delete federated protocol. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:delete_protocol": "rule:admin" + +# Show region details. +# GET /v3/regions/{region_id} +# HEAD /v3/regions/{region_id} +# Intended scope(s): system, project +"identity:get_region": "rule:admin or rule:member" + +# List regions. +# GET /v3/regions +# HEAD /v3/regions +# Intended scope(s): system, project +"identity:list_regions": "rule:admin or rule:member" + +# Create region. +# POST /v3/regions +# PUT /v3/regions/{region_id} +# Intended scope(s): system +"identity:create_region": "rule:admin" + +# Update region. +# PATCH /v3/regions/{region_id} +# Intended scope(s): system +"identity:update_region": "rule:admin" + +# Delete region. +# DELETE /v3/regions/{region_id} +# Intended scope(s): system +"identity:delete_region": "rule:admin" + +# Show registered limit details. +# GET /v3/registered_limits/{registered_limit_id} +# HEAD /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system, project +"identity:get_registered_limit": "rule:admin or rule:member" + +# List registered limits. +# GET /v3/registered_limits +# HEAD /v3/registered_limits +# Intended scope(s): system, project +"identity:list_registered_limits": "rule:admin or rule:member" + +# Create registered limits. +# POST /v3/registered_limits +# Intended scope(s): system +"identity:create_registered_limits": "rule:admin" + +# Update registered limit. +# PATCH /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +"identity:update_registered_limit": "rule:admin" + +# Delete registered limit. +# DELETE /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +"identity:delete_registered_limit": "rule:admin" + +# List revocation events. +# GET /v3/OS-REVOKE/events +# Intended scope(s): system +"identity:list_revoke_events": "rule:admin or rule:service_role or rule:reader" + +# Show role details. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +"identity:get_role": "rule:admin or rule:reader" + +# List roles. +# GET /v3/roles +# HEAD /v3/roles +# Intended scope(s): system +"identity:list_roles": "rule:admin or rule:reader" + +# Create role. +# POST /v3/roles +# Intended scope(s): system +"identity:create_role": "rule:admin" + +# Update role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +"identity:update_role": "rule:admin" + +# Delete role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +"identity:delete_role": "rule:admin" + +# Show domain role. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +"identity:get_domain_role": "rule:admin or rule:reader" + +# List domain roles. +# GET /v3/roles?domain_id={domain_id} +# HEAD /v3/roles?domain_id={domain_id} +# Intended scope(s): system +"identity:list_domain_roles": "rule:admin or rule:reader" + +# Create domain role. +# POST /v3/roles +# Intended scope(s): system +"identity:create_domain_role": "rule:admin" + +# Update domain role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +"identity:update_domain_role": "rule:admin" + +# Delete domain role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +"identity:delete_domain_role": "rule:admin" + +# List role assignments. +# GET /v3/role_assignments +# HEAD /v3/role_assignments +# Intended scope(s): system +"identity:list_role_assignments": "rule:admin or rule:reader" + +# List all role assignments for a given tree of hierarchical projects. +# GET /v3/role_assignments?include_subtree +# HEAD /v3/role_assignments?include_subtree +# Intended scope(s): project +"identity:list_role_assignments_for_tree": "rule:admin or rule:reader" + +# Show service details. +# GET /v3/services/{service_id} +# Intended scope(s): system +"identity:get_service": "rule:admin or rule:reader" + +# List services. +# GET /v3/services +# Intended scope(s): system +"identity:list_services": "rule:admin or rule:reader" + +# Create service. +# POST /v3/services +# Intended scope(s): system +"identity:create_service": "rule:admin" + +# Update service. +# PATCH /v3/services/{service_id} +# Intended scope(s): system +"identity:update_service": "rule:admin" + +# Delete service. +# DELETE /v3/services/{service_id} +# Intended scope(s): system +"identity:delete_service": "rule:admin" + +# Create federated service provider. +# PUT /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:create_service_provider": "rule:admin" + +# List federated service providers. +# GET /v3/OS-FEDERATION/service_providers +# HEAD /v3/OS-FEDERATION/service_providers +# Intended scope(s): system +"identity:list_service_providers": "rule:admin or rule:reader" + +# Get federated service provider. +# GET /v3/OS-FEDERATION/service_providers/{service_provider_id} +# HEAD /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:get_service_provider": "rule:admin or rule:reader" + +# Update federated service provider. +# PATCH /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:update_service_provider": "rule:admin" + +# Delete federated service provider. +# DELETE /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:delete_service_provider": "rule:admin" + +# List revoked PKI tokens. +# GET /v3/auth/tokens/OS-PKI/revoked +# Intended scope(s): system, project +"identity:revocation_list": "rule:admin or rule:service_role or rule:reader" + +# Check a token. +# HEAD /v3/auth/tokens +"identity:check_token": "rule:admin or rule:token_subject" + +# Validate a token. +# GET /v3/auth/tokens +"identity:validate_token": "rule:admin or rule:service_role or rule:token_subject or rule:reader" + +# Revoke a token. +# DELETE /v3/auth/tokens +"identity:revoke_token": "rule:admin or rule:token_subject" + +# Create trust. +# POST /v3/OS-TRUST/trusts +# Intended scope(s): project +"identity:create_trust": "user_id:%(trust.trustor_user_id)s" + +# List trusts. +# GET /v3/OS-TRUST/trusts +# HEAD /v3/OS-TRUST/trusts +# Intended scope(s): project +"identity:list_trusts": "rule:admin or rule:member" + +# List roles delegated by a trust. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles +# Intended scope(s): project +"identity:list_roles_for_trust": "rule:admin or rule:member" + +# Check if trust delegates a particular role. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# Intended scope(s): project +"identity:get_role_for_trust": "rule:admin or rule:member" + +# Revoke trust. +# DELETE /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +"identity:delete_trust": "rule:admin or rule:member" + +# Get trust. +# GET /v3/OS-TRUST/trusts/{trust_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +"identity:get_trust": "rule:admin or rule:member" + +# Show user details. +# GET /v3/users/{user_id} +# HEAD /v3/users/{user_id} +"identity:get_user": "rule:admin or rule:owner or rule:reader" + +# List users. +# GET /v3/users +# HEAD /v3/users +# Intended scope(s): system +"identity:list_users": "rule:admin or rule:reader" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +"identity:list_projects_for_user": "rule:admin or rule:member" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +"identity:list_domains_for_user": "rule:admin or rule:member" + +# Create a user. +# POST /v3/users +# Intended scope(s): system +"identity:create_user": "rule:admin" + +# Update a user, including administrative password resets. +# PATCH /v3/users/{user_id} +# Intended scope(s): system +"identity:update_user": "rule:admin" + +# Delete a user. +# DELETE /v3/users/{user_id} +# Intended scope(s): system +"identity:delete_user": "rule:admin" diff --git a/etc/manila/policy.json b/etc/manila/policy.json deleted file mode 100644 index a0b6df6..0000000 --- a/etc/manila/policy.json +++ /dev/null @@ -1,138 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "default": "rule:admin or rule:member", - - "availability_zone:index": "rule:default", - - "quota_set:update": "rule:admin", - "quota_set:show": "rule:default", - "quota_set:delete": "rule:admin", - - "quota_class_set:show": "rule:default", - "quota_class_set:update": "rule:admin", - - "service:index": "rule:admin", - "service:update": "rule:admin", - - "share:create": "rule:admin or rule: member", - "share:delete": "rule:default", - "share:get": "rule:default", - "share:get_all": "rule:default", - "share:list_by_share_server_id": "rule:admin", - "share:update": "rule:default", - "share:access_get": "rule:default", - "share:access_get_all": "rule:default", - "share:allow_access": "rule:default", - "share:deny_access": "rule:default", - "share:extend": "rule:default", - "share:shrink": "rule:default", - "share:get_share_metadata": "rule:default", - "share:delete_share_metadata": "rule:default", - "share:update_share_metadata": "rule:default", - "share:migration_start": "rule:admin", - "share:migration_complete": "rule:admin", - "share:migration_cancel": "rule:admin", - "share:migration_get_progress": "rule:admin", - "share:reset_task_state": "rule:admin", - "share:manage": "rule:admin", - "share:unmanage": "rule:admin", - "share:force_delete": "rule:admin", - "share:reset_status": "rule:admin", - "share_export_location:index": "rule:default", - "share_export_location:show": "rule:default", - - "share_instance:index": "rule:admin", - "share_instance:show": "rule:admin", - "share_instance:force_delete": "rule:admin", - "share_instance:reset_status": "rule:admin", - "share_instance_export_location:index": "rule:admin", - "share_instance_export_location:show": "rule:admin", - - "share_snapshot:create_snapshot": "rule:default", - "share_snapshot:delete_snapshot": "rule:default", - "share_snapshot:get_snapshot": "rule:default", - "share_snapshot:get_all_snapshots": "rule:default", - "share_snapshot:snapshot_update": "rule:default", - "share_snapshot:manage_snapshot": "rule:admin", - "share_snapshot:unmanage_snapshot": "rule:admin", - "share_snapshot:force_delete": "rule:admin", - "share_snapshot:reset_status": "rule:admin", - - "share_snapshot_instance:detail": "rule:admin", - "share_snapshot_instance:index": "rule:admin", - "share_snapshot_instance:show": "rule:admin", - "share_snapshot_instance:reset_status": "rule:admin", - - "share_type:index": "rule:default", - "share_type:show": "rule:default", - "share_type:default": "rule:default", - "share_type:create": "rule:admin", - "share_type:delete": "rule:admin", - "share_type:add_project_access": "rule:admin", - "share_type:list_project_access": "rule:admin", - "share_type:remove_project_access": "rule:admin", - - "share_types_extra_spec:create": "rule:admin", - "share_types_extra_spec:update": "rule:admin", - "share_types_extra_spec:show": "rule:admin", - "share_types_extra_spec:index": "rule:admin", - "share_types_extra_spec:delete": "rule:admin", - - "security_service:create": "rule:default", - "security_service:delete": "rule:default", - "security_service:update": "rule:default", - "security_service:show": "rule:default", - "security_service:index": "rule:default", - "security_service:detail": "rule:default", - "security_service:get_all_security_services": "rule:admin", - - "share_server:index": "rule:admin", - "share_server:show": "rule:admin", - "share_server:details": "rule:admin", - "share_server:delete": "rule:admin", - - "share_network:create": "rule:default", - "share_network:delete": "rule:default", - "share_network:update": "rule:default", - "share_network:index": "rule:default", - "share_network:detail": "rule:default", - "share_network:show": "rule:default", - "share_network:add_security_service": "rule:default", - "share_network:remove_security_service": "rule:default", - "share_network:get_all_share_networks": "rule:admin", - - "scheduler_stats:pools:index": "rule:admin", - "scheduler_stats:pools:detail": "rule:admin", - - "consistency_group:create" : "rule:default", - "consistency_group:delete": "rule:default", - "consistency_group:update": "rule:default", - "consistency_group:get": "rule:default", - "consistency_group:get_all": "rule:default", - "consistency_group:force_delete": "rule:admin", - "consistency_group:reset_status": "rule:admin", - - "cgsnapshot:force_delete": "rule:admin", - "cgsnapshot:reset_status": "rule:admin", - "cgsnapshot:create" : "rule:default", - "cgsnapshot:update" : "rule:default", - "cgsnapshot:delete": "rule:default", - "cgsnapshot:get_cgsnapshot": "rule:default", - "cgsnapshot:get_all": "rule:default", - - "share_replica:get_all": "rule:default", - "share_replica:show": "rule:default", - "share_replica:create" : "rule:default", - "share_replica:delete": "rule:default", - "share_replica:promote": "rule:default", - "share_replica:resync": "rule:admin", - "share_replica:reset_status": "rule:admin", - "share_replica:force_delete": "rule:admin", - "share_replica:reset_replica_state": "rule:admin" -} diff --git a/etc/manila/policy.yaml b/etc/manila/policy.yaml new file mode 100644 index 0000000..7c174ae --- /dev/null +++ b/etc/manila/policy.yaml @@ -0,0 +1,750 @@ +### Policy Rules defined in manila.policies.availability_zone + +# Get all storage availability zones. +# GET /os-availability-zone +# GET /availability-zone +# +# "availability_zone:index":"rule:default" + +### Policy Rules defined in manila.policies.base + +### Policy Rules defined in manila.policies.message + +# Get details of a given message. +# GET /messages/{message_id} +# +# "message:get":"rule:default" + +# Get all messages. +# GET /messages +# GET /messages?{query} +# +# "message:get_all":"rule:default" + +# Delete a message. +# DELETE /messages/{message_id} +# +# "message:delete":"rule:default" + +### Policy Rules defined in manila.policies.quota_class_set + +# Update quota class. +# PUT /quota-class-sets/{class_name} +# PUT /os-quota-class-sets/{class_name} +# +# "quota_class_set:update":"rule:admin_api" + +# Get quota class. +# GET /quota-class-sets/{class_name} +# GET /os-quota-class-sets/{class_name} +# +# "quota_class_set:show":"rule:default" + +### Policy Rules defined in manila.policies.quota_set + +# Update the quotas for a project/user and/or share type. +# PUT /quota-sets/{tenant_id} +# PUT /quota-sets/{tenant_id}?user_id={user_id} +# PUT /quota-sets/{tenant_id}?share_type={share_type_id} +# PUT /os-quota-sets/{tenant_id} +# PUT /os-quota-sets/{tenant_id}?user_id={user_id} +# +# "quota_set:update":"rule:admin_api" + +# List the quotas for a tenant/user. +# GET /quota-sets/{tenant_id}/defaults +# GET /os-quota-sets/{tenant_id}/defaults +# +# "quota_set:show":"rule:default" + +# Delete quota for a tenant/user or tenant/share-type. The quota will revert back to default (Admin only). +# DELETE /quota-sets/{tenant_id} +# DELETE /quota-sets/{tenant_id}?user_id={user_id} +# DELETE /quota-sets/{tenant_id}?share_type={share_type_id} +# DELETE /os-quota-sets/{tenant_id} +# DELETE /os-quota-sets/{tenant_id}?user_id={user_id} +# +# "quota_set:delete":"rule:admin_api" + +### Policy Rules defined in manila.policies.scheduler_stats + +# Get information regarding backends (and storage pools) known to the scheduler. +# GET /scheduler-stats/pools +# GET /scheduler-stats/pools?{query} +# +# "scheduler_stats:pools:index":"rule:admin_api" + +# Get detailed information regarding backends (and storage pools) known to the scheduler. +# GET /scheduler-stats/pools/detail?{query} +# GET /scheduler-stats/pools/detail +# +# "scheduler_stats:pools:detail":"rule:admin_api" + +### Policy Rules defined in manila.policies.security_service + +# Create security service. +# POST /security-services +# +# "security_service:create":"rule:default" + +# Get details of a security service. +# GET /security-services/{security_service_id} +# +# "security_service:show":"rule:default" + +# Get details of all security services. +# GET /security-services/detail?{query} +# GET /security-services/detail +# +# "security_service:detail":"rule:default" + +# Get all security services. +# GET /security-services +# GET /security-services?{query} +# +# "security_service:index":"rule:default" + +# Update a security service. +# PUT /security-services/{security_service_id} +# +# "security_service:update":"rule:default" + +# Delete a security service. +# DELETE /security-services/{security_service_id} +# +# "security_service:delete":"rule:default" + +# Get security services of all projects. +# GET /security-services?all_tenants=1 +# GET /security-services/detail?all_tenants=1 +# +# "security_service:get_all_security_services":"rule:admin_api" + +### Policy Rules defined in manila.policies.service + +# Return a list of all running services. +# GET /os-services +# GET /os-services?{query} +# GET /services +# GET /services?{query} +# +# "service:index":"rule:admin_api" + +# Enable/Disable scheduling for a service. +# PUT /os-services/disable +# PUT /os-services/enable +# PUT /services/disable +# PUT /services/enable +# +# "service:update":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_access + +### Policy Rules defined in manila.policies.share_access_metadata + +### Policy Rules defined in manila.policies.share_export_location + +# Get all export locations of a given share. +# GET /shares/{share_id}/export_locations +# +# "share_export_location:index":"rule:default" + +# Get details about the requested export location. +# GET /shares/{share_id}/export_locations/{export_location_id} +# +# "share_export_location:show":"rule:default" + +### Policy Rules defined in manila.policies.share_group + +# Create share group. +# POST /share-groups +# +# "share_group:create":"rule:default" + +# Get details of a share group. +# GET /share-groups/{share_group_id} +# +# "share_group:get":"rule:default" + +# Get all share groups. +# GET /share-groups +# GET /share-groups/detail +# GET /share-groups?{query} +# GET /share-groups/detail?{query} +# +# "share_group:get_all":"rule:default" + +# Update share group. +# PUT /share-groups/{share_group_id} +# +# "share_group:update":"rule:default" + +# Delete share group. +# DELETE /share-groups/{share_group_id} +# +# "share_group:delete":"rule:default" + +# Force delete a share group. +# POST /share-groups/{share_group_id}/action +# +# "share_group:force_delete":"rule:admin_api" + +# Reset share group's status. +# POST /share-groups/{share_group_id}/action +# +# "share_group:reset_status":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_group_snapshot + +# Create a new share group snapshot. +# POST /share-group-snapshots +# +# "share_group_snapshot:create":"rule:default" + +# Get details of a share group snapshot. +# GET /share-group-snapshots/{share_group_snapshot_id} +# +# "share_group_snapshot:get":"rule:default" + +# Get all share group snapshots. +# GET /share-group-snapshots +# GET /share-group-snapshots/detail +# GET /share-group-snapshots/{query} +# GET /share-group-snapshots/detail?{query} +# +# "share_group_snapshot:get_all":"rule:default" + +# Update a share group snapshot. +# PUT /share-group-snapshots/{share_group_snapshot_id} +# +# "share_group_snapshot:update":"rule:default" + +# Delete a share group snapshot. +# DELETE /share-group-snapshots/{share_group_snapshot_id} +# +# "share_group_snapshot:delete":"rule:default" + +# Force delete a share group snapshot. +# POST /share-group-snapshots/{share_group_snapshot_id}/action +# +# "share_group_snapshot:force_delete":"rule:admin_api" + +# Reset a share group snapshot's status. +# POST /share-group-snapshots/{share_group_snapshot_id}/action +# +# "share_group_snapshot:reset_status":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_group_type + +# Create a new share group type. +# POST /share-group-types +# +# "share_group_type:create":"rule:admin_api" + +# Get the list of share group types. +# GET /share-group-types +# GET /share-group-types?is_public=all +# +# "share_group_type:index":"rule:default" + +# Get details regarding the specified share group type. +# GET /share-group-types/{share_group_type_id} +# +# "share_group_type:show":"rule:default" + +# Get the default share group type. +# GET /share-group-types/default +# +# "share_group_type:default":"rule:default" + +# Delete an existing group type. +# DELETE /share-group-types/{share_group_type_id} +# +# "share_group_type:delete":"rule:admin_api" + +# Get project access by share group type. +# POST /share-group-types/{share_group_type_id}/access +# +# "share_group_type:list_project_access":"rule:admin_api" + +# Allow project to use the share group type. +# POST /share-group-types/{share_group_type_id}/action +# +# "share_group_type:add_project_access":"rule:admin_api" + +# Deny project access to use the share group type. +# POST /share-group-types/{share_group_type_id}/action +# +# "share_group_type:remove_project_access":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_group_types_spec + +# Create share group type specs. +# POST /share-group-types/{share_group_type_id}/group-specs +# +# "share_group_types_spec:create":"rule:admin_api" + +# Get share group type specs. +# GET /share-group-types/{share_group_type_id}/group-specs +# +# "share_group_types_spec:index":"rule:admin_api" + +# Get details of a share group type spec. +# GET /share-group-types/{share_group_type_id}/group-specs/{key} +# +# "share_group_types_spec:show":"rule:admin_api" + +# Update a share group type spec. +# PUT /share-group-types/{share_group_type_id}/group-specs/{key} +# +# "share_group_types_spec:update":"rule:admin_api" + +# Delete a share group type spec. +# DELETE /share-group-types/{share_group_type_id}/group-specs/{key} +# +# "share_group_types_spec:delete":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_instance + +### Policy Rules defined in manila.policies.share_instance_export_location + +### Policy Rules defined in manila.policies.share_network + +# Create share network. +# POST /share-networks +# +# "share_network:create":"rule:default" + +# Get details of a share network. +# GET /share-networks/{share_network_id} +# +# "share_network:show":"rule:default" + +# Get all share networks. +# GET /share-networks +# GET /share-networks?{query} +# +# "share_network:index":"rule:default" + +# Get details of share networks . +# GET /share-networks/detail?{query} +# GET /share-networks/detail +# +# "share_network:detail":"rule:default" + +# Update a share network. +# PUT /share-networks/{share_network_id} +# +# "share_network:update":"rule:default" + +# Delete a share network. +# DELETE /share-networks/{share_network_id} +# +# "share_network:delete":"rule:default" + +# Add security service to share network. +# POST /share-networks/{share_network_id}/action +# +# "share_network:add_security_service":"rule:default" + +# Remove security service from share network. +# POST /share-networks/{share_network_id}/action +# +# "share_network:remove_security_service":"rule:default" + +# Get share networks belonging to all projects. +# GET /share-networks?all_tenants=1 +# GET /share-networks/detail?all_tenants=1 +# +# "share_network:get_all_share_networks":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_replica + +# Create share replica. +# POST /share-replicas +# +# "share_replica:create":"rule:default" + +# Get all share replicas. +# GET /share-replicas +# GET /share-replicas/detail +# GET /share-replicas/detail?share_id={share_id} +# +# "share_replica:get_all":"rule:default" + +# Get details of a share replica. +# GET /share-replicas/{share_replica_id} +# +# "share_replica:show":"rule:default" + +# Delete a share replica. +# DELETE /share-replicas/{share_replica_id} +# +# "share_replica:delete":"rule:default" + +# Force delete a share replica. +# POST /share-replicas/{share_replica_id}/action +# +# "share_replica:force_delete":"rule:admin_api" + +# Promote a non-active share replica to active. +# POST /share-replicas/{share_replica_id}/action +# +# "share_replica:promote":"rule:default" + +# Resync a share replica that is out of sync. +# POST /share-replicas/{share_replica_id}/action +# +# "share_replica:resync":"rule:admin_api" + +# Reset share replica's replica_state attribute. +# POST /share-replicas/{share_replica_id}/action +# +# "share_replica:reset_replica_state":"rule:admin_api" + +# Reset share replica's status. +# POST /share-replicas/{share_replica_id}/action +# +# "share_replica:reset_status":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_server + +# Get share servers. +# GET /share-servers +# GET /share-servers?{query} +# +# "share_server:index":"rule:admin_api" + +# Show share server. +# GET /share-servers/{server_id} +# +# "share_server:show":"rule:admin_api" + +# Get share server details. +# GET /share-servers/{server_id}/details +# +# "share_server:details":"rule:admin_api" + +# Delete share server. +# DELETE /share-servers/{server_id} +# +# "share_server:delete":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_snapshot + +# Get share snapshot. +# GET /snapshots/{snapshot_id} +# +# "share_snapshot:get_snapshot":"rule:default" + +# Get all share snapshots. +# GET /snapshots +# GET /snapshots/detail +# GET /snapshots?{query} +# GET /snapshots/detail?{query} +# +# "share_snapshot:get_all_snapshots":"rule:default" + +# Force Delete a share snapshot. +# DELETE /snapshots/{snapshot_id} +# +# "share_snapshot:force_delete":"rule:admin_api" + +# Manage share snapshot. +# POST /snapshots/manage +# +# "share_snapshot:manage_snapshot":"rule:admin_api" + +# Unmanage share snapshot. +# POST /snapshots/{snapshot_id}/action +# +# "share_snapshot:unmanage_snapshot":"rule:admin_api" + +# Reset status. +# POST /snapshots/{snapshot_id}/action +# +# "share_snapshot:reset_status":"rule:admin_api" + +# List access rules of a share snapshot. +# GET /snapshots/{snapshot_id}/access-list +# +# "share_snapshot:access_list":"rule:default" + +# Allow access to a share snapshot. +# POST /snapshots/{snapshot_id}/action +# +# "share_snapshot:allow_access":"rule:default" + +# Deny access to a share snapshot. +# POST /snapshots/{snapshot_id}/action +# +# "share_snapshot:deny_access":"rule:default" + +### Policy Rules defined in manila.policies.share_snapshot_export_location + +# List export locations of a share snapshot. +# GET /snapshots/{snapshot_id}/export-locations/ +# +# "share_snapshot_export_location:index":"rule:default" + +# Get details of a specified export location of a share snapshot. +# GET /snapshots/{snapshot_id}/export-locations/{export_location_id} +# +# "share_snapshot_export_location:show":"rule:default" + +### Policy Rules defined in manila.policies.share_snapshot_instance + +# Get share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id} +# +# "share_snapshot_instance:show":"rule:admin_api" + +# Get all share snapshot instances. +# GET /snapshot-instances +# GET /snapshot-instances?{query} +# +# "share_snapshot_instance:index":"rule:admin_api" + +# Get details of share snapshot instances. +# GET /snapshot-instances/detail +# GET /snapshot-instances/detail?{query} +# +# "share_snapshot_instance:detail":"rule:admin_api" + +# Reset share snapshot instance's status. +# POST /snapshot-instances/{snapshot_instance_id}/action +# +# "share_snapshot_instance:reset_status":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_snapshot_instance_export_location + +# List export locations of a share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id}/export-locations +# +# "share_snapshot_instance_export_location:index":"rule:admin_api" + +# Show details of a specified export location of a share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id}/export-locations/{export_location_id} +# +# "share_snapshot_instance_export_location:show":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_type + +# Create share type. +# POST /types +# +# "share_type:create":"rule:admin_api" + +# Get share type. +# GET /types/{share_type_id} +# +# "share_type:show":"rule:default" + +# List share types. +# GET /types +# GET /types?is_public=all +# +# "share_type:index":"rule:default" + +# Get default share type. +# GET /types/default +# +# "share_type:default":"rule:default" + +# Delete share type. +# DELETE /types/{share_type_id} +# +# "share_type:delete":"rule:admin_api" + +# List share type project access. +# GET /types/{share_type_id} +# +# "share_type:list_project_access":"rule:admin_api" + +# Add share type to project. +# POST /types/{share_type_id}/action +# +# "share_type:add_project_access":"rule:admin_api" + +# Remove share type from project. +# POST /types/{share_type_id}/action +# +# "share_type:remove_project_access":"rule:admin_api" + +### Policy Rules defined in manila.policies.share_types_extra_spec + +# Create share type extra spec. +# POST /types/{share_type_id}/extra_specs +# +# "share_types_extra_spec:create":"rule:admin_api" + +# Get share type extra specs of a given share type. +# GET /types/{share_type_id}/extra_specs +# +# "share_types_extra_spec:show":"rule:admin_api" + +# Get details of a share type extra spec. +# GET /types/{share_type_id}/extra_specs/{extra_spec_id} +# +# "share_types_extra_spec:index":"rule:admin_api" + +# Update share type extra spec. +# PUT /types/{share_type_id}/extra_specs +# +# "share_types_extra_spec:update":"rule:admin_api" + +# Delete share type extra spec. +# DELETE /types/{share_type_id}/extra_specs/{key} +# +# "share_types_extra_spec:delete":"rule:admin_api" + +### Policy Rules defined in manila.policies.shares + +# Create share. +# POST /shares +# +# "share:create":"" + +# Get share. +# GET /shares/{share_id} +# +# "share:get":"rule:default" + +# List shares. +# GET /shares +# GET /shares/detail +# +# "share:get_all":"rule:default" + +# Update share. +# PUT /shares +# +# "share:update":"rule:default" + +# Delete share. +# DELETE /shares/{share_id} +# +# "share:delete":"rule:default" + +# Force Delete a share. +# DELETE /shares/{share_id} +# +# "share:force_delete":"rule:admin_api" + +# Manage share. +# POST /shares/manage +# +# "share:manage":"rule:admin_api" + +# Unmanage share. +# POST /shares/unmanage +# +# "share:unmanage":"rule:admin_api" + +# Create share snapshot. +# POST /snapshots +# +# "share:create_snapshot":"rule:default" + +# List share by host. +# GET /shares +# GET /shares/detail +# +# "share:list_by_host":"rule:admin_api" + +# List share by server id. +# GET /shares +# GET /shares/detail +# +# "share:list_by_share_server_id":"rule:admin_api" + +# Get share access rule, it under deny access operation. +# POST /shares/{share_id}/action +# +# "share:access_get":"rule:default" + +# List share access rules. +# GET /shares/{share_id}/action +# +# "share:access_get_all":"rule:default" + +# Extend share. +# POST /shares/{share_id}/action +# +# "share:extend":"rule:default" + +# Shrink share. +# POST /shares/{share_id}/action +# +# "share:shrink":"rule:default" + +# Migrate a share to the specified host. +# POST /shares/{share_id}/action +# +# "share:migration_start":"rule:admin_api" + +# Invokes 2nd phase of share migration. +# POST /shares/{share_id}/action +# +# "share:migration_complete":"rule:admin_api" + +# Attempts to cancel share migration. +# POST /shares/{share_id}/action +# +# "share:migration_cancel":"rule:admin_api" + +# Retrieve share migration progress for a given share. +# POST /shares/{share_id}/action +# +# "share:migration_get_progress":"rule:admin_api" + +# Reset task state. +# POST /shares/{share_id}/action +# +# "share:reset_task_state":"rule:admin_api" + +# Reset status. +# POST /shares/{share_id}/action +# +# "share:reset_status":"rule:admin_api" + +# Revert a share to a snapshot. +# POST /shares/{share_id}/action +# +# "share:revert_to_snapshot":"rule:default" + +# Add share access rule. +# POST /shares/{share_id}/action +# +# "share:allow_access":"rule:default" + +# Remove share access rule. +# POST /shares/{share_id}/action +# +# "share:deny_access":"rule:default" + +# Delete share snapshot. +# DELETE /snapshots/{snapshot_id} +# +# "share:delete_snapshot":"rule:default" + +# Update share snapshot. +# PUT /snapshots/{snapshot_id}/action +# +# "share:snapshot_update":"rule:default" + +# Update share metadata. +# PUT /shares/{share_id}/metadata +# +# "share:update_share_metadata":"rule:default" + +# Delete share metadata. +# DELETE /shares/{share_id}/metadata/{key} +# +# "share:delete_share_metadata":"rule:default" + +# Get share metadata. +# GET /shares/{share_id}/metadata +# +# "share:get_share_metadata":"rule:default" + diff --git a/etc/mistral/policy.json b/etc/mistral/policy.json deleted file mode 100644 index 774d22a..0000000 --- a/etc/mistral/policy.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "default": "rule:admin or rule:member", - - "action_executions:delete": "rule:admin or rule:member", - "action_execution:create": "rule:admin or rule:member", - "action_executions:get": "rule:admin or rule:member", - "action_executions:list": "rule:admin or rule:member", - "action_executions:update": "rule:admin or rule:member", - - "actions:create": "rule:admin or rule:member", - "actions:delete": "rule:admin or rule:member", - "actions:get": "rule:admin or rule:member", - "actions:list": "rule:admin or rule:member", - "actions:update": "rule:admin or rule:member", - - "cron_triggers:create": "rule:admin or rule:member", - "cron_triggers:delete": "rule:admin or rule:member", - "cron_triggers:get": "rule:admin or rule:member", - "cron_triggers:list": "rule:admin or rule:member", - - "environments:create": "rule:admin or rule:member", - "environments:delete": "rule:admin or rule:member", - "environments:get": "rule:admin or rule:member", - "environments:list": "rule:admin or rule:member", - "environments:update": "rule:admin or rule:member", - - "executions:create": "rule:admin or rule:member", - "executions:delete": "rule:admin or rule:member", - "executions:get": "rule:admin or rule:member", - "executions:list": "rule:admin or rule:member", - "executions:update": "rule:admin or rule:member", - - "members:create": "rule:admin or rule:member", - "members:delete": "rule:admin or rule:member", - "members:get": "rule:admin or rule:member", - "members:list": "rule:admin or rule:member", - "members:update": "rule:admin or rule:member", - - "services:list": "rule:admin or rule:member", - - "tasks:get": "rule:admin or rule:member", - "tasks:list": "rule:admin or rule:member", - "tasks:update": "rule:admin or rule:member", - - "workbooks:create": "rule:admin or rule:member", - "workbooks:delete": "rule:admin or rule:member", - "workbooks:get": "rule:admin or rule:member", - "workbooks:list": "rule:admin or rule:member", - "workbooks:update": "rule:admin or rule:member", - - "workflows:create": "rule:admin or rule:member", - "workflows:delete": "rule:admin or rule:member", - "workflows:get": "rule:admin or rule:member", - "workflows:list": "rule:admin or rule:member", - "workflows:update": "rule:admin or rule:member", - - "event_triggers:create": "rule:admin or rule:member", - "event_triggers:delete": "rule:admin or rule:member", - "event_triggers:get": "rule:admin or rule:member", - "event_triggers:list": "rule:admin or rule:member", - "event_triggers:update": "rule:admin or rule:member" -} diff --git a/etc/neutron/policy.json b/etc/neutron/policy.json deleted file mode 100644 index b1f9a87..0000000 --- a/etc/neutron/policy.json +++ /dev/null @@ -1,219 +0,0 @@ -{ - - "readonly": "(project_id:%(project_id)s and role:readonly)", - "global_readonly": "(role:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "context_is_advsvc": "role:advsvc", - - "admin_or_network_owner": "(rule:admin or rule:member or role:network_admin)", - "admin_owner_or_network_owner": "(rule:owner or rule:admin_or_network_owner)", - "shared": "(field:networks:shared=True)", - "shared_subnetpools": "(field:subnetpools:shared=True)", - "shared_address_scopes": "(field:address_scopes:shared=True)", - "external": "(field:networks:router:external=True)", - - "default": "rule:admin or rule:member", - - "create_subnet": "rule:admin_or_network_owner", - "create_subnet:segment_id": "rule:admin", - "create_subnet:service_types": "rule:admin", - "get_subnet": "rule:admin or rule:member or rule:shared or rule:readonly or rule:global_readonly", - "get_subnet:segment_id": "rule:admin", - "update_subnet": "rule:admin_or_network_owner", - "update_subnet:service_types": "rule:admin", - "delete_subnet": "rule:admin_or_network_owner", - - "create_subnetpool": "rule:admin or rule:member", - "create_subnetpool:shared": "rule:admin", - "create_subnetpool:is_default": "rule:admin", - "get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:readonly or rule:global_readonly", - "update_subnetpool": "rule:admin or rule:member", - "update_subnetpool:is_default": "rule:admin", - "delete_subnetpool": "rule:admin or rule:member", - - "create_address_scope": "rule:admin or rule:member", - "create_address_scope:shared": "rule:admin", - "get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes", - "update_address_scope": "rule:admin or rule:member", - "update_address_scope:shared": "rule:admin", - "delete_address_scope": "rule:admin or rule:member", - - "create_network": "rule:admin or rule:member", - "get_network": "rule:admin or rule:member or rule:readonly or rule:global_readonly or rule:shared or rule:external or rule:context_is_advsvc", - "get_network:router:external": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "get_network:segments": "rule:admin or rule:readonly or rule:global_readonly", - "get_network:provider:network_type": "rule:admin or rule:readonly or rule:global_readonly", - "get_network:provider:physical_network": "rule:admin or rule:readonly or rule:global_readonly", - "get_network:provider:segmentation_id": "rule:admin or rule:readonly or rule:global_readonly", - "get_network:queue_id": "rule:admin", - "get_network_ip_availabilities": "rule:admin", - "get_network_ip_availability": "rule:admin", - "create_network:shared": "rule:admin", - "create_network:router:external": "rule:admin", - "create_network:is_default": "rule:admin", - "create_network:segments": "rule:admin", - "create_network:provider:network_type": "rule:admin", - "create_network:provider:physical_network": "rule:admin", - "create_network:provider:segmentation_id": "rule:admin", - "update_network": "rule:admin or rule:member", - "update_network:segments": "rule:admin", - "update_network:shared": "rule:admin", - "update_network:provider:network_type": "rule:admin", - "update_network:provider:physical_network": "rule:admin", - "update_network:provider:segmentation_id": "rule:admin", - "update_network:router:external": "rule:admin", - "delete_network": "rule:admin or rule:member", - - "create_segment": "rule:admin", - "get_segment": "rule:admin", - "update_segment": "rule:admin", - "delete_segment": "rule:admin", - - "network_device": "field:port:device_owner=~^network:", - "create_port": "rule:admin or rule:member", - "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", - "create_port:mac_address": "rule:context_is_advsvc or rule:admin_or_network_owner", - "create_port:fixed_ips": "rule:context_is_advsvc or rule:admin_or_network_owner", - "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", - "create_port:binding:host_id": "rule:admin", - "create_port:binding:profile": "rule:admin", - "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", - "create_port:allowed_address_pairs": "rule:admin_or_network_owner", - "get_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner or rule:readonly or rule:global_readonly", - "get_port:queue_id": "rule:admin", - "get_port:binding:vif_type": "rule:admin or rule:readonly or rule:global_readonly", - "get_port:binding:vif_details": "rule:admin or rule:readonly or rule:global_readonly", - "get_port:binding:host_id": "rule:admin or rule:readonly or rule:global_readonly", - "get_port:binding:profile": "rule:admin or rule:readonly or rule:global_readonly", - "update_port": "rule:admin or rule:member or rule:context_is_advsvc", - "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin_or_network_owner", - "update_port:mac_address": "rule:admin or rule:context_is_advsvc", - "update_port:fixed_ips": "rule:context_is_advsvc or rule:admin_or_network_owner", - "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", - "update_port:binding:host_id": "rule:admin", - "update_port:binding:profile": "rule:admin", - "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin_or_network_owner", - "update_port:allowed_address_pairs": "rule:admin_or_network_owner", - "delete_port": "rule:context_is_advsvc or rule:admin_owner_or_network_owner", - - "get_router:ha": "rule:admin", - "create_router": "rule:admin or rule:member", - "create_router:external_gateway_info:enable_snat": "rule:admin", - "create_router:distributed": "rule:admin", - "create_router:ha": "rule:admin", - "get_router": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "get_router:distributed": "rule:admin or rule:readonly or rule:global_readonly", - "update_router:external_gateway_info:enable_snat": "rule:admin", - "update_router:distributed": "rule:admin", - "update_router:ha": "rule:admin", - "delete_router": "rule:admin or rule:member", - - "add_router_interface": "rule:admin or rule:member", - "remove_router_interface": "rule:admin or rule:member", - - "create_router:external_gateway_info:external_fixed_ips": "rule:admin", - "update_router:external_gateway_info:external_fixed_ips": "rule:admin", - - "insert_rule": "rule:admin or rule:member", - "remove_rule": "rule:admin or rule:member", - - "create_qos_queue": "rule:admin", - "get_qos_queue": "rule:admin", - - "update_agent": "rule:admin", - "delete_agent": "rule:admin", - "get_agent": "rule:admin or rule:readonly or rule:global_readonly", - - "create_dhcp-network": "rule:admin", - "delete_dhcp-network": "rule:admin", - "get_dhcp-networks": "rule:admin or rule:readonly or rule:global_readonly", - "create_l3-router": "rule:admin", - "delete_l3-router": "rule:admin", - "get_l3-routers": "rule:admin or rule:readonly or rule:global_readonly", - "get_dhcp-agents": "rule:admin or rule:readonly or rule:global_readonly", - "get_l3-agents": "rule:admin", - "get_loadbalancer-agent": "rule:admin", - "get_loadbalancer-pools": "rule:admin", - "get_agent-loadbalancers": "rule:admin", - "get_loadbalancer-hosting-agent": "rule:admin", - - "create_floatingip": "rule:admin or rule:member", - "create_floatingip:floating_ip_address": "rule:admin", - "update_floatingip": "rule:admin or rule:member", - "delete_floatingip": "rule:admin or rule:member", - "get_floatingip": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - - "create_network_profile": "rule:admin", - "update_network_profile": "rule:admin", - "delete_network_profile": "rule:admin", - "get_network_profiles": "rule:admin or rule:member", - "get_network_profile": "rule:admin or rule:member", - "update_policy_profiles": "rule:admin", - "get_policy_profiles": "rule:admin or rule:member", - "get_policy_profile": "rule:admin or rule:member", - - "create_metering_label": "rule:admin", - "delete_metering_label": "rule:admin", - "get_metering_label": "rule:admin or rule:readonly or rule:global_readonly", - - "create_metering_label_rule": "rule:admin", - "delete_metering_label_rule": "rule:admin", - "get_metering_label_rule": "rule:admin or rule:readonly or rule:global_readonly", - - "get_service_provider": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "get_lsn": "rule:admin", - "create_lsn": "rule:admin", - - "create_flavor": "rule:admin", - "update_flavor": "rule:admin", - "delete_flavor": "rule:admin", - "get_flavors": "rule:admin or rule:member", - "get_flavor": "rule:admin or rule:member", - "create_service_profile": "rule:admin", - "update_service_profile": "rule:admin", - "delete_service_profile": "rule:admin", - "get_service_profiles": "rule:admin", - "get_service_profile": "rule:admin", - - "get_policy": "rule:admin or rule:member", - "create_policy": "rule:admin", - "update_policy": "rule:admin", - "delete_policy": "rule:admin", - "get_policy_bandwidth_limit_rule": "rule:admin or rule:member", - "create_policy_bandwidth_limit_rule": "rule:admin", - "delete_policy_bandwidth_limit_rule": "rule:admin", - "update_policy_bandwidth_limit_rule": "rule:admin", - "get_policy_dscp_marking_rule": "rule:admin or rule:member", - "create_policy_dscp_marking_rule": "rule:admin", - "delete_policy_dscp_marking_rule": "rule:admin", - "update_policy_dscp_marking_rule": "rule:admin", - "get_rule_type": "rule:admin or rule:member", - "get_policy_minimum_bandwidth_rule": "rule:admin or rule:member", - "create_policy_minimum_bandwidth_rule": "rule:admin", - "delete_policy_minimum_bandwidth_rule": "rule:admin", - "update_policy_minimum_bandwidth_rule": "rule:admin", - - "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin", - "create_rbac_policy": "rule:admin or rule:member", - "create_rbac_policy:target_tenant": "rule:restrict_wildcard", - "update_rbac_policy": "rule:admin or rule:member", - "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member", - "get_rbac_policy": "rule:admin or rule:member", - "delete_rbac_policy": "rule:admin or rule:member", - - "create_flavor_service_profile": "rule:admin", - "delete_flavor_service_profile": "rule:admin", - "get_flavor_service_profile": "rule:admin or rule:member", - "get_auto_allocated_topology": "rule:admin or rule:member", - - "create_trunk": "rule:admin or rule:member", - "get_trunk": "rule:admin or rule:member", - "delete_trunk": "rule:admin or rule:member", - "get_subports": "rule:admin or rule:member", - "add_subports": "rule:admin or rule:member", - "remove_subports": "rule:admin or rule:member" -} diff --git a/etc/neutron/policy.yaml b/etc/neutron/policy.yaml new file mode 100644 index 0000000..bb91787 --- /dev/null +++ b/etc/neutron/policy.yaml @@ -0,0 +1,256 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +"context_is_advsvc": "role:advsvc" +"network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)" +"admin_or_data_plane_int": "rule:admin or role:data_plane_integrator" +"shared": "field:networks:shared=True" +"shared_subnetpools": "field:subnetpools:shared=True" +"shared_address_scopes": "field:address_scopes:shared=True" +"external": "field:networks:router:external=True" + +# "context_is_admin": "role:admin" +# "owner": "tenant_id:%(tenant_id)s" +# "admin_or_owner": "rule:context_is_admin or rule:owner" +# "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s" +# "admin_owner_or_network_owner": "rule:owner or rule:admin or rule:network_owner" +# "admin_only": "rule:context_is_admin" +# "regular_user": "" +"default": "rule:admin or rule:member" + +"create_subnet": "rule:admin or rule:network_owner" +"create_subnet:segment_id": "rule:admin" +"create_subnet:service_types": "rule:admin" +"get_subnet": "rule:admin or rule:member or rule:shared" +"get_subnet:segment_id": "rule:admin" +"update_subnet": "rule:admin or rule:network_owner" +"update_subnet:service_types": "rule:admin" +"delete_subnet": "rule:admin or rule:network_owner" + +"create_subnetpool": "" +"create_subnetpool:shared": "rule:admin" +"create_subnetpool:is_default": "rule:admin" +"get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools" +"update_subnetpool": "rule:admin or rule:member" +"update_subnetpool:is_default": "rule:admin" +"delete_subnetpool": "rule:admin or rule:member" + +"create_address_scope": "" +"create_address_scope:shared": "rule:admin" +"get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes" +"update_address_scope": "rule:admin or rule:member" +"update_address_scope:shared": "rule:admin" +"delete_address_scope": "rule:admin or rule:member" + +"create_network": "" +"get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc" +"get_network:router:external": "rule:admin or rule:member" +"get_network:segments": "rule:admin" +"get_network:provider:network_type": "rule:admin" +"get_network:provider:physical_network": "rule:admin" +"get_network:provider:segmentation_id": "rule:admin" +"get_network:queue_id": "rule:admin" +"get_network_ip_availabilities": "rule:admin" +"get_network_ip_availability": "rule:admin" +"create_network:shared": "rule:admin" +"create_network:router:external": "rule:admin" +"create_network:is_default": "rule:admin" +"create_network:segments": "rule:admin" +"create_network:provider:network_type": "rule:admin" +"create_network:provider:physical_network": "rule:admin" +"create_network:provider:segmentation_id": "rule:admin" +"update_network": "rule:admin or rule:member" +"update_network:segments": "rule:admin" +"update_network:shared": "rule:admin" +"update_network:provider:network_type": "rule:admin" +"update_network:provider:physical_network": "rule:admin" +"update_network:provider:segmentation_id": "rule:admin" +"update_network:router:external": "rule:admin" +"delete_network": "rule:admin or rule:member" + +"create_segment": "rule:admin" +"get_segment": "rule:admin" +"update_segment": "rule:admin" +"delete_segment": "rule:admin" + +"network_device": "field:port:device_owner=~^network:" +"create_port": "" +"create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" +"create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:binding:host_id": "rule:admin" +"create_port:binding:profile": "rule:admin" +"create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:allowed_address_pairs": "rule:admin or rule:network_owner" +"get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" +"get_port:queue_id": "rule:admin" +"get_port:binding:vif_type": "rule:admin" +"get_port:binding:vif_details": "rule:admin" +"get_port:binding:host_id": "rule:admin" +"get_port:binding:profile": "rule:admin" +"update_port": "rule:admin or rule:member or rule:context_is_advsvc" +"update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:mac_address": "rule:admin or rule:context_is_advsvc" +"update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" +"update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:binding:host_id": "rule:admin" +"update_port:binding:profile": "rule:admin" +"update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:allowed_address_pairs": "rule:admin or rule:network_owner" +"update_port:data_plane_status": "rule:admin_or_data_plane_int" +"delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" + +"get_router:ha": "rule:admin" +"create_router": "rule:admin or rule:member" +"create_router:external_gateway_info:enable_snat": "rule:admin" +"create_router:distributed": "rule:admin" +"create_router:ha": "rule:admin" +"get_router": "rule:admin or rule:member" +"get_router:distributed": "rule:admin" +"update_router": "rule:admin or rule:member" +"update_router:external_gateway_info": "rule:admin or rule:member" +"update_router:external_gateway_info:network_id": "rule:admin or rule:member" +"update_router:external_gateway_info:enable_snat": "rule:admin" +"update_router:distributed": "rule:admin" +"update_router:ha": "rule:admin" +"delete_router": "rule:admin or rule:member" + +"add_router_interface": "rule:admin or rule:member" +"remove_router_interface": "rule:admin or rule:member" + +"create_router:external_gateway_info:external_fixed_ips": "rule:admin" +"update_router:external_gateway_info:external_fixed_ips": "rule:admin" + +"create_qos_queue": "rule:admin" +"get_qos_queue": "rule:admin" + +"update_agent": "rule:admin" +"delete_agent": "rule:admin" +"get_agent": "rule:admin" + +"create_dhcp-network": "rule:admin" +"delete_dhcp-network": "rule:admin" +"get_dhcp-networks": "rule:admin" +"create_l3-router": "rule:admin" +"delete_l3-router": "rule:admin" +"get_l3-routers": "rule:admin" +"get_dhcp-agents": "rule:admin" +"get_l3-agents": "rule:admin" +"get_loadbalancer-agent": "rule:admin" +"get_loadbalancer-pools": "rule:admin" +"get_agent-loadbalancers": "rule:admin" +"get_loadbalancer-hosting-agent": "rule:admin" + +"create_floatingip": "rule:admin or rule:member" +"create_floatingip:floating_ip_address": "rule:admin" +"update_floatingip": "rule:admin or rule:member" +"delete_floatingip": "rule:admin or rule:member" +"get_floatingip": "rule:admin or rule:member" + +"create_network_profile": "rule:admin" +"update_network_profile": "rule:admin" +"delete_network_profile": "rule:admin" +"get_network_profiles": "" +"get_network_profile": "" +"update_policy_profiles": "rule:admin" +"get_policy_profiles": "" +"get_policy_profile": "" + +"create_metering_label": "rule:admin" +"delete_metering_label": "rule:admin" +"get_metering_label": "rule:admin" + +"create_metering_label_rule": "rule:admin" +"delete_metering_label_rule": "rule:admin" +"get_metering_label_rule": "rule:admin" + +"get_service_provider": "rule:admin or rule:member" +"get_lsn": "rule:admin" +"create_lsn": "rule:admin" + +"create_flavor": "rule:admin" +"update_flavor": "rule:admin" +"delete_flavor": "rule:admin" +"get_flavors": "rule:admin or rule:member" +"get_flavor": "rule:admin or rule:member" +"create_service_profile": "rule:admin" +"update_service_profile": "rule:admin" +"delete_service_profile": "rule:admin" +"get_service_profiles": "rule:admin" +"get_service_profile": "rule:admin" + +"get_policy": "rule:admin or rule:member" +"create_policy": "rule:admin" +"update_policy": "rule:admin" +"delete_policy": "rule:admin" +"get_policy_bandwidth_limit_rule": "rule:admin or rule:member" +"create_policy_bandwidth_limit_rule": "rule:admin" +"delete_policy_bandwidth_limit_rule": "rule:admin" +"update_policy_bandwidth_limit_rule": "rule:admin" +"get_policy_dscp_marking_rule": "rule:admin or rule:member" +"create_policy_dscp_marking_rule": "rule:admin" +"delete_policy_dscp_marking_rule": "rule:admin" +"update_policy_dscp_marking_rule": "rule:admin" +"get_rule_type": "rule:admin or rule:member" +"get_policy_minimum_bandwidth_rule": "rule:admin or rule:member" +"create_policy_minimum_bandwidth_rule": "rule:admin" +"delete_policy_minimum_bandwidth_rule": "rule:admin" +"update_policy_minimum_bandwidth_rule": "rule:admin" + +"restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin" +"create_rbac_policy": "" +"create_rbac_policy:target_tenant": "rule:restrict_wildcard" +"update_rbac_policy": "rule:admin or rule:member" +"update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member" +"get_rbac_policy": "rule:admin or rule:member" +"delete_rbac_policy": "rule:admin or rule:member" + +"create_flavor_service_profile": "rule:admin" +"delete_flavor_service_profile": "rule:admin" +"get_flavor_service_profile": "rule:admin or rule:member" +"get_auto_allocated_topology": "rule:admin or rule:member" + +"create_trunk": "rule:admin or rule:member" +"get_trunk": "rule:admin or rule:member" +"delete_trunk": "rule:admin or rule:member" +"get_subports": "" +"add_subports": "rule:admin or rule:member" +"remove_subports": "rule:admin or rule:member" + +"get_security_groups": "rule:admin or rule:member" +"get_security_group": "rule:admin or rule:member" +"create_security_group": "rule:admin or rule:member" +"update_security_group": "rule:admin or rule:member" +"delete_security_group": "rule:admin or rule:member" +"get_security_group_rules": "rule:admin or rule:member" +"get_security_group_rule": "rule:admin or rule:member" +"create_security_group_rule": "rule:admin or rule:member" +"delete_security_group_rule": "rule:admin or rule:member" + +"get_loggable_resources": "rule:admin" +"create_log": "rule:admin" +"update_log": "rule:admin" +"delete_log": "rule:admin" +"get_logs": "rule:admin" +"get_log": "rule:admin" diff --git a/etc/nova/policy.json b/etc/nova/policy.json deleted file mode 100644 index 6d71921..0000000 --- a/etc/nova/policy.json +++ /dev/null @@ -1,180 +0,0 @@ -{ - - "readonly": "(project_id:%(project_id)s and role:readonly)", - "global_readonly": "(role:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "os_compute_api:os-evacuate": "rule:admin", - "os_compute_api:servers:create": "rule:admin or rule:member", - "os_compute_api:os-extended-volumes": "rule:admin or rule:member", - "os_compute_api:servers:create:forced_host": "rule:admin", - "os_compute_api:os-aggregates:remove_host": "rule:admin", - "os_compute_api:os-console-output": "rule:admin or rule:member", - "os_compute_api:os-floating-ips": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-aggregates:update": "rule:admin", - "os_compute_api:os-pci:pci_servers": "rule:admin or rule:member", - "os_compute_api:servers:start": "rule:admin or rule:member", - "os_compute_api:os-keypairs:create": "rule:admin or user_id:%(user_id)s", - "os_compute_api:servers:trigger_crash_dump": "rule:admin or rule:member", - "os_compute_api:server-metadata:index": "rule:admin or rule:member", - "os_compute_api:servers:create_image": "rule:admin or rule:member", - "os_compute_api:os-virtual-interfaces": "rule:admin or rule:member", - "os_compute_api:os-server-groups": "rule:admin or rule:member", - "os_compute_api:os-server-tags:delete_all": "@", - "os_compute_api:os-keypairs:delete": "rule:admin or user_id:%(user_id)s", - "os_compute_api:os-floating-ips-bulk": "rule:admin", - "os_compute_api:os-simple-tenant-usage:list": "rule:admin", - "os_compute_api:os-quota-class-sets:show": "is_admin:True or quota_class:%(quota_class)s", - "os_compute_api:os-suspend-server:resume": "rule:admin or rule:member", - "os_compute_api:os-tenant-networks": "rule:admin or rule:member", - "os_compute_api:os-floating-ip-dns:domain:update": "rule:admin", - "os_compute_api:os-hypervisors": "rule:admin", - "os_compute_api:os-consoles:delete": "rule:admin or rule:member", - "os_compute_api:os-networks-associate": "rule:admin", - "os_compute_api:os-volumes-attachments:index": "rule:admin or rule:member", - "os_compute_api:os-pci:show": "rule:admin", - "os_compute_api:os-remote-consoles": "rule:admin or rule:member", - "os_compute_api:limits": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-cells:create": "rule:admin", - "os_compute_api:os-aggregates:delete": "rule:admin", - "os_compute_api:servers:migrations:show": "rule:admin", - "os_compute_api:os-consoles:create": "rule:admin or rule:member", - "os_compute_api:os-aggregates:set_metadata": "rule:admin", - "os_compute_api:os-create-backup": "rule:admin or rule:member", - "os_compute_api:server-metadata:delete": "rule:admin or rule:member", - "os_compute_api:os-pause-server:pause": "rule:admin or rule:member", - "os_compute_api:os-server-external-events:create": "rule:admin", - "os_compute_api:server-metadata:show": "rule:admin or rule:member", - "os_compute_api:os-rescue": "rule:admin or rule:member", - "os_compute_api:os-agents": "rule:admin", - "os_compute_api:os-server-tags:delete": "rule:admin or rule:member", - "os_compute_api:os-flavor-extra-specs:show": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-attach-interfaces:delete": "rule:admin or rule:member", - "os_compute_api:os-extended-availability-zone": "rule:admin or rule:member", - "os_compute_api:os-instance-actions:events": "rule:admin", - "os_compute_api:os-fixed-ips": "rule:admin", - "os_compute_api:os-flavor-manage": "rule:admin", - "os_compute_api:server-metadata:create": "rule:admin or rule:member", - "os_compute_api:os-shelve:shelve": "rule:admin or rule:member", - "os_compute_api:servers:resize": "rule:admin or rule:member", - "os_compute_api:os-aggregates:add_host": "rule:admin", - "os_compute_api:os-flavor-access:add_tenant_access": "rule:admin", - "os_compute_api:os-cells:update": "rule:admin", - "os_compute_api:os-server-diagnostics": "rule:admin", - "os_compute_api:servers:revert_resize": "rule:admin or rule:member", - "os_compute_api:os-cells": "rule:admin", - "os_compute_api:servers:update": "rule:admin or rule:member", - "os_compute_api:servers:index:get_all_tenants": "rule:admin", - "os_compute_api:os-admin-actions:reset_network": "rule:admin", - "os_compute_api:os-certificates:show": "rule:admin or rule:member", - "os_compute_api:os-config-drive": "rule:admin or rule:member", - "os_compute_api:os-instance-actions": "rule:admin or rule:member", - "os_compute_api:os-attach-interfaces:create": "rule:admin or rule:member", - "os_compute_api:os-volumes-attachments:create": "rule:admin or rule:member", - "os_compute_api:os-consoles:index": "rule:admin or rule:member", - "os_compute_api:os-used-limits": "rule:admin", - "os_compute_api:os-migrations:index": "rule:admin", - "os_compute_api:os-admin-actions:reset_state": "rule:admin", - "os_compute_api:os-flavor-rxtx": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-quota-sets:defaults": "@", - "os_compute_api:os-fping:all_tenants": "rule:admin", - "os_compute_api:os-flavor-extra-specs:create": "rule:admin", - "os_compute_api:os-lock-server:lock": "rule:admin or rule:member", - "os_compute_api:os-flavor-extra-specs:index": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:servers:create_image:allow_volume_backed": "rule:admin or rule:member", - "os_compute_api:os-extended-status": "rule:admin or rule:member", - "os_compute_api:os-assisted-volume-snapshots:delete": "rule:admin", - "os_compute_api:servers:migrations:force_complete": "rule:admin", - "os_compute_api:os-extended-server-attributes": "rule:admin", - "os_compute_api:os-assisted-volume-snapshots:create": "rule:admin", - "os_compute_api:os-consoles:show": "rule:admin or rule:member", - "os_compute_api:os-admin-actions:inject_network_info": "rule:admin", - "os_compute_api:servers:create:attach_volume": "rule:admin or rule:member", - "os_compute_api:os-server-tags:update_all": "@", - "os_compute_api:os-quota-sets:show": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-server-tags:update": "@", - "os_compute_api:os-quota-class-sets:update": "rule:admin", - "os_compute_api:image-size": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-migrate-server:migrate": "rule:admin", - "os_compute_api:extensions": "rule:admin or rule:member", - "os_compute_api:flavors": "rule:admin or rule:member", - "os_compute_api:os-flavor-access:remove_tenant_access": "rule:admin", - "os_compute_api:os-simple-tenant-usage:show": "rule:admin or rule:member", - "os_compute_api:os-floating-ip-pools": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:os-volumes-attachments:show": "rule:admin or rule:member", - "os_compute_api:os-security-groups": "rule:admin or rule:member", - "os_compute_api:os-keypairs:show": "rule:admin or user_id:%(user_id)s", - "os_compute_api:os-pci:index": "rule:admin", - "os_compute_api:os-deferred-delete": "rule:admin or rule:member", - "os_compute_api:os-hide-server-addresses": "is_admin:False", - "os_compute_api:os-flavor-extra-specs:update": "rule:admin", - "os_compute_api:os-pause-server:unpause": "rule:admin or rule:member", - "os_compute_api:os-availability-zone:list": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:servers:detail": "rule:admin or rule:member", - "os_compute_api:servers:stop": "rule:admin or rule:member", - "os_compute_api:os-pci:detail": "rule:admin", - "os_compute_api:servers:rebuild": "rule:admin or rule:member", - "os_compute_api:ips:index": "rule:admin or rule:member", - "os_compute_api:os-quota-sets:delete": "rule:admin", - "os_compute_api:os-quota-sets:detail": "rule:admin or rule:readonly or rule:global_readonly", - "os_compute_api:os-availability-zone:detail": "rule:admin or rule:readonly or rule:global_readonly", - "cells_scheduler_filter:TargetCellFilter": "is_admin:True", - "os_compute_api:os-keypairs": "rule:admin or rule:member", - "os_compute_api:servers:show": "rule:admin or rule:member", - "network:attach_external_network": "is_admin:True", - "os_compute_api:os-cloudpipe": "rule:admin", - "os_compute_api:os-certificates:create": "rule:admin or rule:member", - "os_compute_api:os-aggregates:show": "rule:admin", - "os_compute_api:os-cells:sync_instances": "rule:admin", - "os_compute_api:ips:show": "rule:admin or rule:member", - "os_compute_api:os-server-password": "rule:admin or rule:member", - "os_compute_api:os-server-usage": "rule:admin or rule:member", - "os_compute_api:os-services": "rule:admin", - "os_compute_api:servers:detail:get_all_tenants": "rule:admin", - "os_compute_api:servers:index": "rule:admin or rule:member", - "os_compute_api:os-keypairs:index": "rule:admin or user_id:%(user_id)s", - "os_compute_api:os-fping": "rule:admin or rule:member", - "os_compute_api:os-server-tags:index": "@", - "os_compute_api:os-suspend-server:suspend": "rule:admin or rule:member", - "os_compute_api:os-admin-actions": "rule:admin", - "os_compute_api:servers:confirm_resize": "rule:admin or rule:member", - "os_compute_api:os-networks:view": "rule:admin or rule:member", - "os_compute_api:os-floating-ip-dns": "rule:admin or rule:member", - "os_compute_api:os-quota-sets:update": "rule:admin", - "os_compute_api:os-volumes": "rule:admin or rule:member", - "os_compute_api:os-admin-password": "rule:admin or rule:member", - "os_compute_api:os-baremetal-nodes": "rule:admin", - "os_compute_api:servers:show:host_status": "rule:admin", - "os_compute_api:os-aggregates:index": "rule:admin", - "os_compute_api:os-flavor-extra-specs:delete": "rule:admin", - "os_compute_api:servers:migrations:delete": "rule:admin", - "os_compute_api:os-instance-usage-audit-log": "rule:admin", - "os_compute_api:os-aggregates:create": "rule:admin", - "os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin", - "os_compute_api:os-networks": "rule:admin", - "os_compute_api:os-server-tags:show": "@", - "os_compute_api:os-lock-server:unlock": "rule:admin or rule:member", - "os_compute_api:os-cells:delete": "rule:admin", - "os_compute_api:server-metadata:update_all": "rule:admin or rule:member", - "os_compute_api:os-security-group-default-rules": "rule:admin", - "os_compute_api:servers:reboot": "rule:admin or rule:member", - "cells_scheduler_filter:DifferentCellFilter": "is_admin:True", - "os_compute_api:servers:migrations:index": "rule:admin", - "os_compute_api:os-flavor-access": "rule:admin or rule:member or rule:readonly or rule:global_readonly", - "os_compute_api:servers:delete": "rule:admin or rule:member", - "os_compute_api:os-migrate-server:migrate_live": "rule:admin", - "os_compute_api:servers:create:attach_network": "rule:admin or rule:member", - "os_compute_api:os-console-auth-tokens": "rule:admin", - "os_compute_api:os-attach-interfaces": "rule:admin or rule:member", - "os_compute_api:os-volumes-attachments:update": "rule:admin", - "os_compute_api:os-hosts": "rule:admin", - "os_compute_api:os-multinic": "rule:admin or rule:member", - "os_compute_api:os-shelve:unshelve": "rule:admin or rule:member", - "os_compute_api:server-metadata:update": "rule:admin or rule:member", - "os_compute_api:os-volumes-attachments:delete": "rule:admin or rule:member", - "os_compute_api:os-floating-ip-dns:domain:delete": "rule:admin", - "os_compute_api:os-shelve:shelve_offload": "rule:admin" -} diff --git a/etc/nova/policy.yaml b/etc/nova/policy.yaml new file mode 100644 index 0000000..8943e60 --- /dev/null +++ b/etc/nova/policy.yaml @@ -0,0 +1,989 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +# Reset the state of a given server +# POST /servers/{server_id}/action (os-resetState) +"os_compute_api:os-admin-actions:reset_state": "rule:admin" + +# Inject network information into the server +# POST /servers/{server_id}/action (injectNetworkInfo) +"os_compute_api:os-admin-actions:inject_network_info": "rule:admin" + +# Reset networking on a server +# POST /servers/{server_id}/action (resetNetwork) +"os_compute_api:os-admin-actions:reset_network": "rule:admin" + +# Change the administrative password for a server +# POST /servers/{server_id}/action (changePassword) +"os_compute_api:os-admin-password": "rule:admin or rule:member" + +# Create, list, update, and delete guest agent builds +# +# This is XenAPI driver specific. +# It is used to force the upgrade of the XenAPI guest agent on +# instance boot. +# GET /os-agents +# POST /os-agents +# PUT /os-agents/{agent_build_id} +# DELETE /os-agents/{agent_build_id} +"os_compute_api:os-agents": "rule:admin" + +# Create or replace metadata for an aggregate +# POST /os-aggregates/{aggregate_id}/action (set_metadata) +"os_compute_api:os-aggregates:set_metadata": "rule:admin" + +# Add a host to an aggregate +# POST /os-aggregates/{aggregate_id}/action (add_host) +"os_compute_api:os-aggregates:add_host": "rule:admin" + +# Create an aggregate +# POST /os-aggregates +"os_compute_api:os-aggregates:create": "rule:admin" + +# Remove a host from an aggregate +# POST /os-aggregates/{aggregate_id}/action (remove_host) +"os_compute_api:os-aggregates:remove_host": "rule:admin" + +# Update name and/or availability zone for an aggregate +# PUT /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:update": "rule:admin" + +# List all aggregates +# GET /os-aggregates +"os_compute_api:os-aggregates:index": "rule:admin or rule:reader" + +# Delete an aggregate +# DELETE /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:delete": "rule:admin" + +# Show details for an aggregate +# GET /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:show": "rule:admin or rule:reader" + +# Create an assisted volume snapshot +# POST /os-assisted-volume-snapshots +"os_compute_api:os-assisted-volume-snapshots:create": "rule:admin" + +# Delete an assisted volume snapshot +# DELETE /os-assisted-volume-snapshots/{snapshot_id} +"os_compute_api:os-assisted-volume-snapshots:delete": "rule:admin" + +# List port interfaces or show details of a port interface attached to +# a server +# GET /servers/{server_id}/os-interface +# GET /servers/{server_id}/os-interface/{port_id} +"os_compute_api:os-attach-interfaces": "rule:admin or rule:member or rule:reader" + +# Attach an interface to a server +# POST /servers/{server_id}/os-interface +"os_compute_api:os-attach-interfaces:create": "rule:admin or rule:member" + +# Detach an interface from a server +# DELETE /servers/{server_id}/os-interface/{port_id} +"os_compute_api:os-attach-interfaces:delete": "rule:admin or rule:member" + +# List availability zone information without host information +# GET /os-availability-zone +"os_compute_api:os-availability-zone:list": "rule:admin or rule:member or rule:reader" + +# List detailed availability zone information with host information +# GET /os-availability-zone/detail +"os_compute_api:os-availability-zone:detail": "rule:admin or rule:reader" + +# List and show details of bare metal nodes. +# +# These APIs are proxy calls to the Ironic service and are deprecated. +# GET /os-baremetal-nodes +# GET /os-baremetal-nodes/{node_id} +"os_compute_api:os-baremetal-nodes": "rule:admin or rule:reader" + +# Update an existing cell +# PUT /os-cells/{cell_id} +"os_compute_api:os-cells:update": "rule:admin" + +# Create a new cell +# POST /os-cells +"os_compute_api:os-cells:create": "rule:admin" + +# List and show detailed info for a given cell or all cells +# GET /os-cells +# GET /os-cells/detail +# GET /os-cells/info +# GET /os-cells/capacities +# GET /os-cells/{cell_id} +"os_compute_api:os-cells": "rule:admin or rule:reader" + +# Sync instances info in all cells +# POST /os-cells/sync_instances +"os_compute_api:os-cells:sync_instances": "rule:admin" + +# Remove a cell +# DELETE /os-cells/{cell_id} +"os_compute_api:os-cells:delete": "rule:admin" + +# Different cell filter to route a build away from a particular cell +# +# This policy is read by nova-scheduler process. +"cells_scheduler_filter:DifferentCellFilter": "rule:admin" + +# Target cell filter to route a build to a particular cell +# +# This policy is read by nova-scheduler process. +"cells_scheduler_filter:TargetCellFilter": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-config-drive" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-config-drive" policy which was +# added for extensions is not needed any more +# Add 'config_drive' attribute in the server response +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-config-drive": "rule:admin or rule:member" + +# Show console connection information for a given console +# authentication token +# GET /os-console-auth-tokens/{console_token} +"os_compute_api:os-console-auth-tokens": "rule:admin or rule:reader" + +# Show console output for a server +# POST /servers/{server_id}/action (os-getConsoleOutput) +"os_compute_api:os-console-output": "rule:admin or rule:member or rule:reader" + +# Create a console for a server instance +# POST /servers/{server_id}/consoles +"os_compute_api:os-consoles:create": "rule:admin or rule:member" + +# Show console details for a server instance +# GET /servers/{server_id}/consoles/{console_id} +"os_compute_api:os-consoles:show": "rule:admin or rule:member or rule:reader" + +# Delete a console for a server instance +# DELETE /servers/{server_id}/consoles/{console_id} +"os_compute_api:os-consoles:delete": "rule:admin or rule:member" + +# List all consoles for a server instance +# GET /servers/{server_id}/consoles +"os_compute_api:os-consoles:index": "rule:admin or rule:member or rule:reader" + +# Create a back up of a server +# POST /servers/{server_id}/action (createBackup) +"os_compute_api:os-create-backup": "rule:admin or rule:member" + +# Restore a soft deleted server or force delete a server before +# deferred cleanup +# POST /servers/{server_id}/action (restore) +# POST /servers/{server_id}/action (forceDelete) +"os_compute_api:os-deferred-delete": "rule:admin or rule:member" + +# Evacuate a server from a failed host to a new host +# POST /servers/{server_id}/action (evacuate) +"os_compute_api:os-evacuate": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-extended-availability-zone" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-availability-zone" +# policy which was added for extensions is not needed any more +# Add `OS-EXT-AZ:availability_zone` into the server response +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-availability-zone": "rule:admin or rule:member" + +# Return extended attributes for server. +# +# This rule will control the visibility for a set of servers +# attributes: +# +# - ``OS-EXT-SRV-ATTR:host`` +# - ``OS-EXT-SRV-ATTR:instance_name`` +# - ``OS-EXT-SRV-ATTR:reservation_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:launch_index`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:hostname`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:kernel_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:ramdisk_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:root_device_name`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:user_data`` (since microversion 2.3) +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-server-attributes": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-extended-status" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-status" policy which was +# added for extensions is not needed any more +# Return extended status in the response of server. +# +# This policy will control the visibility for a set of attributes: +# +# - ``OS-EXT-STS:task_state`` +# - ``OS-EXT-STS:vm_state`` +# - ``OS-EXT-STS:power_state`` +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-status": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-extended-volumes" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-volumes" policy which +# was added for extensions is not needed any more +# Return 'os-extended-volumes:volumes_attached' in the response of +# server +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-volumes": "rule:admin or rule:member or rule:reader" + +# List available extensions and show information for an extension by +# alias +# GET /extensions +# GET /extensions/{alias} +"os_compute_api:extensions": "rule:admin or rule:member or rule:reader" + +# Add flavor access to a tenant +# POST /flavors/{flavor_id}/action (addTenantAccess) +"os_compute_api:os-flavor-access:add_tenant_access": "rule:admin" + +# Remove flavor access from a tenant +# POST /flavors/{flavor_id}/action (removeTenantAccess) +"os_compute_api:os-flavor-access:remove_tenant_access": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-flavor-access" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-flavor-access" policy for POST, +# PUT, GET /flavors which was added for extensions is not needed any +# more. NOTE: This policy is deprecated only for POST /flavors, PUT +# /flavors, GET /flavors/{flavor_id} & GET /flavors/detail. This +# policy for other API operations is still valid and not deprecated +# List flavor access information +# +# Adds the os-flavor-access:is_public key into several flavor APIs. +# +# It also allows access to the full list of tenants that have access +# to a flavor via an os-flavor-access API. +# GET /flavors/{flavor_id}/os-flavor-access +# GET /flavors/detail +# GET /flavors/{flavor_id} +# POST /flavors +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-access": "rule:admin or rule:member" + +# Show an extra spec for a flavor +# GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:show": "rule:admin or rule:member or rule:reader" + +# Create extra specs for a flavor +# POST /flavors/{flavor_id}/os-extra_specs/ +"os_compute_api:os-flavor-extra-specs:create": "rule:admin" + +# Update an extra spec for a flavor +# PUT /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:update": "rule:admin" + +# Delete an extra spec for a flavor +# DELETE /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:delete": "rule:admin" + +# List extra specs for a flavor. Starting with microversion 2.47, the +# flavor used for a server is also returned in the response when +# showing server details, updating a server or rebuilding a server. +# Starting with microversion 2.61, extra specs may be returned in +# responses for the flavor resource. +# GET /flavors/{flavor_id}/os-extra_specs/ +# GET /servers/detail +# GET /servers/{server_id} +# PUT /servers/{server_id} +# POST /servers/{server_id}/action (rebuild) +# POST /flavors +# GET /flavors/detail +# GET /flavors/{flavor_id} +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-extra-specs:index": "rule:admin or rule:member" + +# Create and delete Flavors. Deprecated in Pike and will be removed in +# future release +# POST /flavors +# DELETE /flavors/{flavor_id} +"os_compute_api:os-flavor-manage": "rule:admin" + +# Create a flavor +# POST /flavors +"os_compute_api:os-flavor-manage:create": "rule:os_compute_api:os-flavor-manage" + +# Update a flavor +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-manage:update": "rule:admin" + +# Delete a flavor +# DELETE /flavors/{flavor_id} +"os_compute_api:os-flavor-manage:delete": "rule:os_compute_api:os-flavor-manage" + +# DEPRECATED +# "os_compute_api:os-flavor-rxtx" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-flavor-rxtx" policy which was +# added for extensions is not needed any more +# Add the rxtx_factor key into some Flavor APIs +# GET /flavors/detail +# GET /flavors/{flavor_id} +# POST /flavors +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-rxtx": "rule:admin or rule:member" + +# Deprecated in Pike and will be removed in next release +"os_compute_api:flavors": "rule:admin or rule:member" + +# List floating IP pools. This API is deprecated. +# GET /os-floating-ip-pools +"os_compute_api:os-floating-ip-pools": "rule:admin or rule:member or rule:reader" + +# Manage a project's floating IPs. These APIs are all deprecated. +# POST /servers/{server_id}/action (addFloatingIp) +# POST /servers/{server_id}/action (removeFloatingIp) +# GET /os-floating-ips +# POST /os-floating-ips +# GET /os-floating-ips/{floating_ip_id} +# DELETE /os-floating-ips/{floating_ip_id} +"os_compute_api:os-floating-ips": "rule:admin or rule:member" + +# DEPRECATED +# "os_compute_api:os-hide-server-addresses" has been deprecated since 17.0.0. +# Capability of configuring the server states to hide the address has +# been deprecated for removal. Now this policy is not needed to +# control the server address +# Hide server's 'addresses' key in the server response. +# +# This set the 'addresses' key in the server response to an empty +# dictionary when the server is in a specific set of states as +# defined in CONF.api.hide_server_address_states. +# By default 'addresses' is hidden only when the server is in +# 'BUILDING' state. +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-hide-server-addresses": "rule:admin or rule:member" + +# List, show and manage physical hosts. +# +# These APIs are all deprecated in favor of os-hypervisors and os- +# services. +# GET /os-hosts +# GET /os-hosts/{host_name} +# PUT /os-hosts/{host_name} +# GET /os-hosts/{host_name}/reboot +# GET /os-hosts/{host_name}/shutdown +# GET /os-hosts/{host_name}/startup +"os_compute_api:os-hosts": "rule:admin" + +# Policy rule for hypervisor related APIs. +# +# This rule will be checked for the following APIs: +# +# List all hypervisors, list all hypervisors with details, show +# summary statistics for all hypervisors over all compute nodes, +# show details for a hypervisor, show the uptime of a hypervisor, +# search hypervisor by hypervisor_hostname pattern and list all +# servers on hypervisors that can match the provided +# hypervisor_hostname pattern. +# GET /os-hypervisors +# GET /os-hypervisors/details +# GET /os-hypervisors/statistics +# GET /os-hypervisors/{hypervisor_id} +# GET /os-hypervisors/{hypervisor_id}/uptime +# GET /os-hypervisors/{hypervisor_hostname_pattern}/search +# GET /os-hypervisors/{hypervisor_hostname_pattern}/servers +"os_compute_api:os-hypervisors": "rule:admin or rule:reader" + +# DEPRECATED +# "os_compute_api:image-size" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:image-size" policy which was added +# for extensions is not needed any more +# Add 'OS-EXT-IMG-SIZE:size' attribute in the image response. +# GET /images/{id} +# GET /images/detail +"os_compute_api:image-size": "rule:admin or rule:member or rule:reader" + +# Add events details in action details for a server. +# +# This check is performed only after the check +# os_compute_api:os-instance-actions passes. Beginning with +# Microversion 2.51, events details are always included; traceback +# information is provided per event if policy enforcement passes. +# Beginning with Microversion 2.62, each event includes a hashed +# host identifier and, if policy enforcement passes, the name of +# the host. +# GET /servers/{server_id}/os-instance-actions/{request_id} +"os_compute_api:os-instance-actions:events": "rule:admin or rule:reader" + +# List actions and show action details for a server. +# GET /servers/{server_id}/os-instance-actions +# GET /servers/{server_id}/os-instance-actions/{request_id} +"os_compute_api:os-instance-actions": "rule:admin or rule:member or rule:reader" + +# List all usage audits and that occurred before a specified time for +# all servers on all compute hosts where usage auditing is configured +# GET /os-instance_usage_audit_log +# GET /os-instance_usage_audit_log/{before_timestamp} +"os_compute_api:os-instance-usage-audit-log": "rule:admin or rule:reader" + +# Show IP addresses details for a network label of a server +# GET /servers/{server_id}/ips/{network_label} +"os_compute_api:ips:show": "rule:admin or rule:member or rule:reader" + +# List IP addresses that are assigned to a server +# GET /servers/{server_id}/ips +"os_compute_api:ips:index": "rule:admin or rule:member or rule:reader" + +# List all keypairs +# GET /os-keypairs +"os_compute_api:os-keypairs:index": "rule:admin or rule:owner" + +# Create a keypair +# POST /os-keypairs +"os_compute_api:os-keypairs:create": "rule:admin or rule:owner" + +# Delete a keypair +# DELETE /os-keypairs/{keypair_name} +"os_compute_api:os-keypairs:delete": "rule:admin or rule:owner" + +# Show details of a keypair +# GET /os-keypairs/{keypair_name} +"os_compute_api:os-keypairs:show": "rule:admin or rule:owner" + +# DEPRECATED +# "os_compute_api:os-keypairs" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-keypairs" policy which was added +# for extensions is not needed any more +# Return 'key_name' in the response of server. +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-keypairs": "rule:admin or rule:member" + +# Show rate and absolute limits for the project +# GET /limits +"os_compute_api:limits": "rule:admin or rule:member or rule:reader" + +# Lock a server +# POST /servers/{server_id}/action (lock) +"os_compute_api:os-lock-server:lock": "rule:admin or rule:member" + +# Unlock a server +# POST /servers/{server_id}/action (unlock) +"os_compute_api:os-lock-server:unlock": "rule:admin or rule:member" + +# Unlock a server, regardless who locked the server. +# +# This check is performed only after the check +# os_compute_api:os-lock-server:unlock passes +# POST /servers/{server_id}/action (unlock) +"os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin" + +# Cold migrate a server to a host +# POST /servers/{server_id}/action (migrate) +"os_compute_api:os-migrate-server:migrate": "rule:admin" + +# Live migrate a server to a new host without a reboot +# POST /servers/{server_id}/action (os-migrateLive) +"os_compute_api:os-migrate-server:migrate_live": "rule:admin" + +# List migrations +# GET /os-migrations +"os_compute_api:os-migrations:index": "rule:admin or rule:reader" + +# Add or remove a fixed IP address from a server. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# POST /servers/{server_id}/action (addFixedIp) +# POST /servers/{server_id}/action (removeFixedIp) +"os_compute_api:os-multinic": "rule:admin or rule:member" + +# Create and delete a network, add and disassociate a network +# from a project. +# +# These APIs are only available with nova-network which is deprecated. +# POST /os-networks +# POST /os-networks/add +# DELETE /os-networks/{network_id} +# POST /os-networks/{network_id}/action (disassociate) +"os_compute_api:os-networks": "rule:admin" + +# List networks for the project and show details for a network. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# GET /os-networks +# GET /os-networks/{network_id} +"os_compute_api:os-networks:view": "rule:admin or rule:member or rule:reader" + +# Associate or disassociate a network from a host or project. +# +# These APIs are only available with nova-network which is deprecated. +# POST /os-networks/{network_id}/action (disassociate_host) +# POST /os-networks/{network_id}/action (disassociate_project) +# POST /os-networks/{network_id}/action (associate_host) +"os_compute_api:os-networks-associate": "rule:admin" + +# Pause a server +# POST /servers/{server_id}/action (pause) +"os_compute_api:os-pause-server:pause": "rule:admin or rule:member" + +# Unpause a paused server +# POST /servers/{server_id}/action (unpause) +"os_compute_api:os-pause-server:unpause": "rule:admin or rule:member" + +# List quotas for specific quota classs +# GET /os-quota-class-sets/{quota_class} +"os_compute_api:os-quota-class-sets:show": "rule:admin or quota_class:%(quota_class)s or rule:reader" + +# Update quotas for specific quota class +# PUT /os-quota-class-sets/{quota_class} +"os_compute_api:os-quota-class-sets:update": "rule:admin" + +# Update the quotas +# PUT /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:update": "rule:admin" + +# List default quotas +# GET /os-quota-sets/{tenant_id}/defaults +"os_compute_api:os-quota-sets:defaults": "@" + +# Show a quota +# GET /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:show": "rule:admin or rule:member or rule:reader" + +# Revert quotas to defaults +# DELETE /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:delete": "rule:admin" + +# Show the detail of quota +# GET /os-quota-sets/{tenant_id}/detail +"os_compute_api:os-quota-sets:detail": "rule:admin or rule:member or rule:reader" + +# Generate a URL to access remove server console +# POST /servers/{server_id}/action (os-getRDPConsole) +# POST /servers/{server_id}/action (os-getSerialConsole) +# POST /servers/{server_id}/action (os-getSPICEConsole) +# POST /servers/{server_id}/action (os-getVNCConsole) +# POST /servers/{server_id}/remote-consoles +"os_compute_api:os-remote-consoles": "rule:admin or rule:member" + +# Rescue/unrescue a server +# POST /servers/{server_id}/action (rescue) +# POST /servers/{server_id}/action (unrescue) +"os_compute_api:os-rescue": "rule:admin or rule:member" + +# List, show information for, create, or delete default security +# group rules. +# +# These APIs are only available with nova-network which is now +# deprecated. +# GET /os-security-group-default-rules +# GET /os-security-group-default-rules/{security_group_default_rule_id} +# POST /os-security-group-default-rules +# DELETE /os-security-group-default-rules/{security_group_default_rule_id} +"os_compute_api:os-security-group-default-rules": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-security-groups" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-security-groups" policy for POST, +# GET /servers which was added for extensions is not needed any more. +# NOTE: This policy is deprecated only for POST /servers, GET +# /servers/{server_id} & GET /servers/detail. This policy for other +# API operations is still valid and not deprecated +# List, show, add, or remove security groups. +# +# APIs which are directly related to security groups resource are +# deprecated: +# Lists, shows information for, creates, updates and deletes +# security groups. Creates and deletes security group rules. All these +# APIs are deprecated. +# +# APIs which are related to server resource are not deprecated: +# Lists Security Groups for a server. Add Security Group to a server +# and remove security group from a server. Expand security_groups in +# server representation +# GET /os-security-groups +# GET /os-security-groups/{security_group_id} +# POST /os-security-groups +# PUT /os-security-groups/{security_group_id} +# DELETE /os-security-groups/{security_group_id} +# GET /servers/{server_id}/os-security-groups +# POST /servers/{server_id}/action (addSecurityGroup) +# POST /servers/{server_id}/action (removeSecurityGroup) +# POST /servers +# GET /servers/{server_id} +# GET /servers/detail +"os_compute_api:os-security-groups": "rule:admin or rule:member" + +# Show the usage data for a server +# GET /servers/{server_id}/diagnostics +"os_compute_api:os-server-diagnostics": "rule:admin or rule:member or rule:reader" + +# Create one or more external events +# POST /os-server-external-events +"os_compute_api:os-server-external-events:create": "rule:admin" + +# Deprecated in Pike and will be removed in next release +"os_compute_api:os-server-groups": "rule:admin or rule:member" + +# Create a new server group +# POST /os-server-groups +"os_compute_api:os-server-groups:create": "rule:admin or rule:member" + +# Delete a server group +# DELETE /os-server-groups/{server_group_id} +"os_compute_api:os-server-groups:delete": "rule:admin or rule:member" + +# List all server groups +# GET /os-server-groups +"os_compute_api:os-server-groups:index": "rule:admin or rule:member or rule:reader" + +# Show details of a server group +# GET /os-server-groups/{server_group_id} +"os_compute_api:os-server-groups:show": "rule:admin or rule:member or rule:reader" + +# List all metadata of a server +# GET /servers/{server_id}/metadata +"os_compute_api:server-metadata:index": "rule:admin or rule:member or rule:reader" + +# Show metadata for a server +# GET /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:show": "rule:admin or rule:member or rule:reader" + +# Create metadata for a server +# POST /servers/{server_id}/metadata +"os_compute_api:server-metadata:create": "rule:admin or rule:member" + +# Replace metadata for a server +# PUT /servers/{server_id}/metadata +"os_compute_api:server-metadata:update_all": "rule:admin or rule:member" + +# Update metadata from a server +# PUT /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:update": "rule:admin or rule:member" + +# Delete metadata from a server +# DELETE /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:delete": "rule:admin or rule:member" + +# Show and clear the encrypted administrative password of a server +# GET /servers/{server_id}/os-server-password +# DELETE /servers/{server_id}/os-server-password +"os_compute_api:os-server-password": "rule:admin or rule:member" + +# Delete all the server tags +# DELETE /servers/{server_id}/tags +"os_compute_api:os-server-tags:delete_all": "rule:admin or rule:member" + +# List all tags for given server +# GET /servers/{server_id}/tags +"os_compute_api:os-server-tags:index": "rule:admin or rule:member or rule:reader" + +# Replace all tags on specified server with the new set of tags. +# PUT /servers/{server_id}/tags +"os_compute_api:os-server-tags:update_all": "rule:admin or rule:member" + +# Delete a single tag from the specified server +# DELETE /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:delete": "rule:admin or rule:member" + +# Add a single tag to the server if server has no specified tag +# PUT /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:update": "rule:admin or rule:member" + +# Check tag existence on the server. +# GET /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:show": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-server-usage" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-server-usage" policy which was +# added for extensions is not needed any more +# Add 'OS-SRV-USG:launched_at' & 'OS-SRV-USG:terminated_at' attribute +# in the server response. +# +# This check is performed only after the check +# 'os_compute_api:servers:show' for GET /servers/{id} and +# 'os_compute_api:servers:detail' for GET /servers/detail passes +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-server-usage": "rule:admin or rule:member or rule:reader" + +# List all servers +# GET /servers +"os_compute_api:servers:index": "rule:admin or rule:member or rule:reader" + +# List all servers with detailed information +# GET /servers/detail +"os_compute_api:servers:detail": "rule:admin or rule:member or rule:reader" + +# List all servers for all projects +# GET /servers +"os_compute_api:servers:index:get_all_tenants": "rule:admin or rule:global_reader" + +# List all servers with detailed information for all projects +# GET /servers/detail +"os_compute_api:servers:detail:get_all_tenants": "rule:admin or rule:reader" + +# Show a server +# GET /servers/{server_id} +"os_compute_api:servers:show": "rule:admin or rule:member or rule:reader" + +# Show a server with additional host status information +# GET /servers/{server_id} +# GET /servers/detail +"os_compute_api:servers:show:host_status": "rule:admin or rule:reader" + +# Create a server +# POST /servers +"os_compute_api:servers:create": "rule:admin or rule:member" + +# Create a server on the specified host +# POST /servers +"os_compute_api:servers:create:forced_host": "rule:admin" + +# Create a server with the requested volume attached to it +# POST /servers +"os_compute_api:servers:create:attach_volume": "rule:admin or rule:member" + +# Create a server with the requested network attached to it +# POST /servers +"os_compute_api:servers:create:attach_network": "rule:admin or rule:member" + +# Create a server with trusted image certificate IDs +# POST /servers +"os_compute_api:servers:create:trusted_certs": "rule:admin or rule:member" + +# +# This rule controls the compute API validation behavior of creating a +# server +# with a flavor that has 0 disk, indicating the server should be +# volume-backed. +# +# For a flavor with disk=0, the root disk will be set to exactly the +# size of the +# image used to deploy the instance. However, in this case the +# filter_scheduler +# cannot select the compute host based on the virtual image size. +# Therefore, 0 +# should only be used for volume booted instances or for testing +# purposes. +# +# WARNING: It is a potential security exposure to enable this policy +# rule +# if users can upload their own images since repeated attempts to +# create a disk=0 flavor instance with a large image can exhaust +# the local disk of the compute (or shared storage cluster). See bug +# https://bugs.launchpad.net/nova/+bug/1739646 for details. +# +# This rule defaults to ``rule:admin or rule:member`` for backward +# compatibility but +# will be changed to default to ``rule:admin`` in a subsequent +# release. +# POST /servers +"os_compute_api:servers:create:zero_disk_flavor": "rule:admin or rule:member" + +# Attach an unshared external network to a server +# POST /servers +# POST /servers/{server_id}/os-interface +"network:attach_external_network": "rule:admin" + +# Delete a server +# DELETE /servers/{server_id} +"os_compute_api:servers:delete": "rule:admin or rule:member" + +# Update a server +# PUT /servers/{server_id} +"os_compute_api:servers:update": "rule:admin or rule:member" + +# Confirm a server resize +# POST /servers/{server_id}/action (confirmResize) +"os_compute_api:servers:confirm_resize": "rule:admin or rule:member" + +# Revert a server resize +# POST /servers/{server_id}/action (revertResize) +"os_compute_api:servers:revert_resize": "rule:admin or rule:member" + +# Reboot a server +# POST /servers/{server_id}/action (reboot) +"os_compute_api:servers:reboot": "rule:admin or rule:member" + +# Resize a server +# POST /servers/{server_id}/action (resize) +"os_compute_api:servers:resize": "rule:admin or rule:member" + +# Rebuild a server +# POST /servers/{server_id}/action (rebuild) +"os_compute_api:servers:rebuild": "rule:admin or rule:member" + +# Rebuild a server with trusted image certificate IDs +# POST /servers/{server_id}/action (rebuild) +"os_compute_api:servers:rebuild:trusted_certs": "rule:admin or rule:member" + +# Create an image from a server +# POST /servers/{server_id}/action (createImage) +"os_compute_api:servers:create_image": "rule:admin or rule:member" + +# Create an image from a volume backed server +# POST /servers/{server_id}/action (createImage) +"os_compute_api:servers:create_image:allow_volume_backed": "rule:admin or rule:member" + +# Start a server +# POST /servers/{server_id}/action (os-start) +"os_compute_api:servers:start": "rule:admin or rule:member" + +# Stop a server +# POST /servers/{server_id}/action (os-stop) +"os_compute_api:servers:stop": "rule:admin or rule:member" + +# Trigger crash dump in a server +# POST /servers/{server_id}/action (trigger_crash_dump) +"os_compute_api:servers:trigger_crash_dump": "rule:admin or rule:member" + +# Show details for an in-progress live migration for a given server +# GET /servers/{server_id}/migrations/{migration_id} +"os_compute_api:servers:migrations:show": "rule:admin or rule:reader" + +# Force an in-progress live migration for a given server to complete +# POST /servers/{server_id}/migrations/{migration_id}/action (force_complete) +"os_compute_api:servers:migrations:force_complete": "rule:admin" + +# Delete(Abort) an in-progress live migration +# DELETE /servers/{server_id}/migrations/{migration_id} +"os_compute_api:servers:migrations:delete": "rule:admin" + +# Lists in-progress live migrations for a given server +# GET /servers/{server_id}/migrations +"os_compute_api:servers:migrations:index": "rule:admin or rule:reader" + +# List all running Compute services in a region, enables or disable +# scheduling for a Compute service, logs disabled Compute service +# information, set or unset forced_down flag for the compute service +# and delete a Compute service +# GET /os-services +# PUT /os-services/enable +# PUT /os-services/disable +# PUT /os-services/disable-log-reason +# PUT /os-services/force-down +# PUT /os-services/{service_id} +# DELETE /os-services/{service_id} +"os_compute_api:os-services": "rule:admin" + +# Shelve server +# POST /servers/{server_id}/action (shelve) +"os_compute_api:os-shelve:shelve": "rule:admin or rule:member" + +# Unshelve (restore) shelved server +# POST /servers/{server_id}/action (unshelve) +"os_compute_api:os-shelve:unshelve": "rule:admin or rule:member" + +# Shelf-offload (remove) server +# POST /servers/{server_id}/action (shelveOffload) +"os_compute_api:os-shelve:shelve_offload": "rule:admin" + +# Show usage statistics for a specific tenant +# GET /os-simple-tenant-usage/{tenant_id} +"os_compute_api:os-simple-tenant-usage:show": "rule:admin or rule:member or rule:reader" + +# List per tenant usage statistics for all tenants +# GET /os-simple-tenant-usage +"os_compute_api:os-simple-tenant-usage:list": "rule:admin or rule:reader" + +# Resume suspended server +# POST /servers/{server_id}/action (resume) +"os_compute_api:os-suspend-server:resume": "rule:admin or rule:member" + +# Suspend server +# POST /servers/{server_id}/action (suspend) +"os_compute_api:os-suspend-server:suspend": "rule:admin or rule:member" + +# Create, list, show information for, and delete project networks. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# GET /os-tenant-networks +# POST /os-tenant-networks +# GET /os-tenant-networks/{network_id} +# DELETE /os-tenant-networks/{network_id} +"os_compute_api:os-tenant-networks": "rule:admin or rule:member" + +# Show rate and absolute limits for the project. +# +# This policy only checks if the user has access to the requested +# project limits. And this check is performed only after the check +# os_compute_api:limits passes +# GET /limits +"os_compute_api:os-used-limits": "rule:admin or rule:reader" + +# Manage volumes for use with the Compute API. +# +# Lists, shows details, creates, and deletes volumes and +# snapshots. These APIs are proxy calls to the Volume service. +# These are all deprecated. +# GET /os-volumes +# POST /os-volumes +# GET /os-volumes/detail +# GET /os-volumes/{volume_id} +# DELETE /os-volumes/{volume_id} +# GET /os-snapshots +# POST /os-snapshots +# GET /os-snapshots/detail +# GET /os-snapshots/{snapshot_id} +# DELETE /os-snapshots/{snapshot_id} +"os_compute_api:os-volumes": "rule:admin or rule:member" + +# List volume attachments for an instance +# GET /servers/{server_id}/os-volume_attachments +"os_compute_api:os-volumes-attachments:index": "rule:admin or rule:member or rule:reader" + +# Attach a volume to an instance +# POST /servers/{server_id}/os-volume_attachments +"os_compute_api:os-volumes-attachments:create": "rule:admin or rule:member" + +# Show details of a volume attachment +# GET /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:show": "rule:admin or rule:member or rule:reader" + +# Update a volume attachment +# PUT /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:update": "rule:admin" + +# Detach a volume from an instance +# DELETE /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:delete": "rule:admin or rule:member" diff --git a/etc/panko/policy.yaml b/etc/panko/policy.yaml new file mode 100644 index 0000000..737291d --- /dev/null +++ b/etc/panko/policy.yaml @@ -0,0 +1,41 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + + +### Policy Rules defined in panko.policies.segregation + +# Return the user and project the requestshould be limited to +# GET /v2/events +# GET /v2/events/{message_id} +# +"segregation": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in panko.policies.telemetry + +# Return all events matching the query filters. +# GET /v2/events +# +"telemetry:events:index": "rule:admin or rule:member or rule:reader" + +# Return a single event with the given message id. +# GET /v2/events/{message_id} +# +"telemetry:events:show": "rule:admin or rule:member or rule:reader" diff --git a/etc/sahara/policy.json b/etc/sahara/policy.json deleted file mode 100644 index 15eeb69..0000000 --- a/etc/sahara/policy.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "default": "rule:admin or rule:member", - - "data-processing:clusters:get_all": "rule:admin or rule:member", - "data-processing:clusters:create": "rule:admin or rule:member", - "data-processing:clusters:scale": "rule:admin or rule:member", - "data-processing:clusters:get": "rule:admin or rule:member", - "data-processing:clusters:delete": "rule:admin or rule:member", - "data-processing:clusters:modify": "rule:admin or rule:member", - - "data-processing:cluster-templates:get_all": "rule:admin or rule:member", - "data-processing:cluster-templates:create": "rule:admin or rule:member", - "data-processing:cluster-templates:get": "rule:admin or rule:member", - "data-processing:cluster-templates:modify": "rule:admin or rule:member", - "data-processing:cluster-templates:delete": "rule:admin or rule:member", - - "data-processing:node-group-templates:get_all": "rule:admin or rule:member", - "data-processing:node-group-templates:create": "rule:admin or rule:member", - "data-processing:node-group-templates:get": "rule:admin or rule:member", - "data-processing:node-group-templates:modify": "rule:admin or rule:member", - "data-processing:node-group-templates:delete": "rule:admin or rule:member", - - "data-processing:plugins:get_all": "rule:admin or rule:member", - "data-processing:plugins:get": "rule:admin or rule:member", - "data-processing:plugins:get_version": "rule:admin or rule:member", - "data-processing:plugins:convert_config": "rule:admin or rule:member", - "data-processing:plugins:patch": "rule:admin", - - "data-processing:images:get_all": "rule:admin or rule:member", - "data-processing:images:get": "rule:admin or rule:member", - "data-processing:images:register": "rule:admin or rule:member", - "data-processing:images:unregister": "rule:admin or rule:member", - "data-processing:images:add_tags": "rule:admin or rule:member", - "data-processing:images:remove_tags": "rule:admin or rule:member", - - "data-processing:job-executions:get_all": "rule:admin or rule:member", - "data-processing:job-executions:get": "rule:admin or rule:member", - "data-processing:job-executions:refresh_status": "rule:admin or rule:member", - "data-processing:job-executions:cancel": "rule:admin or rule:member", - "data-processing:job-executions:delete": "rule:admin or rule:member", - "data-processing:job-executions:modify": "rule:admin or rule:member", - - "data-processing:data-sources:get_all": "rule:admin or rule:member", - "data-processing:data-sources:get": "rule:admin or rule:member", - "data-processing:data-sources:register": "rule:admin or rule:member", - "data-processing:data-sources:delete": "rule:admin or rule:member", - "data-processing:data-sources:modify": "rule:admin or rule:member", - - "data-processing:jobs:get_all": "rule:admin or rule:member", - "data-processing:jobs:create": "rule:admin or rule:member", - "data-processing:jobs:get": "rule:admin or rule:member", - "data-processing:jobs:delete": "rule:admin or rule:member", - "data-processing:jobs:get_config_hints": "rule:admin or rule:member", - "data-processing:jobs:execute": "rule:admin or rule:member", - "data-processing:jobs:modify": "rule:admin or rule:member", - - "data-processing:job-binaries:get_all": "rule:admin or rule:member", - "data-processing:job-binaries:create": "rule:admin or rule:member", - "data-processing:job-binaries:get": "rule:admin or rule:member", - "data-processing:job-binaries:delete": "rule:admin or rule:member", - "data-processing:job-binaries:get_data": "rule:admin or rule:member", - "data-processing:job-binaries:modify": "rule:admin or rule:member", - - "data-processing:job-binary-internals:get_all": "rule:admin or rule:member", - "data-processing:job-binary-internals:create": "rule:admin or rule:member", - "data-processing:job-binary-internals:get": "rule:admin or rule:member", - "data-processing:job-binary-internals:delete": "rule:admin or rule:member", - "data-processing:job-binary-internals:get_data": "rule:admin or rule:member", - "data-processing:job-binary-internals:modify": "rule:admin or rule:member", - - "data-processing:job-types:get_all": "rule:admin or rule:member" -} diff --git a/etc/zaqar/policy.json b/etc/zaqar/policy.json deleted file mode 100644 index 1a6c49e..0000000 --- a/etc/zaqar/policy.json +++ /dev/null @@ -1,53 +0,0 @@ -{ - "global_readonly": "(role:global_readonly)", - "readonly": "((project_id:%(project_id)s and role:readonly) or rule:global_readonly)", - "_member_role": "(role:member or role:_member_)", - "member": "(project_id:%(project_id)s and rule:_member_role)", - "admin": "(is_admin:True or role:admin)", - "owner": "(user_id:%(user_id)s and rule:_member_role)", - - "context_is_admin": "role:admin", - - "default": "rule:admin or rule:member", - - "queues:get_all": "rule:admin or rule:member", - "queues:create": "rule:admin or rule:member", - "queues:get": "rule:admin or rule:member", - "queues:delete": "rule:admin or rule:member", - "queues:update": "rule:admin or rule:member", - "queues:stats": "rule:admin or rule:member", - - "messages:get_all": "rule:admin or rule:member", - "messages:create": "rule:admin or rule:member", - "messages:get": "rule:admin or rule:member", - "messages:delete": "rule:admin or rule:member", - "messages:delete_all": "rule:admin or rule:member", - - "claims:get_all": "rule:admin or rule:member", - "claims:create": "rule:admin or rule:member", - "claims:get": "rule:admin or rule:member", - "claims:delete": "rule:admin or rule:member", - "claims:update": "rule:admin or rule:member", - - "subscription:get_all": "rule:admin or rule:member", - "subscription:create": "rule:admin or rule:member", - "subscription:get": "rule:admin or rule:member", - "subscription:delete": "rule:admin or rule:member", - "subscription:update": "rule:admin or rule:member", - "subscription:confirm": "rule:admin or rule:member", - - "pools:get_all": "rule:admin or rule:member", - "pools:create": "rule:admin or rule:member", - "pools:get": "rule:admin or rule:member", - "pools:delete": "rule:admin or rule:member", - "pools:update": "rule:admin or rule:member", - - "flavors:get_all": "rule:admin or rule:member", - "flavors:create": "rule:admin or rule:member", - "flavors:get": "rule:admin or rule:member", - "flavors:delete": "rule:admin or rule:member", - "flavors:update": "rule:admin or rule:member", - - "ping:get": "rule:admin or rule:member", - "health:get": "rule:admin or rule:member" -} From dba95e9f1a0347275207e2a6eb1cb996f3ff2785 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 10/26] Updated neutron and manila policies Change-Id: I356df11246109b16addb7abcd3bf6885cc5dbcbd --- diff --git a/etc/manila/policy.yaml b/etc/manila/policy.yaml index 7c174ae..1920745 100644 --- a/etc/manila/policy.yaml +++ b/etc/manila/policy.yaml @@ -1,10 +1,33 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +"default": "rule:admin or rule:member" + ### Policy Rules defined in manila.policies.availability_zone # Get all storage availability zones. # GET /os-availability-zone # GET /availability-zone # -# "availability_zone:index":"rule:default" +"availability_zone:index": "rule:default or rule:reader" ### Policy Rules defined in manila.policies.base @@ -13,18 +36,18 @@ # Get details of a given message. # GET /messages/{message_id} # -# "message:get":"rule:default" +"message:get": "rule:default or rule:reader" # Get all messages. # GET /messages # GET /messages?{query} # -# "message:get_all":"rule:default" +"message:get_all": "rule:default or rule:reader" # Delete a message. # DELETE /messages/{message_id} # -# "message:delete":"rule:default" +"message:delete": "rule:default" ### Policy Rules defined in manila.policies.quota_class_set @@ -32,13 +55,13 @@ # PUT /quota-class-sets/{class_name} # PUT /os-quota-class-sets/{class_name} # -# "quota_class_set:update":"rule:admin_api" +"quota_class_set:update": "rule:admin" # Get quota class. # GET /quota-class-sets/{class_name} # GET /os-quota-class-sets/{class_name} # -# "quota_class_set:show":"rule:default" +"quota_class_set:show": "rule:defaul or rule:readert" ### Policy Rules defined in manila.policies.quota_set @@ -49,13 +72,13 @@ # PUT /os-quota-sets/{tenant_id} # PUT /os-quota-sets/{tenant_id}?user_id={user_id} # -# "quota_set:update":"rule:admin_api" +"quota_set:update": "rule:admin" # List the quotas for a tenant/user. # GET /quota-sets/{tenant_id}/defaults # GET /os-quota-sets/{tenant_id}/defaults # -# "quota_set:show":"rule:default" +"quota_set:show": "rule:default or rule:reader" # Delete quota for a tenant/user or tenant/share-type. The quota will revert back to default (Admin only). # DELETE /quota-sets/{tenant_id} @@ -64,7 +87,7 @@ # DELETE /os-quota-sets/{tenant_id} # DELETE /os-quota-sets/{tenant_id}?user_id={user_id} # -# "quota_set:delete":"rule:admin_api" +"quota_set:delete": "rule:admin" ### Policy Rules defined in manila.policies.scheduler_stats @@ -72,53 +95,53 @@ # GET /scheduler-stats/pools # GET /scheduler-stats/pools?{query} # -# "scheduler_stats:pools:index":"rule:admin_api" +"scheduler_stats:pools:index": "rule:admin or rule:reader" # Get detailed information regarding backends (and storage pools) known to the scheduler. # GET /scheduler-stats/pools/detail?{query} # GET /scheduler-stats/pools/detail # -# "scheduler_stats:pools:detail":"rule:admin_api" +"scheduler_stats:pools:detail": "rule:admin or rule:reader" ### Policy Rules defined in manila.policies.security_service # Create security service. # POST /security-services # -# "security_service:create":"rule:default" +"security_service:create": "rule:default" # Get details of a security service. # GET /security-services/{security_service_id} # -# "security_service:show":"rule:default" +"security_service:show": "rule:default or rule:reader" # Get details of all security services. # GET /security-services/detail?{query} # GET /security-services/detail # -# "security_service:detail":"rule:default" +"security_service:detail": "rule:default or rule:reader" # Get all security services. # GET /security-services # GET /security-services?{query} # -# "security_service:index":"rule:default" +"security_service:index": "rule:default or rule:reader" # Update a security service. # PUT /security-services/{security_service_id} # -# "security_service:update":"rule:default" +"security_service:update": "rule:default" # Delete a security service. # DELETE /security-services/{security_service_id} # -# "security_service:delete":"rule:default" +"security_service:delete": "rule:default" # Get security services of all projects. # GET /security-services?all_tenants=1 # GET /security-services/detail?all_tenants=1 # -# "security_service:get_all_security_services":"rule:admin_api" +"security_service:get_all_security_services": "rule:admin or rule:reader" ### Policy Rules defined in manila.policies.service @@ -128,7 +151,7 @@ # GET /services # GET /services?{query} # -# "service:index":"rule:admin_api" +"service:index": "rule:admin or rule:reader" # Enable/Disable scheduling for a service. # PUT /os-services/disable @@ -136,7 +159,7 @@ # PUT /services/disable # PUT /services/enable # -# "service:update":"rule:admin_api" +"service:update": "rule:admin" ### Policy Rules defined in manila.policies.share_access @@ -147,24 +170,24 @@ # Get all export locations of a given share. # GET /shares/{share_id}/export_locations # -# "share_export_location:index":"rule:default" +"share_export_location:index": "rule:default or rule:reader" # Get details about the requested export location. # GET /shares/{share_id}/export_locations/{export_location_id} # -# "share_export_location:show":"rule:default" +"share_export_location:show": "rule:default or rule:reader" ### Policy Rules defined in manila.policies.share_group # Create share group. # POST /share-groups # -# "share_group:create":"rule:default" +"share_group:create": "rule:default" # Get details of a share group. # GET /share-groups/{share_group_id} # -# "share_group:get":"rule:default" +"share_group:get": "rule:default or rule:reader" # Get all share groups. # GET /share-groups @@ -172,39 +195,39 @@ # GET /share-groups?{query} # GET /share-groups/detail?{query} # -# "share_group:get_all":"rule:default" +"share_group:get_all": "rule:default or rule:reader" # Update share group. # PUT /share-groups/{share_group_id} # -# "share_group:update":"rule:default" +"share_group:update": "rule:default" # Delete share group. # DELETE /share-groups/{share_group_id} # -# "share_group:delete":"rule:default" +"share_group:delete": "rule:default" # Force delete a share group. # POST /share-groups/{share_group_id}/action # -# "share_group:force_delete":"rule:admin_api" +"share_group:force_delete": "rule:admin" # Reset share group's status. # POST /share-groups/{share_group_id}/action # -# "share_group:reset_status":"rule:admin_api" +"share_group:reset_status": "rule:admin" ### Policy Rules defined in manila.policies.share_group_snapshot # Create a new share group snapshot. # POST /share-group-snapshots # -# "share_group_snapshot:create":"rule:default" +"share_group_snapshot:create": "rule:default" # Get details of a share group snapshot. # GET /share-group-snapshots/{share_group_snapshot_id} # -# "share_group_snapshot:get":"rule:default" +"share_group_snapshot:get": "rule:default or rule:reader" # Get all share group snapshots. # GET /share-group-snapshots @@ -212,97 +235,97 @@ # GET /share-group-snapshots/{query} # GET /share-group-snapshots/detail?{query} # -# "share_group_snapshot:get_all":"rule:default" +"share_group_snapshot:get_all": "rule:default or rule:reader" # Update a share group snapshot. # PUT /share-group-snapshots/{share_group_snapshot_id} # -# "share_group_snapshot:update":"rule:default" +"share_group_snapshot:update": "rule:default" # Delete a share group snapshot. # DELETE /share-group-snapshots/{share_group_snapshot_id} # -# "share_group_snapshot:delete":"rule:default" +"share_group_snapshot:delete": "rule:default" # Force delete a share group snapshot. # POST /share-group-snapshots/{share_group_snapshot_id}/action # -# "share_group_snapshot:force_delete":"rule:admin_api" +"share_group_snapshot:force_delete": "rule:admin" # Reset a share group snapshot's status. # POST /share-group-snapshots/{share_group_snapshot_id}/action # -# "share_group_snapshot:reset_status":"rule:admin_api" +"share_group_snapshot:reset_status": "rule:admin" ### Policy Rules defined in manila.policies.share_group_type # Create a new share group type. # POST /share-group-types # -# "share_group_type:create":"rule:admin_api" +"share_group_type:create": "rule:admin" # Get the list of share group types. # GET /share-group-types # GET /share-group-types?is_public=all # -# "share_group_type:index":"rule:default" +"share_group_type:index": "rule:default or rule:reader" # Get details regarding the specified share group type. # GET /share-group-types/{share_group_type_id} # -# "share_group_type:show":"rule:default" +"share_group_type:show": "rule:default or rule:reader" # Get the default share group type. # GET /share-group-types/default # -# "share_group_type:default":"rule:default" +"share_group_type:default": "rule:default or rule:reader" # Delete an existing group type. # DELETE /share-group-types/{share_group_type_id} # -# "share_group_type:delete":"rule:admin_api" +"share_group_type:delete": "rule:admin" # Get project access by share group type. # POST /share-group-types/{share_group_type_id}/access # -# "share_group_type:list_project_access":"rule:admin_api" +"share_group_type:list_project_access": "rule:admin or rule:reader" # Allow project to use the share group type. # POST /share-group-types/{share_group_type_id}/action # -# "share_group_type:add_project_access":"rule:admin_api" +"share_group_type:add_project_access": "rule:admin" # Deny project access to use the share group type. # POST /share-group-types/{share_group_type_id}/action # -# "share_group_type:remove_project_access":"rule:admin_api" +"share_group_type:remove_project_access": "rule:admin" ### Policy Rules defined in manila.policies.share_group_types_spec # Create share group type specs. # POST /share-group-types/{share_group_type_id}/group-specs # -# "share_group_types_spec:create":"rule:admin_api" +"share_group_types_spec:create": "rule:admin" # Get share group type specs. # GET /share-group-types/{share_group_type_id}/group-specs # -# "share_group_types_spec:index":"rule:admin_api" +"share_group_types_spec:index": "rule:admin or rule:reader" # Get details of a share group type spec. # GET /share-group-types/{share_group_type_id}/group-specs/{key} # -# "share_group_types_spec:show":"rule:admin_api" +"share_group_types_spec:show": "rule:admin or rule:reader" # Update a share group type spec. # PUT /share-group-types/{share_group_type_id}/group-specs/{key} # -# "share_group_types_spec:update":"rule:admin_api" +"share_group_types_spec:update": "rule:admin" # Delete a share group type spec. # DELETE /share-group-types/{share_group_type_id}/group-specs/{key} # -# "share_group_types_spec:delete":"rule:admin_api" +"share_group_types_spec:delete": "rule:admin" ### Policy Rules defined in manila.policies.share_instance @@ -313,99 +336,99 @@ # Create share network. # POST /share-networks # -# "share_network:create":"rule:default" +"share_network:create": "rule:default" # Get details of a share network. # GET /share-networks/{share_network_id} # -# "share_network:show":"rule:default" +"share_network:show": "rule:default or rule:reader" # Get all share networks. # GET /share-networks # GET /share-networks?{query} # -# "share_network:index":"rule:default" +"share_network:index": "rule:default or rule:reader" # Get details of share networks . # GET /share-networks/detail?{query} # GET /share-networks/detail # -# "share_network:detail":"rule:default" +"share_network:detail": "rule:default or rule:reader" # Update a share network. # PUT /share-networks/{share_network_id} # -# "share_network:update":"rule:default" +"share_network:update": "rule:default" # Delete a share network. # DELETE /share-networks/{share_network_id} # -# "share_network:delete":"rule:default" +"share_network:delete": "rule:default" # Add security service to share network. # POST /share-networks/{share_network_id}/action # -# "share_network:add_security_service":"rule:default" +"share_network:add_security_service": "rule:default" # Remove security service from share network. # POST /share-networks/{share_network_id}/action # -# "share_network:remove_security_service":"rule:default" +"share_network:remove_security_service": "rule:default" # Get share networks belonging to all projects. # GET /share-networks?all_tenants=1 # GET /share-networks/detail?all_tenants=1 # -# "share_network:get_all_share_networks":"rule:admin_api" +"share_network:get_all_share_networks": "rule:admin or rule:reader" ### Policy Rules defined in manila.policies.share_replica # Create share replica. # POST /share-replicas # -# "share_replica:create":"rule:default" +"share_replica:create": "rule:default" # Get all share replicas. # GET /share-replicas # GET /share-replicas/detail # GET /share-replicas/detail?share_id={share_id} # -# "share_replica:get_all":"rule:default" +"share_replica:get_all": "rule:default or rule:reader" # Get details of a share replica. # GET /share-replicas/{share_replica_id} # -# "share_replica:show":"rule:default" +"share_replica:show": "rule:default or rule:reader" # Delete a share replica. # DELETE /share-replicas/{share_replica_id} # -# "share_replica:delete":"rule:default" +"share_replica:delete": "rule:default" # Force delete a share replica. # POST /share-replicas/{share_replica_id}/action # -# "share_replica:force_delete":"rule:admin_api" +"share_replica:force_delete": "rule:admin" # Promote a non-active share replica to active. # POST /share-replicas/{share_replica_id}/action # -# "share_replica:promote":"rule:default" +"share_replica:promote": "rule:default" # Resync a share replica that is out of sync. # POST /share-replicas/{share_replica_id}/action # -# "share_replica:resync":"rule:admin_api" +"share_replica:resync": "rule:admin" # Reset share replica's replica_state attribute. # POST /share-replicas/{share_replica_id}/action # -# "share_replica:reset_replica_state":"rule:admin_api" +"share_replica:reset_replica_state": "rule:admin" # Reset share replica's status. # POST /share-replicas/{share_replica_id}/action # -# "share_replica:reset_status":"rule:admin_api" +"share_replica:reset_status": "rule:admin" ### Policy Rules defined in manila.policies.share_server @@ -413,29 +436,29 @@ # GET /share-servers # GET /share-servers?{query} # -# "share_server:index":"rule:admin_api" +"share_server:index": "rule:admin or rule:reader" # Show share server. # GET /share-servers/{server_id} # -# "share_server:show":"rule:admin_api" +"share_server:show": "rule:admin or rule:reader" # Get share server details. # GET /share-servers/{server_id}/details # -# "share_server:details":"rule:admin_api" +"share_server:details": "rule:admin or rule:reader" # Delete share server. # DELETE /share-servers/{server_id} # -# "share_server:delete":"rule:admin_api" +"share_server:delete": "rule:admin" ### Policy Rules defined in manila.policies.share_snapshot # Get share snapshot. # GET /snapshots/{snapshot_id} # -# "share_snapshot:get_snapshot":"rule:default" +"share_snapshot:get_snapshot": "rule:default or rule:reader" # Get all share snapshots. # GET /snapshots @@ -443,308 +466,307 @@ # GET /snapshots?{query} # GET /snapshots/detail?{query} # -# "share_snapshot:get_all_snapshots":"rule:default" +"share_snapshot:get_all_snapshots": "rule:default or rule:reader" # Force Delete a share snapshot. # DELETE /snapshots/{snapshot_id} # -# "share_snapshot:force_delete":"rule:admin_api" +"share_snapshot:force_delete": "rule:admin" # Manage share snapshot. # POST /snapshots/manage # -# "share_snapshot:manage_snapshot":"rule:admin_api" +"share_snapshot:manage_snapshot": "rule:admin" # Unmanage share snapshot. # POST /snapshots/{snapshot_id}/action # -# "share_snapshot:unmanage_snapshot":"rule:admin_api" +"share_snapshot:unmanage_snapshot": "rule:admin" # Reset status. # POST /snapshots/{snapshot_id}/action # -# "share_snapshot:reset_status":"rule:admin_api" +"share_snapshot:reset_status": "rule:admin" # List access rules of a share snapshot. # GET /snapshots/{snapshot_id}/access-list # -# "share_snapshot:access_list":"rule:default" +"share_snapshot:access_list": "rule:default or rule:reader" # Allow access to a share snapshot. # POST /snapshots/{snapshot_id}/action # -# "share_snapshot:allow_access":"rule:default" +"share_snapshot:allow_access": "rule:default" # Deny access to a share snapshot. # POST /snapshots/{snapshot_id}/action # -# "share_snapshot:deny_access":"rule:default" +"share_snapshot:deny_access": "rule:default" ### Policy Rules defined in manila.policies.share_snapshot_export_location # List export locations of a share snapshot. # GET /snapshots/{snapshot_id}/export-locations/ # -# "share_snapshot_export_location:index":"rule:default" +"share_snapshot_export_location:index": "rule:default or rule:reader" # Get details of a specified export location of a share snapshot. # GET /snapshots/{snapshot_id}/export-locations/{export_location_id} # -# "share_snapshot_export_location:show":"rule:default" +"share_snapshot_export_location:show": "rule:default or rule:reader" ### Policy Rules defined in manila.policies.share_snapshot_instance # Get share snapshot instance. # GET /snapshot-instances/{snapshot_instance_id} # -# "share_snapshot_instance:show":"rule:admin_api" +"share_snapshot_instance:show": "rule:admin or rule:reader" # Get all share snapshot instances. # GET /snapshot-instances # GET /snapshot-instances?{query} # -# "share_snapshot_instance:index":"rule:admin_api" +"share_snapshot_instance:index": "rule:admin or rule:reader" # Get details of share snapshot instances. # GET /snapshot-instances/detail # GET /snapshot-instances/detail?{query} # -# "share_snapshot_instance:detail":"rule:admin_api" +"share_snapshot_instance:detail": "rule:admin or rule:reader" # Reset share snapshot instance's status. # POST /snapshot-instances/{snapshot_instance_id}/action # -# "share_snapshot_instance:reset_status":"rule:admin_api" +"share_snapshot_instance:reset_status": "rule:admin" ### Policy Rules defined in manila.policies.share_snapshot_instance_export_location # List export locations of a share snapshot instance. # GET /snapshot-instances/{snapshot_instance_id}/export-locations # -# "share_snapshot_instance_export_location:index":"rule:admin_api" +"share_snapshot_instance_export_location:index": "rule:admin or rule:reader" # Show details of a specified export location of a share snapshot instance. # GET /snapshot-instances/{snapshot_instance_id}/export-locations/{export_location_id} # -# "share_snapshot_instance_export_location:show":"rule:admin_api" +"share_snapshot_instance_export_location:show": "rule:admin or rule:reader" ### Policy Rules defined in manila.policies.share_type # Create share type. # POST /types # -# "share_type:create":"rule:admin_api" +"share_type:create": "rule:admin" # Get share type. # GET /types/{share_type_id} # -# "share_type:show":"rule:default" +"share_type:show": "rule:default or rule:reader" # List share types. # GET /types # GET /types?is_public=all # -# "share_type:index":"rule:default" +"share_type:index": "rule:default or rule:reader" # Get default share type. # GET /types/default # -# "share_type:default":"rule:default" +"share_type:default": "rule:default or rule:reader" # Delete share type. # DELETE /types/{share_type_id} # -# "share_type:delete":"rule:admin_api" +"share_type:delete": "rule:admin" # List share type project access. # GET /types/{share_type_id} # -# "share_type:list_project_access":"rule:admin_api" +"share_type:list_project_access": "rule:admin or rule:reader" # Add share type to project. # POST /types/{share_type_id}/action # -# "share_type:add_project_access":"rule:admin_api" +"share_type:add_project_access": "rule:admin" # Remove share type from project. # POST /types/{share_type_id}/action # -# "share_type:remove_project_access":"rule:admin_api" +"share_type:remove_project_access": "rule:admin" ### Policy Rules defined in manila.policies.share_types_extra_spec # Create share type extra spec. # POST /types/{share_type_id}/extra_specs # -# "share_types_extra_spec:create":"rule:admin_api" +"share_types_extra_spec:create": "rule:admin" # Get share type extra specs of a given share type. # GET /types/{share_type_id}/extra_specs # -# "share_types_extra_spec:show":"rule:admin_api" +"share_types_extra_spec:show": "rule:admin or rule:reader" # Get details of a share type extra spec. # GET /types/{share_type_id}/extra_specs/{extra_spec_id} # -# "share_types_extra_spec:index":"rule:admin_api" +"share_types_extra_spec:index": "rule:admin or rule:reader" # Update share type extra spec. # PUT /types/{share_type_id}/extra_specs # -# "share_types_extra_spec:update":"rule:admin_api" +"share_types_extra_spec:update": "rule:admin" # Delete share type extra spec. # DELETE /types/{share_type_id}/extra_specs/{key} # -# "share_types_extra_spec:delete":"rule:admin_api" +"share_types_extra_spec:delete": "rule:admin" ### Policy Rules defined in manila.policies.shares # Create share. # POST /shares # -# "share:create":"" +"share:create": "rule:default" # Get share. # GET /shares/{share_id} # -# "share:get":"rule:default" +"share:get": "rule:default or rule:reader" # List shares. # GET /shares # GET /shares/detail # -# "share:get_all":"rule:default" +"share:get_all": "rule:default or rule:reader" # Update share. # PUT /shares # -# "share:update":"rule:default" +"share:update": "rule:default" # Delete share. # DELETE /shares/{share_id} # -# "share:delete":"rule:default" +"share:delete": "rule:default" # Force Delete a share. # DELETE /shares/{share_id} # -# "share:force_delete":"rule:admin_api" +"share:force_delete": "rule:admin" # Manage share. # POST /shares/manage # -# "share:manage":"rule:admin_api" +"share:manage": "rule:admin" # Unmanage share. # POST /shares/unmanage # -# "share:unmanage":"rule:admin_api" +"share:unmanage": "rule:admin" # Create share snapshot. # POST /snapshots # -# "share:create_snapshot":"rule:default" +"share:create_snapshot": "rule:default" # List share by host. # GET /shares # GET /shares/detail # -# "share:list_by_host":"rule:admin_api" +"share:list_by_host": "rule:admin or rule:reader" # List share by server id. # GET /shares # GET /shares/detail # -# "share:list_by_share_server_id":"rule:admin_api" +"share:list_by_share_server_id": "rule:admin or rule:reader" # Get share access rule, it under deny access operation. # POST /shares/{share_id}/action # -# "share:access_get":"rule:default" +"share:access_get": "rule:default or rule:reader" # List share access rules. # GET /shares/{share_id}/action # -# "share:access_get_all":"rule:default" +"share:access_get_all": "rule:default or rule:reader" # Extend share. # POST /shares/{share_id}/action # -# "share:extend":"rule:default" +"share:extend": "rule:default" # Shrink share. # POST /shares/{share_id}/action # -# "share:shrink":"rule:default" +"share:shrink": "rule:default" # Migrate a share to the specified host. # POST /shares/{share_id}/action # -# "share:migration_start":"rule:admin_api" +"share:migration_start": "rule:admin" # Invokes 2nd phase of share migration. # POST /shares/{share_id}/action # -# "share:migration_complete":"rule:admin_api" +"share:migration_complete": "rule:admin" # Attempts to cancel share migration. # POST /shares/{share_id}/action # -# "share:migration_cancel":"rule:admin_api" +"share:migration_cancel": "rule:admin" # Retrieve share migration progress for a given share. # POST /shares/{share_id}/action # -# "share:migration_get_progress":"rule:admin_api" +"share:migration_get_progress": "rule:admin or rule:reader" # Reset task state. # POST /shares/{share_id}/action # -# "share:reset_task_state":"rule:admin_api" +"share:reset_task_state": "rule:admin" # Reset status. # POST /shares/{share_id}/action # -# "share:reset_status":"rule:admin_api" +"share:reset_status": "rule:admin" # Revert a share to a snapshot. # POST /shares/{share_id}/action # -# "share:revert_to_snapshot":"rule:default" +"share:revert_to_snapshot": "rule:default" # Add share access rule. # POST /shares/{share_id}/action # -# "share:allow_access":"rule:default" +"share:allow_access": "rule:default" # Remove share access rule. # POST /shares/{share_id}/action # -# "share:deny_access":"rule:default" +"share:deny_access": "rule:default" # Delete share snapshot. # DELETE /snapshots/{snapshot_id} # -# "share:delete_snapshot":"rule:default" +"share:delete_snapshot": "rule:default" # Update share snapshot. # PUT /snapshots/{snapshot_id}/action # -# "share:snapshot_update":"rule:default" +"share:snapshot_update": "rule:default" # Update share metadata. # PUT /shares/{share_id}/metadata # -# "share:update_share_metadata":"rule:default" +"share:update_share_metadata": "rule:default" # Delete share metadata. # DELETE /shares/{share_id}/metadata/{key} # -# "share:delete_share_metadata":"rule:default" +"share:delete_share_metadata": "rule:default" # Get share metadata. # GET /shares/{share_id}/metadata # -# "share:get_share_metadata":"rule:default" - +"share:get_share_metadata": "rule:default or rule:reader" diff --git a/etc/neutron/policy.yaml b/etc/neutron/policy.yaml index bb91787..f23657d 100644 --- a/etc/neutron/policy.yaml +++ b/etc/neutron/policy.yaml @@ -33,43 +33,43 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" # "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s" # "admin_owner_or_network_owner": "rule:owner or rule:admin or rule:network_owner" # "admin_only": "rule:context_is_admin" -# "regular_user": "" +# "regular_user": "rule:admin or rule:member" "default": "rule:admin or rule:member" "create_subnet": "rule:admin or rule:network_owner" "create_subnet:segment_id": "rule:admin" "create_subnet:service_types": "rule:admin" -"get_subnet": "rule:admin or rule:member or rule:shared" -"get_subnet:segment_id": "rule:admin" +"get_subnet": "rule:admin or rule:member or rule:shared or rule:reader" +"get_subnet:segment_id": "rule:admin or rule:reader" "update_subnet": "rule:admin or rule:network_owner" "update_subnet:service_types": "rule:admin" "delete_subnet": "rule:admin or rule:network_owner" -"create_subnetpool": "" +"create_subnetpool": "rule:admin or rule:member" "create_subnetpool:shared": "rule:admin" "create_subnetpool:is_default": "rule:admin" -"get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools" +"get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader" "update_subnetpool": "rule:admin or rule:member" "update_subnetpool:is_default": "rule:admin" "delete_subnetpool": "rule:admin or rule:member" -"create_address_scope": "" +"create_address_scope": "rule:admin or rule:member" "create_address_scope:shared": "rule:admin" -"get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes" +"get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader" "update_address_scope": "rule:admin or rule:member" "update_address_scope:shared": "rule:admin" "delete_address_scope": "rule:admin or rule:member" -"create_network": "" -"get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc" -"get_network:router:external": "rule:admin or rule:member" -"get_network:segments": "rule:admin" -"get_network:provider:network_type": "rule:admin" -"get_network:provider:physical_network": "rule:admin" -"get_network:provider:segmentation_id": "rule:admin" -"get_network:queue_id": "rule:admin" -"get_network_ip_availabilities": "rule:admin" -"get_network_ip_availability": "rule:admin" +"create_network": "rule:admin or rule:member" +"get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader" +"get_network:router:external": "rule:admin or rule:member or rule:reader" +"get_network:segments": "rule:admin or rule:reader" +"get_network:provider:network_type": "rule:admin or rule:reader" +"get_network:provider:physical_network": "rule:admin or rule:reader" +"get_network:provider:segmentation_id": "rule:admin or rule:reader" +"get_network:queue_id": "rule:admin or rule:reader" +"get_network_ip_availabilities": "rule:admin or rule:reader" +"get_network_ip_availability": "rule:admin or rule:reader" "create_network:shared": "rule:admin" "create_network:router:external": "rule:admin" "create_network:is_default": "rule:admin" @@ -87,12 +87,12 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" "delete_network": "rule:admin or rule:member" "create_segment": "rule:admin" -"get_segment": "rule:admin" +"get_segment": "rule:admin or rule:reader" "update_segment": "rule:admin" "delete_segment": "rule:admin" "network_device": "field:port:device_owner=~^network:" -"create_port": "" +"create_port": "rule:admin or rule:member" "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" "create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" @@ -102,12 +102,12 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" "create_port:binding:profile": "rule:admin" "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" "create_port:allowed_address_pairs": "rule:admin or rule:network_owner" -"get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" -"get_port:queue_id": "rule:admin" -"get_port:binding:vif_type": "rule:admin" -"get_port:binding:vif_details": "rule:admin" -"get_port:binding:host_id": "rule:admin" -"get_port:binding:profile": "rule:admin" +"get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader" +"get_port:queue_id": "rule:admin or rule:reader" +"get_port:binding:vif_type": "rule:admin or rule:reader" +"get_port:binding:vif_details": "rule:admin or rule:reader" +"get_port:binding:host_id": "rule:admin or rule:reader" +"get_port:binding:profile": "rule:admin or rule:reader" "update_port": "rule:admin or rule:member or rule:context_is_advsvc" "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" "update_port:mac_address": "rule:admin or rule:context_is_advsvc" @@ -121,13 +121,13 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" "update_port:data_plane_status": "rule:admin_or_data_plane_int" "delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" -"get_router:ha": "rule:admin" +"get_router:ha": "rule:admin or rule:reader" "create_router": "rule:admin or rule:member" "create_router:external_gateway_info:enable_snat": "rule:admin" "create_router:distributed": "rule:admin" "create_router:ha": "rule:admin" -"get_router": "rule:admin or rule:member" -"get_router:distributed": "rule:admin" +"get_router": "rule:admin or rule:member or rule:reader" +"get_router:distributed": "rule:admin or rule:reader" "update_router": "rule:admin or rule:member" "update_router:external_gateway_info": "rule:admin or rule:member" "update_router:external_gateway_info:network_id": "rule:admin or rule:member" @@ -143,114 +143,114 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" "update_router:external_gateway_info:external_fixed_ips": "rule:admin" "create_qos_queue": "rule:admin" -"get_qos_queue": "rule:admin" +"get_qos_queue": "rule:admin or rule:reader" "update_agent": "rule:admin" "delete_agent": "rule:admin" -"get_agent": "rule:admin" +"get_agent": "rule:admin or rule:reader" "create_dhcp-network": "rule:admin" "delete_dhcp-network": "rule:admin" -"get_dhcp-networks": "rule:admin" +"get_dhcp-networks": "rule:admin or rule:reader" "create_l3-router": "rule:admin" "delete_l3-router": "rule:admin" -"get_l3-routers": "rule:admin" -"get_dhcp-agents": "rule:admin" -"get_l3-agents": "rule:admin" -"get_loadbalancer-agent": "rule:admin" -"get_loadbalancer-pools": "rule:admin" -"get_agent-loadbalancers": "rule:admin" -"get_loadbalancer-hosting-agent": "rule:admin" +"get_l3-routers": "rule:admin or rule:reader" +"get_dhcp-agents": "rule:admin or rule:reader" +"get_l3-agents": "rule:admin or rule:reader" +"get_loadbalancer-agent": "rule:admin or rule:reader" +"get_loadbalancer-pools": "rule:admin or rule:reader" +"get_agent-loadbalancers": "rule:admin or rule:reader" +"get_loadbalancer-hosting-agent": "rule:admin or rule:reader" "create_floatingip": "rule:admin or rule:member" "create_floatingip:floating_ip_address": "rule:admin" "update_floatingip": "rule:admin or rule:member" "delete_floatingip": "rule:admin or rule:member" -"get_floatingip": "rule:admin or rule:member" +"get_floatingip": "rule:admin or rule:member or rule:reader" "create_network_profile": "rule:admin" "update_network_profile": "rule:admin" "delete_network_profile": "rule:admin" -"get_network_profiles": "" -"get_network_profile": "" +"get_network_profiles": "rule:admin or rule:member or rule:reader" +"get_network_profile": "rule:admin or rule:member or rule:reader" "update_policy_profiles": "rule:admin" -"get_policy_profiles": "" -"get_policy_profile": "" +"get_policy_profiles": "rule:admin or rule:member or rule:reader" +"get_policy_profile": "rule:admin or rule:member or rule:reader" "create_metering_label": "rule:admin" "delete_metering_label": "rule:admin" -"get_metering_label": "rule:admin" +"get_metering_label": "rule:admin or rule:reader" "create_metering_label_rule": "rule:admin" "delete_metering_label_rule": "rule:admin" -"get_metering_label_rule": "rule:admin" +"get_metering_label_rule": "rule:admin or rule:reader" -"get_service_provider": "rule:admin or rule:member" -"get_lsn": "rule:admin" +"get_service_provider": "rule:admin or rule:member or rule:reader" +"get_lsn": "rule:admin or rule:reader" "create_lsn": "rule:admin" "create_flavor": "rule:admin" "update_flavor": "rule:admin" "delete_flavor": "rule:admin" -"get_flavors": "rule:admin or rule:member" -"get_flavor": "rule:admin or rule:member" +"get_flavors": "rule:admin or rule:member or rule:reader" +"get_flavor": "rule:admin or rule:member or rule:reader" "create_service_profile": "rule:admin" "update_service_profile": "rule:admin" "delete_service_profile": "rule:admin" -"get_service_profiles": "rule:admin" -"get_service_profile": "rule:admin" +"get_service_profiles": "rule:admin or rule:reader" +"get_service_profile": "rule:admin or rule:reader" -"get_policy": "rule:admin or rule:member" +"get_policy": "rule:admin or rule:member or rule:reader" "create_policy": "rule:admin" "update_policy": "rule:admin" "delete_policy": "rule:admin" -"get_policy_bandwidth_limit_rule": "rule:admin or rule:member" +"get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader" "create_policy_bandwidth_limit_rule": "rule:admin" "delete_policy_bandwidth_limit_rule": "rule:admin" "update_policy_bandwidth_limit_rule": "rule:admin" -"get_policy_dscp_marking_rule": "rule:admin or rule:member" +"get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader" "create_policy_dscp_marking_rule": "rule:admin" "delete_policy_dscp_marking_rule": "rule:admin" "update_policy_dscp_marking_rule": "rule:admin" -"get_rule_type": "rule:admin or rule:member" -"get_policy_minimum_bandwidth_rule": "rule:admin or rule:member" +"get_rule_type": "rule:admin or rule:member or rule:reader" +"get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader" "create_policy_minimum_bandwidth_rule": "rule:admin" "delete_policy_minimum_bandwidth_rule": "rule:admin" "update_policy_minimum_bandwidth_rule": "rule:admin" "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin" -"create_rbac_policy": "" +"create_rbac_policy": "rule:admin or rule:member" "create_rbac_policy:target_tenant": "rule:restrict_wildcard" "update_rbac_policy": "rule:admin or rule:member" "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member" -"get_rbac_policy": "rule:admin or rule:member" +"get_rbac_policy": "rule:admin or rule:member or rule:reader" "delete_rbac_policy": "rule:admin or rule:member" "create_flavor_service_profile": "rule:admin" "delete_flavor_service_profile": "rule:admin" -"get_flavor_service_profile": "rule:admin or rule:member" -"get_auto_allocated_topology": "rule:admin or rule:member" +"get_flavor_service_profile": "rule:admin or rule:member or rule:reader" +"get_auto_allocated_topology": "rule:admin or rule:member or rule:reader" "create_trunk": "rule:admin or rule:member" -"get_trunk": "rule:admin or rule:member" +"get_trunk": "rule:admin or rule:member or rule:reader" "delete_trunk": "rule:admin or rule:member" -"get_subports": "" +"get_subports": "rule:admin or rule:member or rule:reader" "add_subports": "rule:admin or rule:member" "remove_subports": "rule:admin or rule:member" -"get_security_groups": "rule:admin or rule:member" -"get_security_group": "rule:admin or rule:member" +"get_security_groups": "rule:admin or rule:member or rule:reader" +"get_security_group": "rule:admin or rule:member or rule:reader" "create_security_group": "rule:admin or rule:member" "update_security_group": "rule:admin or rule:member" "delete_security_group": "rule:admin or rule:member" -"get_security_group_rules": "rule:admin or rule:member" -"get_security_group_rule": "rule:admin or rule:member" +"get_security_group_rules": "rule:admin or rule:member or rule:reader" +"get_security_group_rule": "rule:admin or rule:member or rule:reader" "create_security_group_rule": "rule:admin or rule:member" "delete_security_group_rule": "rule:admin or rule:member" -"get_loggable_resources": "rule:admin" +"get_loggable_resources": "rule:admin or rule:reader" "create_log": "rule:admin" "update_log": "rule:admin" "delete_log": "rule:admin" -"get_logs": "rule:admin" -"get_log": "rule:admin" +"get_logs": "rule:admin or rule:reader" +"get_log": "rule:admin or rule:reader" From e98aa28a1aa08fd5776579c8a27b2f8fc6145e6c Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:44:48 +0000 Subject: [PATCH 11/26] Incremental update Change-Id: Ib83eb22b42f09dbd182b12662e54930555954aee --- diff --git a/etc/aodh/policy.yaml b/etc/aodh/policy.yaml index ca325ce..eeb4d55 100644 --- a/etc/aodh/policy.yaml +++ b/etc/aodh/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/cinder/policy.yaml b/etc/cinder/policy.yaml index 137a510..b7812e8 100644 --- a/etc/cinder/policy.yaml +++ b/etc/cinder/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/glance/policy.yaml b/etc/glance/policy.yaml index 642bb7c..c9167c8 100644 --- a/etc/glance/policy.yaml +++ b/etc/glance/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/gnocchi/policy.yaml b/etc/gnocchi/policy.yaml index 2f30ea1..22a0fc3 100644 --- a/etc/gnocchi/policy.yaml +++ b/etc/gnocchi/policy.yaml @@ -7,7 +7,7 @@ reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" # For gnocchi, this also adds a check to who created the resource -_member_role: "(role:member or role:_member_ or user:%(creator)s)" +_member_role: "(role:Member or role:member or role:_member_ or user:%(creator)s)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/heat/policy.yaml b/etc/heat/policy.yaml index dfcc9c5..4c20394 100644 --- a/etc/heat/policy.yaml +++ b/etc/heat/policy.yaml @@ -9,7 +9,7 @@ global_reader: "(role:global_reader and rule:deny_stack_user)" reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) and rule:deny_stack_user)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/keystone/policy.yaml b/etc/keystone/policy.yaml index 68d2f21..5aba840 100644 --- a/etc/keystone/policy.yaml +++ b/etc/keystone/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/manila/policy.yaml b/etc/manila/policy.yaml index 1920745..fa5bee5 100644 --- a/etc/manila/policy.yaml +++ b/etc/manila/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/neutron/policy.json b/etc/neutron/policy.json new file mode 100644 index 0000000..e867e5a --- /dev/null +++ b/etc/neutron/policy.json @@ -0,0 +1,211 @@ +{ + "global_reader": "(role:global_reader)", + "reader": "((role:reader and project_id:%(project_id)s) or rule:global_reader)", + "_member_role": "(role:Member or role:member or role:_member_)", + "member": "(rule:_member_role and project_id:%(project_id)s)", + "admin": "(is_admin:True or role:admin)", + "owner": "(rule:_member_role and user_id:%(user_id)s)", + "context_is_advsvc": "role:advsvc", + "network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)", + "admin_or_data_plane_int": "rule:admin or role:data_plane_integrator", + "shared": "field:networks:shared=True", + "shared_subnetpools": "field:subnetpools:shared=True", + "shared_address_scopes": "field:address_scopes:shared=True", + "external": "field:networks:router:external=True", + "default": "rule:admin or rule:member", + "create_subnet": "rule:admin or rule:network_owner", + "create_subnet:segment_id": "rule:admin", + "create_subnet:service_types": "rule:admin", + "get_subnet": "rule:admin or rule:member or rule:shared or rule:reader", + "get_subnet:segment_id": "rule:admin or rule:reader", + "update_subnet": "rule:admin or rule:network_owner", + "update_subnet:service_types": "rule:admin", + "delete_subnet": "rule:admin or rule:network_owner", + "create_subnetpool": "rule:admin or rule:member", + "create_subnetpool:shared": "rule:admin", + "create_subnetpool:is_default": "rule:admin", + "get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader", + "update_subnetpool": "rule:admin or rule:member", + "update_subnetpool:is_default": "rule:admin", + "delete_subnetpool": "rule:admin or rule:member", + "create_address_scope": "rule:admin or rule:member", + "create_address_scope:shared": "rule:admin", + "get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader", + "update_address_scope": "rule:admin or rule:member", + "update_address_scope:shared": "rule:admin", + "delete_address_scope": "rule:admin or rule:member", + "create_network": "rule:admin or rule:member", + "get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader", + "get_network:router:external": "rule:admin or rule:member or rule:reader", + "get_network:segments": "rule:admin or rule:reader", + "get_network:provider:network_type": "rule:admin or rule:reader", + "get_network:provider:physical_network": "rule:admin or rule:reader", + "get_network:provider:segmentation_id": "rule:admin or rule:reader", + "get_network:queue_id": "rule:admin or rule:reader", + "get_network_ip_availabilities": "rule:admin or rule:reader", + "get_network_ip_availability": "rule:admin or rule:reader", + "create_network:shared": "rule:admin", + "create_network:router:external": "rule:admin", + "create_network:is_default": "rule:admin", + "create_network:segments": "rule:admin", + "create_network:provider:network_type": "rule:admin", + "create_network:provider:physical_network": "rule:admin", + "create_network:provider:segmentation_id": "rule:admin", + "update_network": "rule:admin or rule:member", + "update_network:segments": "rule:admin", + "update_network:shared": "rule:admin", + "update_network:provider:network_type": "rule:admin", + "update_network:provider:physical_network": "rule:admin", + "update_network:provider:segmentation_id": "rule:admin", + "update_network:router:external": "rule:admin", + "delete_network": "rule:admin or rule:member", + "create_segment": "rule:admin", + "get_segment": "rule:admin or rule:reader", + "update_segment": "rule:admin", + "delete_segment": "rule:admin", + "network_device": "field:port:device_owner=~^network:", + "create_port": "rule:admin or rule:member", + "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", + "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:binding:host_id": "rule:admin", + "create_port:binding:profile": "rule:admin", + "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:allowed_address_pairs": "rule:admin or rule:network_owner", + "get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader", + "get_port:queue_id": "rule:admin or rule:reader", + "get_port:binding:vif_type": "rule:admin or rule:reader", + "get_port:binding:vif_details": "rule:admin or rule:reader", + "get_port:binding:host_id": "rule:admin or rule:reader", + "get_port:binding:profile": "rule:admin or rule:reader", + "update_port": "rule:admin or rule:member or rule:context_is_advsvc", + "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:mac_address": "rule:admin or rule:context_is_advsvc", + "update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", + "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:binding:host_id": "rule:admin", + "update_port:binding:profile": "rule:admin", + "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:allowed_address_pairs": "rule:admin or rule:network_owner", + "update_port:data_plane_status": "rule:admin_or_data_plane_int", + "delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner", + "get_router:ha": "rule:admin or rule:reader", + "create_router": "rule:admin or rule:member", + "create_router:external_gateway_info:enable_snat": "rule:admin", + "create_router:distributed": "rule:admin", + "create_router:ha": "rule:admin", + "get_router": "rule:admin or rule:member or rule:reader", + "get_router:distributed": "rule:admin or rule:reader", + "update_router": "rule:admin or rule:member", + "update_router:external_gateway_info": "rule:admin or rule:member", + "update_router:external_gateway_info:network_id": "rule:admin or rule:member", + "update_router:external_gateway_info:enable_snat": "rule:admin", + "update_router:distributed": "rule:admin", + "update_router:ha": "rule:admin", + "delete_router": "rule:admin or rule:member", + "add_router_interface": "rule:admin or rule:member", + "remove_router_interface": "rule:admin or rule:member", + "create_router:external_gateway_info:external_fixed_ips": "rule:admin", + "update_router:external_gateway_info:external_fixed_ips": "rule:admin", + "create_qos_queue": "rule:admin", + "get_qos_queue": "rule:admin or rule:reader", + "update_agent": "rule:admin", + "delete_agent": "rule:admin", + "get_agent": "rule:admin or rule:reader", + "create_dhcp-network": "rule:admin", + "delete_dhcp-network": "rule:admin", + "get_dhcp-networks": "rule:admin or rule:reader", + "create_l3-router": "rule:admin", + "delete_l3-router": "rule:admin", + "get_l3-routers": "rule:admin or rule:reader", + "get_dhcp-agents": "rule:admin or rule:reader", + "get_l3-agents": "rule:admin or rule:reader", + "get_loadbalancer-agent": "rule:admin or rule:reader", + "get_loadbalancer-pools": "rule:admin or rule:reader", + "get_agent-loadbalancers": "rule:admin or rule:reader", + "get_loadbalancer-hosting-agent": "rule:admin or rule:reader", + "create_floatingip": "rule:admin or rule:member", + "create_floatingip:floating_ip_address": "rule:admin", + "update_floatingip": "rule:admin or rule:member", + "delete_floatingip": "rule:admin or rule:member", + "get_floatingip": "rule:admin or rule:member or rule:reader", + "create_network_profile": "rule:admin", + "update_network_profile": "rule:admin", + "delete_network_profile": "rule:admin", + "get_network_profiles": "rule:admin or rule:member or rule:reader", + "get_network_profile": "rule:admin or rule:member or rule:reader", + "update_policy_profiles": "rule:admin", + "get_policy_profiles": "rule:admin or rule:member or rule:reader", + "get_policy_profile": "rule:admin or rule:member or rule:reader", + "create_metering_label": "rule:admin", + "delete_metering_label": "rule:admin", + "get_metering_label": "rule:admin or rule:reader", + "create_metering_label_rule": "rule:admin", + "delete_metering_label_rule": "rule:admin", + "get_metering_label_rule": "rule:admin or rule:reader", + "get_service_provider": "rule:admin or rule:member or rule:reader", + "get_lsn": "rule:admin or rule:reader", + "create_lsn": "rule:admin", + "create_flavor": "rule:admin", + "update_flavor": "rule:admin", + "delete_flavor": "rule:admin", + "get_flavors": "rule:admin or rule:member or rule:reader", + "get_flavor": "rule:admin or rule:member or rule:reader", + "create_service_profile": "rule:admin", + "update_service_profile": "rule:admin", + "delete_service_profile": "rule:admin", + "get_service_profiles": "rule:admin or rule:reader", + "get_service_profile": "rule:admin or rule:reader", + "get_policy": "rule:admin or rule:member or rule:reader", + "create_policy": "rule:admin", + "update_policy": "rule:admin", + "delete_policy": "rule:admin", + "get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader", + "create_policy_bandwidth_limit_rule": "rule:admin", + "delete_policy_bandwidth_limit_rule": "rule:admin", + "update_policy_bandwidth_limit_rule": "rule:admin", + "get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader", + "create_policy_dscp_marking_rule": "rule:admin", + "delete_policy_dscp_marking_rule": "rule:admin", + "update_policy_dscp_marking_rule": "rule:admin", + "get_rule_type": "rule:admin or rule:member or rule:reader", + "get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader", + "create_policy_minimum_bandwidth_rule": "rule:admin", + "delete_policy_minimum_bandwidth_rule": "rule:admin", + "update_policy_minimum_bandwidth_rule": "rule:admin", + "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin", + "create_rbac_policy": "rule:admin or rule:member", + "create_rbac_policy:target_tenant": "rule:restrict_wildcard", + "update_rbac_policy": "rule:admin or rule:member", + "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member", + "get_rbac_policy": "rule:admin or rule:member or rule:reader", + "delete_rbac_policy": "rule:admin or rule:member", + "create_flavor_service_profile": "rule:admin", + "delete_flavor_service_profile": "rule:admin", + "get_flavor_service_profile": "rule:admin or rule:member or rule:reader", + "get_auto_allocated_topology": "rule:admin or rule:member or rule:reader", + "create_trunk": "rule:admin or rule:member", + "get_trunk": "rule:admin or rule:member or rule:reader", + "delete_trunk": "rule:admin or rule:member", + "get_subports": "rule:admin or rule:member or rule:reader", + "add_subports": "rule:admin or rule:member", + "remove_subports": "rule:admin or rule:member", + "get_security_groups": "rule:admin or rule:member or rule:reader", + "get_security_group": "rule:admin or rule:member or rule:reader", + "create_security_group": "rule:admin or rule:member", + "update_security_group": "rule:admin or rule:member", + "delete_security_group": "rule:admin or rule:member", + "get_security_group_rules": "rule:admin or rule:member or rule:reader", + "get_security_group_rule": "rule:admin or rule:member or rule:reader", + "create_security_group_rule": "rule:admin or rule:member", + "delete_security_group_rule": "rule:admin or rule:member", + "get_loggable_resources": "rule:admin or rule:reader", + "create_log": "rule:admin", + "update_log": "rule:admin", + "delete_log": "rule:admin", + "get_logs": "rule:admin or rule:reader", + "get_log": "rule:admin or rule:reader" +} diff --git a/etc/neutron/policy.yaml b/etc/neutron/policy.yaml index f23657d..604ab95 100644 --- a/etc/neutron/policy.yaml +++ b/etc/neutron/policy.yaml @@ -1,3 +1,5 @@ +# FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON + # A global reader role, that is able to read things that don't have a project_id associated global_reader: "(role:global_reader)" @@ -6,7 +8,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/nova/policy.yaml b/etc/nova/policy.yaml index 8943e60..d83de2f 100644 --- a/etc/nova/policy.yaml +++ b/etc/nova/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud diff --git a/etc/panko/policy.yaml b/etc/panko/policy.yaml index 737291d..73c4a89 100644 --- a/etc/panko/policy.yaml +++ b/etc/panko/policy.yaml @@ -6,7 +6,7 @@ global_reader: "(role:global_reader)" reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:member or role:_member_)" +_member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud From c915c58fc7c974e38b7bb387d96043cad09404e2 Mon Sep 17 00:00:00 2001 From: Sean Pryor Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 12/26] Added test results to branch Change-Id: Ia242894e65c3917ab5483558a17b2e1ef8a282e1 --- diff --git a/patrole-base.log b/patrole-base.log new file mode 100644 index 0000000..0063427 --- /dev/null +++ b/patrole-base.log @@ -0,0 +1,2294 @@ +{"role": "admin", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} diff --git a/patrole-new.log b/patrole-new.log new file mode 100644 index 0000000..0063427 --- /dev/null +++ b/patrole-new.log @@ -0,0 +1,2294 @@ +{"role": "admin", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "admin", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "admin", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "Member", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "Member", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_flavor_manage", "rules": "os_compute_api:os-flavor-manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_limits", "rules": "os_compute_api:limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_get_availability_zone_list_detail_rbac", "rules": "os_compute_api:os-availability-zone:detail", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_add_host_to_aggregate_rbac", "rules": "os_compute_api:os-aggregates:add_host", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_get_availability_zone_list_rbac", "rules": "os_compute_api:os-availability-zone:list", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_create_aggregate_rbac", "rules": "os_compute_api:os-aggregates:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_flavor_manage", "rules": "os_compute_api:os-flavor-manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_agents_rbac", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_aggregate_rbac", "rules": "os_compute_api:os-aggregates:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_update_agent", "rules": "os_compute_api:os-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_aggregate_rbac", "rules": "os_compute_api:os-aggregates:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_add_flavor_access", "rules": "os_compute_api:os-flavor-access:add_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ips_bulk", "rules": "os_compute_api:os-floating-ips-bulk", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ips", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_remove_host_from_aggregate_rbac", "rules": "os_compute_api:os-aggregates:remove_host", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavor_access", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_floating_ip_pools", "rules": "os_compute_api:os-floating-ip-pools", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavors_details_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_set_metadata_on_aggregate_rbac", "rules": "os_compute_api:os-aggregates:set_metadata", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_floating_ip", "rules": "os_compute_api:os-floating-ips", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_quota_class_set", "rules": "os_compute_api:os-quota-class-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_remove_flavor_access", "rules": "os_compute_api:os-flavor-access:remove_tenant_access", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_aggregate_rbac", "rules": "os_compute_api:os-aggregates:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_instance_usage_audit_logs", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_flavor_contains_is_public_key", "rules": "os_compute_api:os-flavor-access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_aggregate_rbac", "rules": "os_compute_api:os-aggregates:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_instance_usage_audit_log", "rules": "os_compute_api:os-instance-usage-audit-log", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_hosts", "rules": "os_compute_api:os-hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_hypervisors", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_flavor_extra_specs", "rules": "os_compute_api:os-flavor-extra-specs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-migrations:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_images", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_hypervisors_with_details", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_set_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_images_with_details", "rules": "os_compute_api:image-size", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_servers_on_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_search_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_unset_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_keypair", "rules": "os_compute_api:os-keypairs:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_update_flavor_extra_spec", "rules": "os_compute_api:os-flavor-extra-specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_keypair", "rules": "os_compute_api:os-keypairs:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor_statistics", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_index_keypair", "rules": "os_compute_api:os-keypairs:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_hypervisor_uptime", "rules": "os_compute_api:os-hypervisors", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_get_flavor_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_keypair", "rules": "os_compute_api:os-keypairs:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_flavors_details_rxtx", "rules": "os_compute_api:os-flavor-rxtx", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_quota_set", "rules": "os_compute_api:os-quota-sets:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_default_quota_set", "rules": "os_compute_api:os-quota-sets:defaults", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_set", "rules": "os_compute_api:os-quota-sets:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_image_metadata", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_quota_set_details", "rules": "os_compute_api:os-quota-sets:detail", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_quota_set", "rules": "os_compute_api:os-quota-sets:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_images_with_details", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_details", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_create_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_metadata_item", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image_metadata", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image_metadata_item", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_show_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_update_security_groups", "rules": "os_compute_api:os-security-groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_show_tenant_networks", "rules": "os_compute_api:os-tenant-networks", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_domain_config", "rules": "identity:create_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_group_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain_group_option_config", "rules": "identity:delete_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_config_settings", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_group_config", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_default_group_option", "rules": "identity:get_domain_config_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_group_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain_group_option_config", "rules": "identity:get_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_security_compliance_domain_config", "rules": "identity:get_security_compliance_domain_config", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_group_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain_group_option_config", "rules": "identity:update_domain_config", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_authorize_request_token", "rules": "identity:authorize_request_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_get_access_token", "rules": "identity:get_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_get_access_token_role", "rules": "identity:get_access_token_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_access_token_roles", "rules": "identity:list_access_token_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_access_tokens", "rules": "identity:list_access_tokens", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_revoke_access_token", "rules": "identity:delete_access_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_from_group_on_domain_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_from_group_on_project_existence", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_role_inference_rule", "rules": "identity:check_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_role_existence_on_domain", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_role_existence_on_project", "rules": "identity:check_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_group_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_group_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_role", "rules": "identity:create_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_role_inference_rule", "rules": "identity:create_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_user_role_on_domain", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_user_role_on_project", "rules": "identity:create_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role", "rules": "identity:delete_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_group_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_group_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_user_on_domain", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_from_user_on_project", "rules": "identity:revoke_grant", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_role_inference_rule", "rules": "identity:delete_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_all_role_inference_rules", "rules": "identity:list_role_inference_rules", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_group_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_group_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_inferences_rules", "rules": "identity:list_implied_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_roles", "rules": "identity:list_roles", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_user_roles_on_domain", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_user_roles_on_project", "rules": "identity:list_grants", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_role", "rules": "identity:get_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_role_inference_rule", "rules": "identity:get_implied_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_role", "rules": "identity:update_role", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_domain", "rules": "identity:create_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_domain", "rules": "identity:delete_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_service", "rules": "identity:create_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_domains", "rules": "identity:list_domains", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_service", "rules": "identity:delete_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_domain", "rules": "identity:get_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_services", "rules": "identity:list_services", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_domain", "rules": "identity:update_domain", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_service", "rules": "identity:get_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_service", "rules": "identity:update_service", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_server_group", "rules": "os_compute_api:os-server-groups:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_consumer", "rules": "identity:create_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_server_group", "rules": "os_compute_api:os-server-groups:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_consumer", "rules": "identity:delete_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_metadef_namespace", "rules": "add_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_server_groups", "rules": "os_compute_api:os-server-groups:index", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_consumers", "rules": "identity:list_consumers", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_namespaces", "rules": "get_metadef_namespaces", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_consumer", "rules": "identity:get_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_server_group", "rules": "os_compute_api:os-server-groups:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_modify_metadef_namespace", "rules": "modify_metadef_namespace", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_consumer", "rules": "identity:update_consumer", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_add_metadef_resource_type", "rules": "add_metadef_resource_type_association", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_create", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_get_metadef_resource_type", "rules": "get_metadef_resource_type", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_delete", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_resource_types", "rules": "list_metadef_resource_types", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_list", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_show", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_add_image_member", "rules": "add_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_group_type_specs_update", "rules": "group:group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_delete_image_member", "rules": "delete_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_image_members", "rules": "get_members", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image_member", "rules": "get_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_reset_group_status", "rules": "group:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_update_image_member", "rules": "modify_member", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_agent", "rules": "get_agent", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_manage_snapshot_rbac", "rules": "snapshot_extension:snapshot_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_agent", "rules": "update_agent", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_unmanage_snapshot_rbac", "rules": "snapshot_extension:snapshot_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_summary", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_floating_ip", "rules": "create_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_floating_ip_floatingip_address", "rules": "create_floatingip:floating_ip_address", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_add_type_access", "rules": "volume_extension:volume_type_access:addProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_type_access", "rules": "volume_extension:volume_type_access", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_floating_ip", "rules": "delete_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_remove_type_access", "rules": "volume_extension:volume_type_access:removeProjectAccess", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_floating_ip", "rules": "get_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_floating_ip", "rules": "update_floatingip", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_manage", "rules": "volume_extension:volume_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_unmanage", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network", "rules": "create_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_network_provider_network_type", "rules": "create_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_provider_segmentation_id", "rules": "create_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_router_external", "rules": "create_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_network_shared", "rules": "create_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_network", "rules": "delete_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_dhcp_agents_on_hosting_network", "rules": "get_dhcp-agents", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network", "rules": "get_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_network_type", "rules": "get_network:provider:network_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_physical_network", "rules": "get_network:provider:physical_network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_provider_segmentation_id", "rules": "get_network:provider:segmentation_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_network_router_external", "rules": "get_network:router:external", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network", "rules": "update_network", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network_router_external", "rules": "update_network:router:external", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_network_shared", "rules": "update_network:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_subnet", "rules": "create_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnet", "rules": "delete_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_list_services", "rules": "os_compute_api:os-services", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_list_subnets", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnet", "rules": "get_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_check_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_subnet", "rules": "update_subnet", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_endpoint_group", "rules": "identity:create_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_endpoint_group", "rules": "identity:delete_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoint_groups", "rules": "identity:list_endpoint_groups", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_endpoint_group", "rules": "identity:get_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group", "rules": "group:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_endpoint_group", "rules": "identity:update_endpoint_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_group", "rules": "group:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_policy", "rules": "identity:create_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_groups", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_policy", "rules": "identity:delete_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_groups_with_details", "rules": "group:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_policies", "rules": "identity:list_policies", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_policy", "rules": "identity:get_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_group", "rules": "group:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_policy", "rules": "identity:update_policy", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_group", "rules": "group:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_user", "rules": "identity:create_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_user", "rules": "identity:delete_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_own_user_group", "rules": "identity:list_groups_for_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_own_user_projects", "rules": "identity:list_user_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_snapshot_metadata", "rules": "volume_extension:extended_snapshot_attributes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_users", "rules": "identity:list_users", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_snapshot_metadata_item", "rules": "volume:delete_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_own_user", "rules": "identity:get_user", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_get_snapshot_metadata", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_user", "rules": "identity:update_user", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_snapshot_metadata_for_volume_tenant", "rules": "volume_extension:volume_tenant_attribute", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_snapshot_metadata_item", "rules": "volume:get_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_metadef_object_in_namespace", "rules": "add_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_metadata", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_metadef_objects_in_namespace", "rules": "get_metadef_objects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_metadata_item", "rules": "volume:update_snapshot_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_metadef_object_in_namespace", "rules": "get_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_metadef_object_in_namespace", "rules": "modify_metadef_object", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_namespace_tag", "rules": "add_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_upload_public", "rules": "volume_extension:volume_actions:upload_public", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_namespace_tags", "rules": "add_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_list_namespace_tags", "rules": "get_metadef_tags", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_namespace_tag", "rules": "get_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_namespace_tag", "rules": "modify_metadef_tag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_on_l3_agent", "rules": "create_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_router_from_l3_agent", "rules": "delete_l3-router", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_list_routers_on_l3_agent", "rules": "get_l3-routers", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_subnetpool", "rules": "create_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_subnetpool_shared", "rules": "create_subnetpool:shared", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_subnetpool", "rules": "delete_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_subnetpool", "rules": "get_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_subnetpool", "rules": "update_subnetpool", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_subnetpool_is_default", "rules": "update_subnetpool:is_default", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type_encryption", "rules": "volume_extension:volume_type_encryption", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_unmanage_volume", "rules": "volume_extension:volume_unmanage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_group_type_group_specs", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_force_delete", "rules": "volume_extension:volume_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_readonly_update", "rules": "volume:update_readonly_flag", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_group_type", "rules": "group:access_group_types_specs", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_region", "rules": "identity:create_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_reserve", "rules": "volume_extension:volume_actions:reserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_group_type", "rules": "group:group_types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_region", "rules": "identity:delete_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_reset_status", "rules": "volume_extension:volume_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_regions", "rules": "identity:list_regions", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_region", "rules": "identity:get_region", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_hosts", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_retype", "rules": "volume:retype", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_update_region", "rules": "identity:update_region", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_host", "rules": "volume_extension:hosts", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_set_bootable", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_unreserve", "rules": "volume_extension:volume_actions:unreserve", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_check_token_existence_negative", "rules": "identity:check_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_metadata", "rules": "volume:create_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_token_negative", "rules": "identity:revoke_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_upload", "rules": "volume_extension:volume_actions:upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_token_negative", "rules": "identity:validate_token", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_metadata_item", "rules": "volume:delete_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_metadata", "rules": "volume:get_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_add_md_properties", "rules": "add_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_get_md_properties", "rules": "get_metadef_properties", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_metadata", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_get_md_property", "rules": "get_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_metadata_item", "rules": "volume:update_volume_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_modify_md_properties", "rules": "modify_metadef_property", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_service_providers", "rules": "get_service_provider", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_quota_class_set", "rules": "volume_extension:quota_classes", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_message", "rules": "message:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_messages", "rules": "message:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_message", "rules": "message:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_endpoint", "rules": "identity:create_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_endpoint", "rules": "identity:delete_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoints", "rules": "identity:list_endpoints", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_endpoint", "rules": "identity:get_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_endpoint", "rules": "identity:update_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_create_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "nova", "test": "test_delete_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_add_user_group", "rules": "identity:add_user_to_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_user_group", "rules": "identity:check_user_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_delete_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_group", "rules": "identity:create_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_snapshots", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_delete_group", "rules": "identity:delete_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_list_volumes", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_groups", "rules": "identity:list_groups", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_snapshot", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_user_group", "rules": "identity:list_users_in_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "nova", "test": "test_show_volume", "rules": "os_compute_api:os-volumes", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_remove_user_group", "rules": "identity:remove_user_from_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_group", "rules": "identity:get_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_group", "rules": "identity:update_group", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_auth_domain", "rules": "identity:get_auth_domains", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_auth_projects", "rules": "identity:get_auth_projects", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_create_project", "rules": "identity:create_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_project", "rules": "identity:delete_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_credential", "rules": "identity:create_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_projects", "rules": "identity:list_projects", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_credential", "rules": "identity:delete_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_project", "rules": "identity:get_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_credentials", "rules": "identity:list_credentials", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_project", "rules": "identity:update_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_credential", "rules": "identity:get_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_update_credential", "rules": "identity:update_credential", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_assignments", "rules": "identity:list_role_assignments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_role_assignments_for_tree", "rules": "identity:list_role_assignments_for_tree", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_add_endpoint_to_project", "rules": "identity:add_endpoint_to_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_endpoint_in_project", "rules": "identity:check_endpoint_in_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_check_token_exsitence", "rules": "identity:check_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_endpoints_in_project", "rules": "identity:list_endpoints_for_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_token", "rules": "identity:revoke_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_projects_for_endpoint", "rules": "identity:list_projects_for_endpoint", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_token", "rules": "identity:validate_token", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_remove_endpoint_from_project", "rules": "identity:remove_endpoint_from_project", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_trust", "rules": "identity:create_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_add_dhcp_agent_to_network", "rules": "create_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_create_trust_negative", "rules": "identity:create_trust", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_delete_network_from_dhcp_agent", "rules": "delete_dhcp-network", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_delete_trust", "rules": "identity:delete_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_list_roles_for_trust", "rules": "identity:list_roles_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_networks_hosted_by_one_dhcp_agent", "rules": "get_dhcp-networks", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_list_trusts", "rules": "identity:list_trusts", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "keystone", "test": "test_show_trust", "rules": "identity:get_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_network_segments", "rules": "create_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "keystone", "test": "test_show_trust_role", "rules": "identity:get_role_for_trust", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_network_segments", "rules": "get_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_communitize_image", "rules": "communitize_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_network_segments", "rules": "update_network:segments", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_create_image", "rules": "add_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_create_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_deactivate_image", "rules": "deactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port", "rules": "create_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image", "rules": "delete_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_allowed_address_pairs", "rules": "create_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_delete_image_tag", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_binding_host_id", "rules": "create_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_download_image", "rules": "download_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_binding_profile", "rules": "create_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "glance", "test": "test_list_images", "rules": "get_images", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_publicize_image", "rules": "publicize_image", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_port_device_owner", "rules": "create_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_reactivate_image", "rules": "reactivate", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_fixed_ips_ip_address", "rules": "create_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_show_image", "rules": "get_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_update_image", "rules": "modify_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_mac_address", "rules": "create_port:mac_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "glance", "test": "test_upload_image", "rules": "upload_image", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_port_security_enabled", "rules": "create_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_port", "rules": "delete_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_port", "rules": "get_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_add_router_interface", "rules": "add_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_host_id", "rules": "get_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_profile", "rules": "get_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_distributed_router", "rules": "create_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_vif_details", "rules": "get_port:binding:vif_details", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_high_availability_router", "rules": "create_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_port_binding_vif_type", "rules": "get_port:binding:vif_type", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_router", "rules": "create_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_enable_snat", "rules": "create_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port", "rules": "update_port", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_router_external_fixed_ips", "rules": "create_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_allowed_address_pairs", "rules": "update_port:allowed_address_pairs", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_router", "rules": "delete_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_binding_host_id", "rules": "update_port:binding:host_id", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_binding_profile", "rules": "update_port:binding:profile", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_remove_router_interface", "rules": "remove_router_interface", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_device_owner", "rules": "update_port:device_owner", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_distributed_router", "rules": "get_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_fixed_ips_ip_address", "rules": "update_port:fixed_ips:ip_address", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_port_mac_address", "rules": "update_port:mac_address", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_show_high_availability_router", "rules": "get_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_port_security_enabled", "rules": "update_port:port_security_enabled", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_router", "rules": "get_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_distributed_router", "rules": "update_router:distributed", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_high_availability_router", "rules": "update_router:ha", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_router", "rules": "update_router", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_enable_snat", "rules": "update_router:external_gateway_info:enable_snat", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_fixed_ips", "rules": "update_router:external_gateway_info:external_fixed_ips", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_create_security_group", "rules": "create_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_gateway_info", "rules": "update_router:external_gateway_info", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_create_security_group_rule", "rules": "create_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_security_group", "rules": "delete_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_update_router_external_gateway_info_network_id", "rules": "update_router:external_gateway_info:network_id", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_delete_security_group_rule", "rules": "delete_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_security_group_rules", "rules": "get_security_group_rules", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_list_security_groups", "rules": "get_security_groups", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_security_group_rule", "rules": "get_security_group_rule", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "neutron", "test": "test_show_security_groups", "rules": "get_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_show_back_end_capabilities", "rules": "volume_extension:capabilities", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "neutron", "test": "test_update_security_group", "rules": "update_security_group", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_associate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_limits", "rules": "limits_extension:used_limits", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_qos_with_consumer", "rules": "volume_extension:qos_specs_manage:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_back_end_storage_pools", "rules": "scheduler_extension:scheduler_stats:get_pools", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_disassociate_all_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_disassociate_qos", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_association_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_create_volume", "rules": "volume:create", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_qos", "rules": "volume_extension:qos_specs_manage:get_all", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume", "rules": "volume:delete", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_set_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_qos", "rules": "volume_extension:qos_specs_manage:get", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_get_volume", "rules": "volume:get", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume", "rules": "volume:update", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_unset_qos_key", "rules": "volume_extension:qos_specs_manage:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_volume_list", "rules": "volume:get_all", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_list_image_metadata", "rules": "volume_extension:volume_image_metadata", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_reset_snapshot_status", "rules": "volume_extension:snapshot_admin_actions:reset_status", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_force_delete", "rules": "volume_extension:snapshot_admin_actions:force_delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_snapshot_status", "rules": "snapshot_extension:snapshot_actions:update_snapshot_status", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_accept_volume_transfer", "rules": "volume:accept_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_transfer", "rules": "volume:create_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_transfer", "rules": "volume:delete_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_get_volume_transfer", "rules": "volume:get_transfer", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_delete_quota_set", "rules": "volume_extension:quotas:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_transfers", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_default_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_transfers_details", "rules": "volume:get_all_transfers", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_quotas", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_list_quotas_usage_true", "rules": "volume_extension:quotas:show", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:create", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_quota_set", "rules": "volume_extension:quotas:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:delete", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_volume_types_extra_specs", "rules": "volume_extension:types_extra_specs:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_list_services", "rules": "volume_extension:services:index", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_show_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:show", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type_extra_specs", "rules": "volume_extension:types_extra_specs:update", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_create", "rules": "volume:create_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_create_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_delete_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_delete", "rules": "volume:delete_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_update_volume_type", "rules": "volume_extension:types_manage", "expected": "Denied", "actual": "Denied"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_get", "rules": "volume:get_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_snapshot_update", "rules": "volume:update_snapshot", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_snapshots_get_all", "rules": "volume:get_all_snapshots", "expected": "Allowed", "actual": "Allowed"} +{"role": "reader", "service": "cinder", "test": "test_volume_extend", "rules": "volume:extend", "expected": "Allowed", "actual": "Allowed"} From 9787fdb00407250d1a8d4f7c54a93c019fa546f9 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 13/26] build system for common header moved polices from src to service added common/common.yaml prepended to all services --- diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1ba70ed --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +build/* +*~ \ No newline at end of file diff --git a/build.sh b/build.sh new file mode 100755 index 0000000..40026c8 --- /dev/null +++ b/build.sh @@ -0,0 +1,10 @@ +#!/bin/sh + +mkdir -p build/etc + +for SUBDIR in $( ls services) +do + mkdir -p build/etc/$SUBDIR + cat common/common.yaml > build/etc/$SUBDIR/policy.yaml + cat services/$SUBDIR/policy.yaml >> build/etc/$SUBDIR/policy.yaml +done diff --git a/cleanup.sh b/cleanup.sh new file mode 100755 index 0000000..797b176 --- /dev/null +++ b/cleanup.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +rm -rf build/etc diff --git a/common/common.yaml b/common/common.yaml new file mode 100644 index 0000000..88f8ac6 --- /dev/null +++ b/common/common.yaml @@ -0,0 +1 @@ +# COMMON diff --git a/etc/aodh/policy.yaml b/etc/aodh/policy.yaml deleted file mode 100644 index eeb4d55..0000000 --- a/etc/aodh/policy.yaml +++ /dev/null @@ -1,62 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# RULES: - -# Get an alarm. -# GET /v2/alarms/{alarm_id} -"telemetry:get_alarm": "rule:admin or rule:member or rule:reader" - -# Get all alarms, based on the query provided. -# GET /v2/alarms -"telemetry:get_alarms": "rule:admin or rule:member or rule:reader" - -# Get all alarms, based on the query provided. -# POST /v2/query/alarms -"telemetry:query_alarm": "rule:admin or rule:member" - -# Create a new alarm. -# POST /v2/alarms -"telemetry:create_alarm": "rule:admin or rule:member" - -# Modify this alarm. -# PUT /v2/alarms/{alarm_id} -"telemetry:change_alarm": "rule:admin or rule:member" - -# Delete this alarm. -# DELETE /v2/alarms/{alarm_id} -"telemetry:delete_alarm": "rule:admin or rule:member" - -# Get the state of this alarm. -# GET /v2/alarms/{alarm_id}/state -"telemetry:get_alarm_state": "rule:admin or rule:member or rule:reader" - -# Set the state of this alarm. -# PUT /v2/alarms/{alarm_id}/state -"telemetry:change_alarm_state": "rule:admin or rule:member" - -# Assembles the alarm history requested. -# GET /v2/alarms/{alarm_id}/history -"telemetry:alarm_history": "rule:admin or rule:member or rule:reader" - -# Define query for retrieving AlarmChange data. -# POST /v2/query/alarms/history -"telemetry:query_alarm_history": "rule:admin or rule:member" diff --git a/etc/cinder/policy.yaml b/etc/cinder/policy.yaml deleted file mode 100644 index b7812e8..0000000 --- a/etc/cinder/policy.yaml +++ /dev/null @@ -1,623 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# Decides what is required for the 'is_admin:True' check to succeed. -# "context_is_admin": "role:admin" - -# RULES - - -# Create attachment. -# POST /attachments -"volume:attachment_create": "rule:admin or rule:member" - -# Update attachment. -# PUT /attachments/{attachment_id} -"volume:attachment_update": "rule:admin or rule:member" - -# Delete attachment. -# DELETE /attachments/{attachment_id} -"volume:attachment_delete": "rule:admin or rule:member" - -# Mark a volume attachment process as completed (in-use) -# POST /attachments/{attachment_id}/action (os-complete) -"volume:attachment_complete": "rule:admin or rule:member" - -# Allow multiattach of bootable volumes. -# POST /attachments -"volume:multiattach_bootable_volume": "rule:admin or rule:member" - -# List messages. -# GET /messages -"message:get_all": "rule:admin or rule:member or rule:reader" - -# Show message. -# GET /messages/{message_id} -"message:get": "rule:admin or rule:member or rule:reader" - -# Delete message. -# DELETE /messages/{message_id} -"message:delete": "rule:admin or rule:member" - -# List clusters. -# GET /clusters -# GET /clusters/detail -"clusters:get_all": "rule:admin or rule:reader" - -# Show cluster. -# GET /clusters/{cluster_id} -"clusters:get": "rule:admin or rule:reader" - -# Update cluster. -# PUT /clusters/{cluster_id} -"clusters:update": "rule:admin" - -# Clean up workers. -# POST /workers/cleanup -"workers:cleanup": "rule:admin" - -# Show snapshot's metadata or one specified metadata with a given key. -# GET /snapshots/{snapshot_id}/metadata -# GET /snapshots/{snapshot_id}/metadata/{key} -"volume:get_snapshot_metadata": "rule:admin or rule:member or rule:reader" - -# Update snapshot's metadata or one specified metadata with a given -# key. -# PUT /snapshots/{snapshot_id}/metadata -# PUT /snapshots/{snapshot_id}/metadata/{key} -"volume:update_snapshot_metadata": "rule:admin or rule:member" - -# Delete snapshot's specified metadata with a given key. -# DELETE /snapshots/{snapshot_id}/metadata/{key} -"volume:delete_snapshot_metadata": "rule:admin or rule:member" - -# List snapshots. -# GET /snapshots -# GET /snapshots/detail -"volume:get_all_snapshots": "rule:admin or rule:member or rule:reader" - -# List or show snapshots with extended attributes. -# GET /snapshots/{snapshot_id} -# GET /snapshots/detail -"volume_extension:extended_snapshot_attributes": "rule:admin or rule:member or rule:reader" - -# Create snapshot. -# POST /snapshots -"volume:create_snapshot": "rule:admin or rule:member" - -# Show snapshot. -# GET /snapshots/{snapshot_id} -"volume:get_snapshot": "rule:admin or rule:member or rule:reader" - -# Update snapshot. -# PUT /snapshots/{snapshot_id} -"volume:update_snapshot": "rule:admin or rule:member" - -# Delete snapshot. -# DELETE /snapshots/{snapshot_id} -"volume:delete_snapshot": "rule:admin or rule:member" - -# Reset status of a snapshot. -# POST /snapshots/{snapshot_id}/action (os-reset_status) -"volume_extension:snapshot_admin_actions:reset_status": "rule:admin" - -# Update database fields of snapshot. -# POST /snapshots/{snapshot_id}/action (update_snapshot_status) -"snapshot_extension:snapshot_actions:update_snapshot_status": "rule:admin or rule:member" - -# Force delete a snapshot. -# POST /snapshots/{snapshot_id}/action (os-force_delete) -"volume_extension:snapshot_admin_actions:force_delete": "rule:admin" - -# List (in detail) of snapshots which are available to manage. -# GET /manageable_snapshots -# GET /manageable_snapshots/detail -"snapshot_extension:list_manageable": "rule:admin or rule:reader" - -# Manage an existing snapshot. -# POST /manageable_snapshots -"snapshot_extension:snapshot_manage": "rule:admin" - -# Stop managing a snapshot. -# POST /snapshots/{snapshot_id}/action (os-unmanage) -"snapshot_extension:snapshot_unmanage": "rule:admin" - -# List backups. -# GET /backups -# GET /backups/detail -"backup:get_all": "rule:admin or rule:member or rule:reader" - -# List backups or show backup with project attributes. -# GET /backups/{backup_id} -# GET /backups/detail -"backup:backup_project_attribute": "rule:admin or rule:reader" - -# Create backup. -# POST /backups -"backup:create": "rule:admin or rule:member" - -# Show backup. -# GET /backups/{backup_id} -"backup:get": "rule:admin or rule:member or rule:reader" - -# Update backup. -# PUT /backups/{backup_id} -"backup:update": "rule:admin or rule:member" - -# Delete backup. -# DELETE /backups/{backup_id} -"backup:delete": "rule:admin or rule:member" - -# Restore backup. -# POST /backups/{backup_id}/restore -"backup:restore": "rule:admin or rule:member" - -# Import backup. -# POST /backups/{backup_id}/import_record -"backup:backup-import": "rule:admin" - -# Export backup. -# POST /backups/{backup_id}/export_record -"backup:export-import": "rule:admin" - -# Reset status of a backup. -# POST /backups/{backup_id}/action (os-reset_status) -"volume_extension:backup_admin_actions:reset_status": "rule:admin" - -# Force delete a backup. -# POST /backups/{backup_id}/action (os-force_delete) -"volume_extension:backup_admin_actions:force_delete": "rule:admin" - -# List groups. -# GET /groups -# GET /groups/detail -"group:get_all": "rule:admin or rule:member or rule:reader" - -# Create group. -# POST /groups -"group:create": "rule:admin or rule:member" - -# Show group. -# GET /groups/{group_id} -"group:get": "rule:admin or rule:member or rule:reader" - -# Update group. -# PUT /groups/{group_id} -"group:update": "rule:admin or rule:member" - -# Create, update or delete a group type. -# POST /group_types/ -# PUT /group_types/{group_type_id} -# DELETE /group_types/{group_type_id} -"group:group_types_manage": "rule:admin" - -# Show group type with type specs attributes. -# GET /group_types/{group_type_id} -"group:access_group_types_specs": "rule:admin or rule:reader" - -# Create, show, update and delete group type spec. -# GET /group_types/{group_type_id}/group_specs/{g_spec_id} -# GET /group_types/{group_type_id}/group_specs -# POST /group_types/{group_type_id}/group_specs -# PUT /group_types/{group_type_id}/group_specs/{g_spec_id} -# DELETE /group_types/{group_type_id}/group_specs/{g_spec_id} -"group:group_types_specs": "rule:admin" - -# List group snapshots. -# GET /group_snapshots -# GET /group_snapshots/detail -"group:get_all_group_snapshots": "rule:admin or rule:member or rule:reader" - -# Create group snapshot. -# POST /group_snapshots -"group:create_group_snapshot": "rule:admin or rule:member" - -# Show group snapshot. -# GET /group_snapshots/{group_snapshot_id} -"group:get_group_snapshot": "rule:admin or rule:member or rule:reader" - -# Delete group snapshot. -# DELETE /group_snapshots/{group_snapshot_id} -"group:delete_group_snapshot": "rule:admin or rule:member" - -# Update group snapshot. -# PUT /group_snapshots/{group_snapshot_id} -"group:update_group_snapshot": "rule:admin or rule:member or rule:reader" - -# Reset status of group snapshot. -# POST /group_snapshots/{g_snapshot_id}/action (reset_status) -"group:reset_group_snapshot_status": "rule:admin or rule:member" - -# Delete group. -# POST /groups/{group_id}/action (delete) -"group:delete": "rule:admin or rule:member" - -# Reset status of group. -# POST /groups/{group_id}/action (reset_status) -"group:reset_status": "rule:admin" - -# Enable replication. -# POST /groups/{group_id}/action (enable_replication) -"group:enable_replication": "rule:admin or rule:member" - -# Disable replication. -# POST /groups/{group_id}/action (disable_replication) -"group:disable_replication": "rule:admin or rule:member" - -# Fail over replication. -# POST /groups/{group_id}/action (failover_replication) -"group:failover_replication": "rule:admin or rule:member" - -# List failover replication. -# POST /groups/{group_id}/action (list_replication_targets) -"group:list_replication_targets": "rule:admin or rule:member" - -# List qos specs or list all associations. -# GET /qos-specs -# GET /qos-specs/{qos_id}/associations -"volume_extension:qos_specs_manage:get_all": "rule:admin or rule:reader" - -# Show qos specs. -# GET /qos-specs/{qos_id} -"volume_extension:qos_specs_manage:get": "rule:admin or rule:reader" - -# Create qos specs. -# POST /qos-specs -"volume_extension:qos_specs_manage:create": "rule:admin" - -# Update qos specs (including updating association). -# PUT /qos-specs/{qos_id} -# GET /qos-specs/{qos_id}/disassociate_all -# GET /qos-specs/{qos_id}/associate -# GET /qos-specs/{qos_id}/disassociate -"volume_extension:qos_specs_manage:update": "rule:admin or rule:reader" - -# delete qos specs or unset one specified qos key. -# DELETE /qos-specs/{qos_id} -# PUT /qos-specs/{qos_id}/delete_keys -"volume_extension:qos_specs_manage:delete": "rule:admin" - -# Show or update project quota class. -# GET /os-quota-class-sets/{project_id} -# PUT /os-quota-class-sets/{project_id} -"volume_extension:quota_classes": "rule:admin" - -# Show project quota (including usage and default). -# GET /os-quota-sets/{project_id} -# GET /os-quota-sets/{project_id}/default -# GET /os-quota-sets/{project_id}?usage=True -"volume_extension:quotas:show": "rule:admin or rule:member or rule:reader" - -# Update project quota. -# PUT /os-quota-sets/{project_id} -"volume_extension:quotas:update": "rule:admin" - -# Delete project quota. -# DELETE /os-quota-sets/{project_id} -"volume_extension:quotas:delete": "rule:admin" - -# Validate setup for nested quota. -# GET /os-quota-sets/validate_setup_for_nested_quota_use -"volume_extension:quota_classes:validate_setup_for_nested_quota_use": "rule:admin or rule:reader" - -# Show backend capabilities. -# GET /capabilities/{host_name} -"volume_extension:capabilities": "rule:admin or rule:reader" - -# List all services. -# GET /os-services -"volume_extension:services:index": "rule:admin or rule:reader" - -# Update service, including failover_host, thaw, freeze, disable, -# enable, set-log and get-log actions. -# PUT /os-services/{action} -"volume_extension:services:update": "rule:admin" - -# Freeze a backend host. -# PUT /os-services/freeze -"volume:freeze_host": "rule:admin" - -# Thaw a backend host. -# PUT /os-services/thaw -"volume:thaw_host": "rule:admin" - -# Failover a backend host. -# PUT /os-services/failover_host -"volume:failover_host": "rule:admin" - -# List all backend pools. -# GET /scheduler-stats/get_pools -"scheduler_extension:scheduler_stats:get_pools": "rule:admin or rule:reader" - -# List, update or show hosts for a project. -# GET /os-hosts -# PUT /os-hosts/{host_name} -# GET /os-hosts/{host_id} -"volume_extension:hosts": "rule:admin" - -# Show limits with used limit attributes. -# GET /limits -"limits_extension:used_limits": "rule:admin or rule:member or rule:reader" - -# List (in detail) of volumes which are available to manage. -# GET /manageable_volumes -# GET /manageable_volumes/detail -"volume_extension:list_manageable": "rule:admin or rule:reader" - -# Manage existing volumes. -# POST /manageable_volumes -"volume_extension:volume_manage": "rule:admin" - -# Stop managing a volume. -# POST /volumes/{volume_id}/action (os-unmanage) -"volume_extension:volume_unmanage": "rule:admin" - -# Create, update and delete volume type. -# POST /types -# PUT /types -# DELETE /types -"volume_extension:types_manage": "rule:admin" - -# List, show, create, update and delete volume type encryption. -# POST /types/{type_id}/encryption -# PUT /types/{type_id}/encryption/{encryption_id} -# GET /types/{type_id}/encryption -# GET /types/{type_id}/encryption/{encryption_id} -# DELETE /types/{type_id}/encryption/{encryption_id} -"volume_extension:volume_type_encryption": "rule:admin" - -# List or show volume type with access type extra specs attribute. -# GET /types/{type_id} -# GET /types -"volume_extension:access_types_extra_specs": "rule:admin or rule:reader" - -# List or show volume type with access type qos specs id attribute. -# GET /types/{type_id} -# GET /types -"volume_extension:access_types_qos_specs_id": "rule:admin or rule:reader" - -# Volume type access related APIs. -# GET /types -# GET /types/detail -# GET /types/{type_id} -# POST /types -"volume_extension:volume_type_access": "rule:admin or rule:member" - -# Add volume type access for project. -# POST /types/{type_id}/action (addProjectAccess) -"volume_extension:volume_type_access:addProjectAccess": "rule:admin" - -# Remove volume type access for project. -# POST /types/{type_id}/action (removeProjectAccess) -"volume_extension:volume_type_access:removeProjectAccess": "rule:admin" - -# Extend a volume. -# POST /volumes/{volume_id}/action (os-extend) -"volume:extend": "rule:admin or rule:member" - -# Extend a attached volume. -# POST /volumes/{volume_id}/action (os-extend) -"volume:extend_attached_volume": "rule:admin or rule:member" - -# Revert a volume to a snapshot. -# POST /volumes/{volume_id}/action (revert) -"volume:revert_to_snapshot": "rule:admin or rule:member" - -# Reset status of a volume. -# POST /volumes/{volume_id}/action (os-reset_status) -"volume_extension:volume_admin_actions:reset_status": "rule:admin" - -# Retype a volume. -# POST /volumes/{volume_id}/action (os-retype) -"volume:retype": "rule:admin or rule:member" - -# Update a volume's readonly flag. -# POST /volumes/{volume_id}/action (os-update_readonly_flag) -"volume:update_readonly_flag": "rule:admin or rule:member" - -# Force delete a volume. -# POST /volumes/{volume_id}/action (os-force_delete) -"volume_extension:volume_admin_actions:force_delete": "rule:admin" - -# Upload a volume to image with public visibility. -# POST /volumes/{volume_id}/action (os-volume_upload_image) -"volume_extension:volume_actions:upload_public": "rule:admin" - -# Upload a volume to image. -# POST /volumes/{volume_id}/action (os-volume_upload_image) -"volume_extension:volume_actions:upload_image": "rule:admin or rule:member" - -# Force detach a volume. -# POST /volumes/{volume_id}/action (os-force_detach) -"volume_extension:volume_admin_actions:force_detach": "rule:admin" - -# migrate a volume to a specified host. -# POST /volumes/{volume_id}/action (os-migrate_volume) -"volume_extension:volume_admin_actions:migrate_volume": "rule:admin" - -# Complete a volume migration. -# POST /volumes/{volume_id}/action (os-migrate_volume_completion) -"volume_extension:volume_admin_actions:migrate_volume_completion": "rule:admin" - -# Initialize volume attachment. -# POST /volumes/{volume_id}/action (os-initialize_connection) -"volume_extension:volume_actions:initialize_connection": "rule:admin or rule:member" - -# Terminate volume attachment. -# POST /volumes/{volume_id}/action (os-terminate_connection) -"volume_extension:volume_actions:terminate_connection": "rule:admin or rule:member" - -# Roll back volume status to 'in-use'. -# POST /volumes/{volume_id}/action (os-roll_detaching) -"volume_extension:volume_actions:roll_detaching": "rule:admin or rule:member" - -# Mark volume as reserved. -# POST /volumes/{volume_id}/action (os-reserve) -"volume_extension:volume_actions:reserve": "rule:admin or rule:member" - -# Unmark volume as reserved. -# POST /volumes/{volume_id}/action (os-unreserve) -"volume_extension:volume_actions:unreserve": "rule:admin or rule:member" - -# Begin detach volumes. -# POST /volumes/{volume_id}/action (os-begin_detaching) -"volume_extension:volume_actions:begin_detaching": "rule:admin or rule:member" - -# Add attachment metadata. -# POST /volumes/{volume_id}/action (os-attach) -"volume_extension:volume_actions:attach": "rule:admin or rule:member" - -# Clear attachment metadata. -# POST /volumes/{volume_id}/action (os-detach) -"volume_extension:volume_actions:detach": "rule:admin or rule:member" - -# List volume transfer. -# GET /os-volume-transfer -# GET /os-volume-transfer/detail -# GET /volume_transfers -# GET /volume_transfers/detail -"volume:get_all_transfers": "rule:admin or rule:member or rule:reader" - -# Create a volume transfer. -# POST /os-volume-transfer -# POST /volume_transfers -"volume:create_transfer": "rule:admin or rule:member" - -# Show one specified volume transfer. -# GET /os-volume-transfer/{transfer_id} -# GET /volume_transfers/{transfer_id} -"volume:get_transfer": "rule:admin or rule:member or rule:reader" - -# Accept a volume transfer. -# POST /os-volume-transfer/{transfer_id}/accept -# POST /volume_transfers/{transfer_id}/accept -"volume:accept_transfer": "rule:admin or rule:member" - -# Delete volume transfer. -# DELETE /os-volume-transfer/{transfer_id} -# DELETE /volume_transfers/{transfer_id} -"volume:delete_transfer": "rule:admin or rule:member" - -# Show volume's metadata or one specified metadata with a given key. -# GET /volumes/{volume_id}/metadata -# GET /volumes/{volume_id}/metadata/{key} -"volume:get_volume_metadata": "rule:admin or rule:member or rule:reader" - -# Create volume metadata. -# POST /volumes/{volume_id}/metadata -"volume:create_volume_metadata": "rule:admin or rule:member" - -# Update volume's metadata or one specified metadata with a given key. -# PUT /volumes/{volume_id}/metadata -# PUT /volumes/{volume_id}/metadata/{key} -"volume:update_volume_metadata": "rule:admin or rule:member" - -# Delete volume's specified metadata with a given key. -# DELETE /volumes/{volume_id}/metadata/{key} -"volume:delete_volume_metadata": "rule:admin or rule:member" - -# Volume's image metadata related operation, create, delete, show and -# list. -# GET /volumes/detail -# GET /volumes/{volume_id} -# POST /volumes/{volume_id}/action (os-set_image_metadata) -# POST /volumes/{volume_id}/action (os-unset_image_metadata) -"volume_extension:volume_image_metadata": "rule:admin or rule:member" - -# Update volume admin metadata. It's used in `attach` and `os- -# update_readonly_flag` APIs -# POST /volumes/{volume_id}/action (os-update_readonly_flag) -# POST /volumes/{volume_id}/action (os-attach) -"volume:update_volume_admin_metadata": "rule:admin" - -# List type extra specs. -# GET /types/{type_id}/extra_specs -"volume_extension:types_extra_specs:index": "rule:admin or rule:reader" - -# Create type extra specs. -# POST /types/{type_id}/extra_specs -"volume_extension:types_extra_specs:create": "rule:admin" - -# Show one specified type extra specs. -# GET /types/{type_id}/extra_specs/{extra_spec_key} -"volume_extension:types_extra_specs:show": "rule:admin or rule:reader" - -# Update type extra specs. -# PUT /types/{type_id}/extra_specs/{extra_spec_key} -"volume_extension:types_extra_specs:update": "rule:admin" - -# Delete type extra specs. -# DELETE /types/{type_id}/extra_specs/{extra_spec_key} -"volume_extension:types_extra_specs:delete": "rule:admin" - -# Create volume. -# POST /volumes -"volume:create": "rule:admin or rule:member" - -# Create volume from image. -# POST /volumes -"volume:create_from_image": "rule:admin or rule:member" - -# Show volume. -# GET /volumes/{volume_id} -"volume:get": "rule:admin or rule:member or rule:reader" - -# List volumes or get summary of volumes. -# GET /volumes -# GET /volumes/detail -# GET /volumes/summary -"volume:get_all": "rule:admin or rule:member or rule:reader" - -# Update volume. -# PUT /volumes -"volume:update": "rule:admin or rule:member" - -# Delete volume. -# DELETE /volumes/{volume_id} -"volume:delete": "rule:admin or rule:member" - -# Force Delete a volume. -# DELETE /volumes/{volume_id} -"volume:force_delete": "rule:admin" - -# List or show volume with host attribute. -# GET /volumes/{volume_id} -# GET /volumes/detail -"volume_extension:volume_host_attribute": "rule:admin or rule:reader" - -# List or show volume with tenant attribute. -# GET /volumes/{volume_id} -# GET /volumes/detail -"volume_extension:volume_tenant_attribute": "rule:admin or rule:member or rule:reader" - -# List or show volume with migration status attribute. -# GET /volumes/{volume_id} -# GET /volumes/detail -"volume_extension:volume_mig_status_attribute": "rule:admin or rule:reader" - -# Show volume's encryption metadata. -# GET /volumes/{volume_id}/encryption -# GET /volumes/{volume_id}/encryption/{encryption_key} -"volume_extension:volume_encryption_metadata": "rule:admin or rule:member or rule:reader" - -# Create multiattach capable volume. -# POST /volumes -"volume:multiattach": "rule:admin or rule:member" diff --git a/etc/glance/policy.yaml b/etc/glance/policy.yaml deleted file mode 100644 index c9167c8..0000000 --- a/etc/glance/policy.yaml +++ /dev/null @@ -1,101 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -# We add here a check for if the image is public, allowing a member to use public images on the cloud -member: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - - -# List available image entities -# GET /v1/images -# GET /v1/images/detail -# GET /v2/images -"get_images": "rule:admin or rule:member or rule:reader" - -# Retrieve a specific image entity -# HEAD /v1/images/ -# GET /v1/images/ -# GET /v2/images/ -"get_image": "rule:admin or rule:member or rule:reader" - -# Download binary image data -# GET /v1/images/ -# GET /v2/images//file -"download_image": "rule:admin or rule:member or rule:reader" - -# Upload binary image data -# POST /v1/images -# PUT /v1/images/ -# PUT /v2/images//file -"upload_image": "rule:admin or rule:member" - -# Copy binary image data from URL -# POST /v1/images -# PUT /v1/images/ -"copy_from": "rule:admin or rule:member" - -# Create an image entity -# POST /v1/images -# POST /v2/images -"add_image": "rule:admin or rule:member" - -# Update an image entity -# PUT /v1/images/ -# PUT /v2/images/ -"modify_image": "rule:admin or rule:member" - -# Create or update public images -# POST /v1/images with attribute is_public = true -# PUT /v1/images/ with attribute is_public = true -# POST /v2/images with attribute visibility = public -# PUT /v2/images/ with attribute visibility = public -"publicize_image": "rule:admin or rule:member" - -# Create or update community images -# POST /v2/images with attribute visibility = community -# PUT /v2/images/ with attribute visibility = community -"communitize_image": "rule:admin or rule:member" - -# Delete an image entity and associated binary data -# DELETE /v1/images/ -# DELETE /v2/images/ -"delete_image": "rule:admin or rule:member" - -# Add a membership to the member repo of an image -# POST /v2/images//members -"add_member": "rule:admin or rule:member" - -# List the members of an image -# GET /v1/images//members -# GET /v2/images//members -"get_members": "rule:admin or rule:member or rule:reader" - -# Delete a membership of an image -# DELETE /v1/images//members/ -# DELETE /v2/images//members/ -"delete_member": "rule:admin or rule:member" - -# Create or update the membership of an image -# PUT /v1/images//members/ -# PUT /v1/images//members -# POST /v2/images//members -# PUT /v2/images//members/ -"modify_member": "rule:admin or rule:member" - -# Allowed to use the image cache management API -"manage_image_cache": "rule:admin or rule:member" diff --git a/etc/gnocchi/policy.yaml b/etc/gnocchi/policy.yaml deleted file mode 100644 index 22a0fc3..0000000 --- a/etc/gnocchi/policy.yaml +++ /dev/null @@ -1,61 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -# For gnocchi, this also adds a check to who created the resource -_member_role: "(role:Member or role:member or role:_member_ or user:%(creator)s)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -# For gnocchi, this also adds a check for the resource to be part of the user's project -member: "(rule:_member_role and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# RULES: - -"get status": "rule:admin or rule:reader" - -"create resource": "rule:admin or rule:member" -"get resource": "rule:admin or rule:member or rule:reader" -"update resource": "rule:admin or rule:member" -"delete resource": "rule:admin or rule:member" -"delete resources": "rule:admin or rule:member" -"list resource": "rule:admin or rule:member or rule:reader" -"search resource": "rule:admin or rule:member or rule:reader" - -"create resource type": "rule:admin" -"delete resource type": "rule:admin" -"update resource type": "rule:admin" -"list resource type": "rule:admin or rule:member or rule:reader" -"get resource type": "rule:admin or rule:member or rule:reader" - -"get archive policy": "rule:admin or rule:member or rule:reader" -"list archive policy": "rule:admin or rule:member or rule:reader" -"create archive policy": "rule:admin" -"update archive policy": "rule:admin" -"delete archive policy": "rule:admin" - -"create archive policy rule": "rule:admin" -"get archive policy rule": "rule:admin or rule:member or rule:reader" -"list archive policy rule": "rule:admin or rule:member or rule:reader" -"update archive policy rule": "rule:admin" -"delete archive policy rule": "rule:admin" - -"create metric": "rule:admin or rule:member" -"delete metric": "rule:admin or rule:member" -"get metric": "rule:admin or rule:member or rule:reader" -"search metric": "rule:admin or rule:member or rule:reader" -"list metric": "rule:admin or rule:member or rule:reader" - -"get measures": "rule:admin or rule:member or rule:reader" -"post measures": "rule:admin or rule:member" diff --git a/etc/heat/policy.yaml b/etc/heat/policy.yaml deleted file mode 100644 index 4c20394..0000000 --- a/etc/heat/policy.yaml +++ /dev/null @@ -1,343 +0,0 @@ -# An additional rule that prevents users created via stack from creating additional stacks -"deny_stack_user": "(not role:heat_stack_user)" - -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader and rule:deny_stack_user)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) and rule:deny_stack_user)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "((rule:_member_role and project_id:%(project_id)s) and rule:deny_stack_user)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "((is_admin:True or role:admin) and rule:deny_stack_user)" - -# This rule is specific for a user's own objects -owner: "((rule:_member_role and user_id:%(user_id)s) and rule:deny_stack_user)" - -# Decides what is required for the 'is_admin:True' check to succeed. -"context_is_admin": "role:admin" - -### Policy Rules defined in heat.policies.base - -# Default rule for deny everybody. -# -"deny_everybody": "!" - -# Default rule for allow everybody. -# -"allow_everybody": "" - -### Policy Rules defined in heat.policies.actions - -# Performs non-lifecycle operations on the stack (Snapshot, Resume, Cancel update, or check stack resources). -# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions -"actions:action": "rule:admin or rule:member" - -### Policy Rules defined in heat.policies.build_info - -# Show build information. -# GET /v1/{tenant_id}/build_info -"build_info:build_info": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in heat.policies.cloudformation - -# -"cloudformation:ListStacks": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:CreateStack": "rule:admin or rule:member" - -# -"cloudformation:DescribeStacks": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:DeleteStack": "rule:admin or rule:member" - -# -"cloudformation:UpdateStack": "rule:admin or rule:member" - -# -"cloudformation:CancelUpdateStack": "rule:admin or rule:member" - -# -"cloudformation:DescribeStackEvents": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:ValidateTemplate": "rule:admin or rule:member" - -# -"cloudformation:GetTemplate": "rule:admin or rule:member" - -# -"cloudformation:EstimateTemplateCost": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:DescribeStackResource": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:DescribeStackResources": "rule:admin or rule:member or rule:reader" - -# -"cloudformation:ListStackResources": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in heat.policies.events - -# List events. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/events -"events:index": "rule:admin or rule:member or rule:reader" - -# Show event. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/events/{event_id} -"events:show": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in heat.policies.resource - -# List resources. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources -"resource:index": "rule:admin or rule:member or rule:reader" - -# Show resource metadata. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/metadata -"resource:metadata": "rule:admin or rule:member or rule:reader" - -# Signal resource. -# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/signal -"resource:signal": "rule:admin or rule:member or rule:reader" - -# Mark resource as unhealthy. -# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name_or_physical_id} -"resource:mark_unhealthy": "rule:admin or rule:member" - -# Show resource. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name} -"resource:show": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in heat.policies.resource_types - -# -"resource_types:OS::Nova::Flavor": "rule:admin" - -# -"resource_types:OS::Cinder::EncryptedVolumeType": "rule:admin" - -# -"resource_types:OS::Cinder::VolumeType": "rule:admin" - -# -"resource_types:OS::Cinder::Quota": "rule:admin" - -# -"resource_types:OS::Neutron::Quota": "rule:admin" - -# -"resource_types:OS::Nova::Quota": "rule:admin" - -# -"resource_types:OS::Manila::ShareType": "rule:admin" - -# -"resource_types:OS::Neutron::ProviderNet": "rule:admin" - -# -"resource_types:OS::Neutron::QoSPolicy": "rule:admin" - -# -"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:admin" - -# -"resource_types:OS::Neutron::Segment": "rule:admin" - -# -"resource_types:OS::Nova::HostAggregate": "rule:admin" - -# -"resource_types:OS::Cinder::QoSSpecs": "rule:admin" - -# -"resource_types:OS::Cinder::QoSAssociation": "rule:admin" - -# -"resource_types:OS::Keystone::*": "rule:admin" - -### Policy Rules defined in heat.policies.service - -# -"service:index": "rule:admin or rule:reader" - -### Policy Rules defined in heat.policies.software_configs - -# List configs globally. -# GET /v1/{tenant_id}/software_configs -"software_configs:global_index": "rule:deny_everybody" - -# List configs. -# GET /v1/{tenant_id}/software_configs -"software_configs:index": "rule:admin or rule:member or rule:reader" - -# Create config. -# POST /v1/{tenant_id}/software_configs -"software_configs:create": "rule:admin or rule:member" - -# Show config details. -# GET /v1/{tenant_id}/software_configs/{config_id} -"software_configs:show": "rule:admin or rule:member or rule:reader" - -# Delete config. -# DELETE /v1/{tenant_id}/software_configs/{config_id} -"software_configs:delete": "rule:admin or rule:member" - -### Policy Rules defined in heat.policies.software_deployments - -# List deployments. -# GET /v1/{tenant_id}/software_deployments -"software_deployments:index": "rule:admin or rule:member or rule:reader" - -# Create deployment. -# POST /v1/{tenant_id}/software_deployments -"software_deployments:create": "rule:admin or rule:member" - -# Show deployment details. -# GET /v1/{tenant_id}/software_deployments/{deployment_id} -"software_deployments:show": "rule:admin or rule:member or rule:reader" - -# Update deployment. -# PUT /v1/{tenant_id}/software_deployments/{deployment_id} -"software_deployments:update": "rule:admin or rule:member" - -# Delete deployment. -# DELETE /v1/{tenant_id}/software_deployments/{deployment_id} -"software_deployments:delete": "rule:admin or rule:member" - -# Show server configuration metadata. -# GET /v1/{tenant_id}/software_deployments/metadata/{server_id} -"software_deployments:metadata": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in heat.policies.stacks - -# Abandon stack. -# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/abandon -"stacks:abandon": "rule:admin or rule:member" - -# Create stack. -# POST /v1/{tenant_id}/stacks -"stacks:create": "rule:admin or rule:member" - -# Delete stack. -# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id} -"stacks:delete": "rule:admin or rule:member" - -# List stacks in detail. -# GET /v1/{tenant_id}/stacks -"stacks:detail": "rule:admin or rule:member or rule:reader" - -# Export stack. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/export -"stacks:export": "rule:admin or rule:member or rule:reader" - -# Generate stack template. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template -"stacks:generate_template": "rule:admin or rule:member or rule:reader" - -# List stacks globally. -# GET /v1/{tenant_id}/stacks -"stacks:global_index": "rule:deny_everybody" - -# List stacks. -# GET /v1/{tenant_id}/stacks -"stacks:index": "rule:admin or rule:member or rule:reader" - -# List resource types. -# GET /v1/{tenant_id}/resource_types -"stacks:list_resource_types": "rule:admin or rule:member or rule:reader" - -# List template versions. -# GET /v1/{tenant_id}/template_versions -"stacks:list_template_versions": "rule:admin or rule:member or rule:reader" - -# List template functions. -# GET /v1/{tenant_id}/template_versions/{template_version}/functions -"stacks:list_template_functions": "rule:admin or rule:member or rule:reader" - -# Find stack. -# GET /v1/{tenant_id}/stacks/{stack_identity} -"stacks:lookup": "rule:admin or rule:member or rule:reader" - -# Preview stack. -# POST /v1/{tenant_id}/stacks/preview -"stacks:preview": "rule:admin or rule:member" - -# Show resource type schema. -# GET /v1/{tenant_id}/resource_types/{type_name} -"stacks:resource_schema": "rule:admin or rule:member or rule:reader" - -# Show stack. -# GET /v1/{tenant_id}/stacks/{stack_identity} -"stacks:show": "rule:admin or rule:member or rule:reader" - -# Get stack template. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template -"stacks:template": "rule:admin or rule:member" - -# Get stack environment. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/environment -"stacks:environment": "rule:admin or rule:member" - -# Get stack files. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/files -"stacks:files": "rule:admin or rule:member" - -# Update stack. -# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id} -"stacks:update": "rule:admin or rule:member" - -# Update stack (PATCH). -# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id} -"stacks:update_patch": "rule:admin or rule:member" - -# Preview update stack. -# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview -"stacks:preview_update": "rule:admin or rule:member" - -# Preview update stack (PATCH). -# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview -"stacks:preview_update_patch": "rule:admin or rule:member" - -# Validate template. -# POST /v1/{tenant_id}/validate -"stacks:validate_template": "rule:admin or rule:member" - -# Snapshot Stack. -# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots -"stacks:snapshot": "rule:admin or rule:member" - -# Show snapshot. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} -"stacks:show_snapshot": "rule:admin or rule:member or rule:reader" - -# Delete snapshot. -# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} -"stacks:delete_snapshot": "rule:admin or rule:member" - -# List snapshots. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots -"stacks:list_snapshots": "rule:admin or rule:member or rule:reader" - -# Restore snapshot. -# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id}/restore -"stacks:restore_snapshot": "rule:admin or rule:member" - -# List outputs. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs -"stacks:list_outputs": "rule:admin or rule:member" - -# Show outputs. -# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs/{output_key} -"stacks:show_output": "rule:admin or rule:member" diff --git a/etc/keystone/policy.yaml b/etc/keystone/policy.yaml deleted file mode 100644 index 5aba840..0000000 --- a/etc/keystone/policy.yaml +++ /dev/null @@ -1,1081 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# The role used by openstack services -"service_role": "(role:service)" - -# -"token_subject": "user_id:%(target.token.user_id)s" - -# RULES: - -# Show application credential details. -# GET /v3/users/{user_id}/application_credentials/{application_credential_id} -# HEAD /v3/users/{user_id}/application_credentials/{application_credential_id} -"identity:get_application_credential": "rule:admin or rule:owner or rule:reader" - -# List application credentials for a user. -# GET /v3/users/{user_id}/application_credentials -# HEAD /v3/users/{user_id}/application_credentials -"identity:list_application_credentials": "rule:admin or rule:owner or rule:reader" - -# Create an application credential. -# POST /v3/users/{user_id}/application_credentials -"identity:create_application_credential": "rule:admin or rule:owner" - -# Delete an application credential. -# DELETE /v3/users/{user_id}/application_credentials/{application_credential_id} -"identity:delete_application_credential": "rule:admin or rule:owner" - -# Authorize OAUTH1 request token. -# PUT /v3/OS-OAUTH1/authorize/{request_token_id} -# Intended scope(s): project -"identity:authorize_request_token": "rule:admin" - -# Get OAUTH1 access token for user by access token ID. -# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} -# Intended scope(s): project -"identity:get_access_token": "rule:admin" - -# Get role for user OAUTH1 access token. -# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id} -# Intended scope(s): project -"identity:get_access_token_role": "rule:admin" - -# List OAUTH1 access tokens for user. -# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens -# Intended scope(s): project -"identity:list_access_tokens": "rule:admin" - -# List OAUTH1 access token roles. -# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles -# Intended scope(s): project -"identity:list_access_token_roles": "rule:admin" - -# Delete OAUTH1 access token. -# DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} -# Intended scope(s): project -"identity:delete_access_token": "rule:admin" - -# Get service catalog. -# GET /v3/auth/catalog -# HEAD /v3/auth/catalog -"identity:get_auth_catalog": "rule:admin or rule:member" - -# List all projects a user has access to via role assignments. -# GET /v3/auth/projects -# HEAD /v3/auth/projects -"identity:get_auth_projects": "rule:admin or rule:member" - -# List all domains a user has access to via role assignments. -# GET /v3/auth/domains -# HEAD /v3/auth/domains -"identity:get_auth_domains": "rule:admin or rule:member" - -# List systems a user has access to via role assignments. -# GET /v3/auth/system -# HEAD /v3/auth/system -"identity:get_auth_system": "rule:admin or rule:member" - -# Show OAUTH1 consumer details. -# GET /v3/OS-OAUTH1/consumers/{consumer_id} -# Intended scope(s): system -"identity:get_consumer": "rule:admin" - -# List OAUTH1 consumers. -# GET /v3/OS-OAUTH1/consumers -# Intended scope(s): system -"identity:list_consumers": "rule:admin" - -# Create OAUTH1 consumer. -# POST /v3/OS-OAUTH1/consumers -# Intended scope(s): system -"identity:create_consumer": "rule:admin" - -# Update OAUTH1 consumer. -# PATCH /v3/OS-OAUTH1/consumers/{consumer_id} -# Intended scope(s): system -"identity:update_consumer": "rule:admin" - -# Delete OAUTH1 consumer. -# DELETE /v3/OS-OAUTH1/consumers/{consumer_id} -# Intended scope(s): system -"identity:delete_consumer": "rule:admin" - -# Show credentials details. -# GET /v3/credentials/{credential_id} -"identity:get_credential": "rule:admin" - -# List credentials. -# GET /v3/credentials -"identity:list_credentials": "rule:admin" - -# Create credential. -# POST /v3/credentials -"identity:create_credential": "rule:admin" - -# Update credential. -# PATCH /v3/credentials/{credential_id} -"identity:update_credential": "rule:admin" - -# Delete credential. -# DELETE /v3/credentials/{credential_id} -"identity:delete_credential": "rule:admin" - -# Show domain details. -# GET /v3/domains/{domain_id} -# Intended scope(s): system -"identity:get_domain": "rule:admin or token.project.domain.id:%(target.domain.id)s or rule:reader" - -# List domains. -# GET /v3/domains -# Intended scope(s): system -"identity:list_domains": "rule:admin or rule:reader" - -# Create domain. -# POST /v3/domains -# Intended scope(s): system -"identity:create_domain": "rule:admin" - -# Update domain. -# PATCH /v3/domains/{domain_id} -# Intended scope(s): system -"identity:update_domain": "rule:admin" - -# Delete domain. -# DELETE /v3/domains/{domain_id} -# Intended scope(s): system -"identity:delete_domain": "rule:admin" - -# Create domain configuration. -# PUT /v3/domains/{domain_id}/config -# Intended scope(s): system -"identity:create_domain_config": "rule:admin" - -# Get the entire domain configuration for a domain, an option group -# within a domain, or a specific configuration option within a group -# for a domain. -# GET /v3/domains/{domain_id}/config -# HEAD /v3/domains/{domain_id}/config -# GET /v3/domains/{domain_id}/config/{group} -# HEAD /v3/domains/{domain_id}/config/{group} -# GET /v3/domains/{domain_id}/config/{group}/{option} -# HEAD /v3/domains/{domain_id}/config/{group}/{option} -# Intended scope(s): system -"identity:get_domain_config": "rule:admin or rule:reader" - -# Get security compliance domain configuration for either a domain or -# a specific option in a domain. -# GET /v3/domains/{domain_id}/config/security_compliance -# HEAD /v3/domains/{domain_id}/config/security_compliance -# GET v3/domains/{domain_id}/config/security_compliance/{option} -# HEAD v3/domains/{domain_id}/config/security_compliance/{option} -# Intended scope(s): system, project -"identity:get_security_compliance_domain_config": "rule:admin or rule:member" - -# Update domain configuration for either a domain, specific group or a -# specific option in a group. -# PATCH /v3/domains/{domain_id}/config -# PATCH /v3/domains/{domain_id}/config/{group} -# PATCH /v3/domains/{domain_id}/config/{group}/{option} -# Intended scope(s): system -"identity:update_domain_config": "rule:admin" - -# Delete domain configuration for either a domain, specific group or a -# specific option in a group. -# DELETE /v3/domains/{domain_id}/config -# DELETE /v3/domains/{domain_id}/config/{group} -# DELETE /v3/domains/{domain_id}/config/{group}/{option} -# Intended scope(s): system -"identity:delete_domain_config": "rule:admin" - -# Get domain configuration default for either a domain, specific group -# or a specific option in a group. -# GET /v3/domains/config/default -# HEAD /v3/domains/config/default -# GET /v3/domains/config/{group}/default -# HEAD /v3/domains/config/{group}/default -# GET /v3/domains/config/{group}/{option}/default -# HEAD /v3/domains/config/{group}/{option}/default -# Intended scope(s): system -"identity:get_domain_config_default": "rule:admin or rule:reader" - -# Show ec2 credential details. -# GET /v3/users/{user_id}/credentials/OS-EC2/{credential_id} -"identity:ec2_get_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s) or rule:reader" - -# List ec2 credentials. -# GET /v3/users/{user_id}/credentials/OS-EC2 -"identity:ec2_list_credentials": "rule:admin or rule:owner" - -# Create ec2 credential. -# POST /v3/users/{user_id}/credentials/OS-EC2 -"identity:ec2_create_credential": "rule:admin or rule:owner" - -# Delete ec2 credential. -# DELETE /v3/users/{user_id}/credentials/OS-EC2/{credential_id} -"identity:ec2_delete_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s)" - -# Show endpoint details. -# GET /v3/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:get_endpoint": "rule:admin or rule:reader" - -# List endpoints. -# GET /v3/endpoints -# Intended scope(s): system -"identity:list_endpoints": "rule:admin or rule:reader" - -# Create endpoint. -# POST /v3/endpoints -# Intended scope(s): system -"identity:create_endpoint": "rule:admin" - -# Update endpoint. -# PATCH /v3/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:update_endpoint": "rule:admin" - -# Delete endpoint. -# DELETE /v3/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:delete_endpoint": "rule:admin" - -# Create endpoint group. -# POST /v3/OS-EP-FILTER/endpoint_groups -# Intended scope(s): system -"identity:create_endpoint_group": "rule:admin" - -# List endpoint groups. -# GET /v3/OS-EP-FILTER/endpoint_groups -# Intended scope(s): system -"identity:list_endpoint_groups": "rule:admin or rule:reader" - -# Get endpoint group. -# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} -# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} -# Intended scope(s): system -"identity:get_endpoint_group": "rule:admin or rule:reader" - -# Update endpoint group. -# PATCH /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} -# Intended scope(s): system -"identity:update_endpoint_group": "rule:admin" - -# Delete endpoint group. -# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} -# Intended scope(s): system -"identity:delete_endpoint_group": "rule:admin" - -# List all projects associated with a specific endpoint group. -# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects -# Intended scope(s): system -"identity:list_projects_associated_with_endpoint_group": "rule:admin or rule:reader" - -# List all endpoints associated with an endpoint group. -# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints -# Intended scope(s): system -"identity:list_endpoints_associated_with_endpoint_group": "rule:admin or rule:reader" - -# Check if an endpoint group is associated with a project. -# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} -# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} -# Intended scope(s): system -"identity:get_endpoint_group_in_project": "rule:admin or rule:reader" - -# List endpoint groups associated with a specific project. -# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoint_groups -# Intended scope(s): system -"identity:list_endpoint_groups_for_project": "rule:admin or rule:reader" - -# Allow a project to access an endpoint group. -# PUT /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} -# Intended scope(s): system -"identity:add_endpoint_group_to_project": "rule:admin" - -# Remove endpoint group from project. -# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} -# Intended scope(s): system -"identity:remove_endpoint_group_from_project": "rule:admin" - -# Check a role grant between a target and an actor. A target can be -# either a domain or a project. An actor can be either a user or a -# group. These terms also apply to the OS-INHERIT APIs, where grants -# on the target are inherited to all projects in the subtree, if -# applicable. -# HEAD /v3/projects/{project_id}/users/{user_id}/roles/{role_id} -# GET /v3/projects/{project_id}/users/{user_id}/roles/{role_id} -# HEAD /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} -# GET /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} -# HEAD /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} -# GET /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} -# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} -# GET /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} -# HEAD /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# GET /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# HEAD /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# GET /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# HEAD /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# HEAD /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# Intended scope(s): system -"identity:check_grant": "rule:admin or rule:reader" - -# List roles granted to an actor on a target. A target can be either a -# domain or a project. An actor can be either a user or a group. For -# the OS-INHERIT APIs, it is possible to list inherited role grants -# for actors on domains, where grants are inherited to all projects in -# the specified domain. -# GET /v3/projects/{project_id}/users/{user_id}/roles -# HEAD /v3/projects/{project_id}/users/{user_id}/roles -# GET /v3/projects/{project_id}/groups/{group_id}/roles -# HEAD /v3/projects/{project_id}/groups/{group_id}/roles -# GET /v3/domains/{domain_id}/users/{user_id}/roles -# HEAD /v3/domains/{domain_id}/users/{user_id}/roles -# GET /v3/domains/{domain_id}/groups/{group_id}/roles -# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles -# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects -# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects -# Intended scope(s): system -"identity:list_grants": "rule:admin or rule:reader" - -# Create a role grant between a target and an actor. A target can be -# either a domain or a project. An actor can be either a user or a -# group. These terms also apply to the OS-INHERIT APIs, where grants -# on the target are inherited to all projects in the subtree, if -# applicable. -# PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} -# PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} -# PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} -# PUT /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} -# PUT /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# PUT /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# PUT /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# PUT /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# Intended scope(s): system -"identity:create_grant": "rule:admin" - -# Revoke a role grant between a target and an actor. A target can be -# either a domain or a project. An actor can be either a user or a -# group. These terms also apply to the OS-INHERIT APIs, where grants -# on the target are inherited to all projects in the subtree, if -# applicable. In that case, revoking the role grant in the target -# would remove the logical effect of inheriting it to the target's -# projects subtree. -# DELETE /v3/projects/{project_id}/users/{user_id}/roles/{role_id} -# DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} -# DELETE /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} -# DELETE /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} -# DELETE /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# DELETE /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# DELETE /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects -# DELETE /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects -# Intended scope(s): system -"identity:revoke_grant": "rule:admin" - -# List all grants a specific user has on the system. -# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles -# Intended scope(s): system -"identity:list_system_grants_for_user": "rule:admin or rule:reader" - -# Check if a user has a role on the system. -# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles/{role_id} -# Intended scope(s): system -"identity:check_system_grant_for_user": "rule:admin or rule:reader" - -# Grant a user a role on the system. -# ['PUT'] /v3/system/users/{user_id}/roles/{role_id} -# Intended scope(s): system -"identity:create_system_grant_for_user": "rule:admin" - -# Remove a role from a user on the system. -# ['DELETE'] /v3/system/users/{user_id}/roles/{role_id} -# Intended scope(s): system -"identity:revoke_system_grant_for_user": "rule:admin" - -# List all grants a specific group has on the system. -# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles -# Intended scope(s): system -"identity:list_system_grants_for_group": "rule:admin or rule:reader" - -# Check if a group has a role on the system. -# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles/{role_id} -# Intended scope(s): system -"identity:check_system_grant_for_group": "rule:admin or rule:reader" - -# Grant a group a role on the system. -# ['PUT'] /v3/system/groups/{group_id}/roles/{role_id} -# Intended scope(s): system -"identity:create_system_grant_for_group": "rule:admin" - -# Remove a role from a group on the system. -# ['DELETE'] /v3/system/groups/{group_id}/roles/{role_id} -# Intended scope(s): system -"identity:revoke_system_grant_for_group": "rule:admin" - -# Show group details. -# GET /v3/groups/{group_id} -# HEAD /v3/groups/{group_id} -# Intended scope(s): system -"identity:get_group": "rule:admin or rule:reader" - -# List groups. -# GET /v3/groups -# HEAD /v3/groups -# Intended scope(s): system -"identity:list_groups": "rule:admin or rule:reader" - -# List groups to which a user belongs. -# GET /v3/users/{user_id}/groups -# HEAD /v3/users/{user_id}/groups -# Intended scope(s): system -"identity:list_groups_for_user": "rule:admin or rule:owner or rule:reader" - -# Create group. -# POST /v3/groups -# Intended scope(s): system -"identity:create_group": "rule:admin" - -# Update group. -# PATCH /v3/groups/{group_id} -# Intended scope(s): system -"identity:update_group": "rule:admin" - -# Delete group. -# DELETE /v3/groups/{group_id} -# Intended scope(s): system -"identity:delete_group": "rule:admin" - -# List members of a specific group. -# GET /v3/groups/{group_id}/users -# HEAD /v3/groups/{group_id}/users -# Intended scope(s): system -"identity:list_users_in_group": "rule:admin or rule:reader" - -# Remove user from group. -# DELETE /v3/groups/{group_id}/users/{user_id} -# Intended scope(s): system -"identity:remove_user_from_group": "rule:admin" - -# Check whether a user is a member of a group. -# HEAD /v3/groups/{group_id}/users/{user_id} -# GET /v3/groups/{group_id}/users/{user_id} -# Intended scope(s): system -"identity:check_user_in_group": "rule:admin or rule:reader" - -# Add user to group. -# PUT /v3/groups/{group_id}/users/{user_id} -# Intended scope(s): system -"identity:add_user_to_group": "rule:admin" - -# Create identity provider. -# PUT /v3/OS-FEDERATION/identity_providers/{idp_id} -# Intended scope(s): system -"identity:create_identity_provider": "rule:admin" - -# List identity providers. -# GET /v3/OS-FEDERATION/identity_providers -# HEAD /v3/OS-FEDERATION/identity_providers -# Intended scope(s): system -"identity:list_identity_providers": "rule:admin or rule:reader" - -# Get identity provider. -# GET /v3/OS-FEDERATION/identity_providers/{idp_id} -# HEAD /v3/OS-FEDERATION/identity_providers/{idp_id} -# Intended scope(s): system -"identity:get_identity_provider": "rule:admin or rule:reader" - -# Update identity provider. -# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id} -# Intended scope(s): system -"identity:update_identity_provider": "rule:admin" - -# Delete identity provider. -# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id} -# Intended scope(s): system -"identity:delete_identity_provider": "rule:admin" - -# Get information about an association between two roles. When a -# relationship exists between a prior role and an implied role and the -# prior role is assigned to a user, the user also assumes the implied -# role. -# GET /v3/roles/{prior_role_id}/implies/{implied_role_id} -# Intended scope(s): system -"identity:get_implied_role": "rule:admin or rule:reader" - -# List associations between two roles. When a relationship exists -# between a prior role and an implied role and the prior role is -# assigned to a user, the user also assumes the implied role. This -# will return all the implied roles that would be assumed by the user -# who gets the specified prior role. -# GET /v3/roles/{prior_role_id}/implies -# HEAD /v3/roles/{prior_role_id}/implies -# Intended scope(s): system -"identity:list_implied_roles": "rule:admin or rule:reader" - -# Create an association between two roles. When a relationship exists -# between a prior role and an implied role and the prior role is -# assigned to a user, the user also assumes the implied role. -# PUT /v3/roles/{prior_role_id}/implies/{implied_role_id} -# Intended scope(s): system -"identity:create_implied_role": "rule:admin" - -# Delete the association between two roles. When a relationship exists -# between a prior role and an implied role and the prior role is -# assigned to a user, the user also assumes the implied role. Removing -# the association will cause that effect to be eliminated. -# DELETE /v3/roles/{prior_role_id}/implies/{implied_role_id} -# Intended scope(s): system -"identity:delete_implied_role": "rule:admin" - -# List all associations between two roles in the system. When a -# relationship exists between a prior role and an implied role and the -# prior role is assigned to a user, the user also assumes the implied -# role. -# GET /v3/role_inferences -# HEAD /v3/role_inferences -# Intended scope(s): system -"identity:list_role_inference_rules": "rule:admin or rule:reader" - -# Check an association between two roles. When a relationship exists -# between a prior role and an implied role and the prior role is -# assigned to a user, the user also assumes the implied role. -# HEAD /v3/roles/{prior_role_id}/implies/{implied_role_id} -# Intended scope(s): system -"identity:check_implied_role": "rule:admin or rule:reader" - -# Get limit enforcement model. -# GET /v3/limits/model -# HEAD /v3/limits/model -# Intended scope(s): system, project -"identity:get_limit_model": "rule:admin or rule:member" - -# Show limit details. -# GET /v3/limits/{limit_id} -# HEAD /v3/limits/{limit_id} -# Intended scope(s): system, project -"identity:get_limit": "rule:admin or rule:member" - -# List limits. -# GET /v3/limits -# HEAD /v3/limits -# Intended scope(s): system, project -"identity:list_limits": "rule:admin or rule:member" - -# Create limits. -# POST /v3/limits -# Intended scope(s): system -"identity:create_limits": "rule:admin" - -# Update limit. -# PATCH /v3/limits/{limit_id} -# Intended scope(s): system -"identity:update_limit": "rule:admin" - -# Delete limit. -# DELETE /v3/limits/{limit_id} -# Intended scope(s): system -"identity:delete_limit": "rule:admin" - -# Create a new federated mapping containing one or more sets of rules. -# PUT /v3/OS-FEDERATION/mappings/{mapping_id} -# Intended scope(s): system -"identity:create_mapping": "rule:admin" - -# Get a federated mapping. -# GET /v3/OS-FEDERATION/mappings/{mapping_id} -# HEAD /v3/OS-FEDERATION/mappings/{mapping_id} -# Intended scope(s): system -"identity:get_mapping": "rule:admin or rule:reader" - -# List federated mappings. -# GET /v3/OS-FEDERATION/mappings -# HEAD /v3/OS-FEDERATION/mappings -# Intended scope(s): system -"identity:list_mappings": "rule:admin or rule:reader" - -# Delete a federated mapping. -# DELETE /v3/OS-FEDERATION/mappings/{mapping_id} -# Intended scope(s): system -"identity:delete_mapping": "rule:admin" - -# Update a federated mapping. -# PATCH /v3/OS-FEDERATION/mappings/{mapping_id} -# Intended scope(s): system -"identity:update_mapping": "rule:admin" - -# Show policy details. -# GET /v3/policy/{policy_id} -# Intended scope(s): system -"identity:get_policy": "rule:admin or rule:reader" - -# List policies. -# GET /v3/policies -# Intended scope(s): system -"identity:list_policies": "rule:admin or rule:reader" - -# Create policy. -# POST /v3/policies -# Intended scope(s): system -"identity:create_policy": "rule:admin" - -# Update policy. -# PATCH /v3/policies/{policy_id} -# Intended scope(s): system -"identity:update_policy": "rule:admin" - -# Delete policy. -# DELETE /v3/policies/{policy_id} -# Intended scope(s): system -"identity:delete_policy": "rule:admin" - -# Associate a policy to a specific endpoint. -# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:create_policy_association_for_endpoint": "rule:admin" - -# Check policy association for endpoint. -# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} -# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:check_policy_association_for_endpoint": "rule:admin or rule:reader" - -# Delete policy association for endpoint. -# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:delete_policy_association_for_endpoint": "rule:admin" - -# Associate a policy to a specific service. -# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} -# Intended scope(s): system -"identity:create_policy_association_for_service": "rule:admin" - -# Check policy association for service. -# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} -# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} -# Intended scope(s): system -"identity:check_policy_association_for_service": "rule:admin or rule:reader" - -# Delete policy association for service. -# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} -# Intended scope(s): system -"identity:delete_policy_association_for_service": "rule:admin" - -# Associate a policy to a specific region and service combination. -# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} -# Intended scope(s): system -"identity:create_policy_association_for_region_and_service": "rule:admin" - -# Check policy association for region and service. -# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} -# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} -# Intended scope(s): system -"identity:check_policy_association_for_region_and_service": "rule:admin or rule:reader" - -# Delete policy association for region and service. -# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} -# Intended scope(s): system -"identity:delete_policy_association_for_region_and_service": "rule:admin" - -# Get policy for endpoint. -# GET /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy -# HEAD /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy -# Intended scope(s): system -"identity:get_policy_for_endpoint": "rule:admin or rule:reader" - -# List endpoints for policy. -# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints -# Intended scope(s): system -"identity:list_endpoints_for_policy": "rule:admin or rule:reader" - -# Show project details. -# GET /v3/projects/{project_id} -"identity:get_project": "rule:admin or project_id:%(target.project.id)s or rule:reader" - -# List projects. -# GET /v3/projects -# Intended scope(s): system -"identity:list_projects": "rule:admin or rule:reader" - -# List projects for user. -# GET /v3/users/{user_id}/projects -"identity:list_user_projects": "rule:admin or rule:owner or rule:reader" - -# Create project. -# POST /v3/projects -# Intended scope(s): system -"identity:create_project": "rule:admin" - -# Update project. -# PATCH /v3/projects/{project_id} -# Intended scope(s): system -"identity:update_project": "rule:admin" - -# Delete project. -# DELETE /v3/projects/{project_id} -# Intended scope(s): system -"identity:delete_project": "rule:admin" - -# List tags for a project. -# GET /v3/projects/{project_id}/tags -# HEAD /v3/projects/{project_id}/tags -"identity:list_project_tags": "rule:admin or project_id:%(target.project.id)s or rule:reader" - -# Check if project contains a tag. -# GET /v3/projects/{project_id}/tags/{value} -# HEAD /v3/projects/{project_id}/tags/{value} -"identity:get_project_tag": "rule:admin or project_id:%(target.project.id)s or rule:reader" - -# Replace all tags on a project with the new set of tags. -# PUT /v3/projects/{project_id}/tags -# Intended scope(s): system -"identity:update_project_tags": "rule:admin" - -# Add a single tag to a project. -# PUT /v3/projects/{project_id}/tags/{value} -# Intended scope(s): system -"identity:create_project_tag": "rule:admin" - -# Remove all tags from a project. -# DELETE /v3/projects/{project_id}/tags -# Intended scope(s): system -"identity:delete_project_tags": "rule:admin" - -# Delete a specified tag from project. -# DELETE /v3/projects/{project_id}/tags/{value} -# Intended scope(s): system -"identity:delete_project_tag": "rule:admin" - -# List projects allowed to access an endpoint. -# GET /v3/OS-EP-FILTER/endpoints/{endpoint_id}/projects -# Intended scope(s): system -"identity:list_projects_for_endpoint": "rule:admin or rule:reader" - -# Allow project to access an endpoint. -# PUT /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:add_endpoint_to_project": "rule:admin" - -# Check if a project is allowed to access an endpoint. -# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} -# HEAD /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:check_endpoint_in_project": "rule:admin or rule:reader" - -# List the endpoints a project is allowed to access. -# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints -# Intended scope(s): system -"identity:list_endpoints_for_project": "rule:admin or rule:reader" - -# Remove access to an endpoint from a project that has previously been -# given explicit access. -# DELETE /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} -# Intended scope(s): system -"identity:remove_endpoint_from_project": "rule:admin" - -# Create federated protocol. -# PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} -# Intended scope(s): system -"identity:create_protocol": "rule:admin" - -# Update federated protocol. -# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} -# Intended scope(s): system -"identity:update_protocol": "rule:admin" - -# Get federated protocol. -# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} -# Intended scope(s): system -"identity:get_protocol": "rule:admin or rule:reader" - -# List federated protocols. -# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols -# Intended scope(s): system -"identity:list_protocols": "rule:admin or rule:reader" - -# Delete federated protocol. -# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} -# Intended scope(s): system -"identity:delete_protocol": "rule:admin" - -# Show region details. -# GET /v3/regions/{region_id} -# HEAD /v3/regions/{region_id} -# Intended scope(s): system, project -"identity:get_region": "rule:admin or rule:member" - -# List regions. -# GET /v3/regions -# HEAD /v3/regions -# Intended scope(s): system, project -"identity:list_regions": "rule:admin or rule:member" - -# Create region. -# POST /v3/regions -# PUT /v3/regions/{region_id} -# Intended scope(s): system -"identity:create_region": "rule:admin" - -# Update region. -# PATCH /v3/regions/{region_id} -# Intended scope(s): system -"identity:update_region": "rule:admin" - -# Delete region. -# DELETE /v3/regions/{region_id} -# Intended scope(s): system -"identity:delete_region": "rule:admin" - -# Show registered limit details. -# GET /v3/registered_limits/{registered_limit_id} -# HEAD /v3/registered_limits/{registered_limit_id} -# Intended scope(s): system, project -"identity:get_registered_limit": "rule:admin or rule:member" - -# List registered limits. -# GET /v3/registered_limits -# HEAD /v3/registered_limits -# Intended scope(s): system, project -"identity:list_registered_limits": "rule:admin or rule:member" - -# Create registered limits. -# POST /v3/registered_limits -# Intended scope(s): system -"identity:create_registered_limits": "rule:admin" - -# Update registered limit. -# PATCH /v3/registered_limits/{registered_limit_id} -# Intended scope(s): system -"identity:update_registered_limit": "rule:admin" - -# Delete registered limit. -# DELETE /v3/registered_limits/{registered_limit_id} -# Intended scope(s): system -"identity:delete_registered_limit": "rule:admin" - -# List revocation events. -# GET /v3/OS-REVOKE/events -# Intended scope(s): system -"identity:list_revoke_events": "rule:admin or rule:service_role or rule:reader" - -# Show role details. -# GET /v3/roles/{role_id} -# HEAD /v3/roles/{role_id} -# Intended scope(s): system -"identity:get_role": "rule:admin or rule:reader" - -# List roles. -# GET /v3/roles -# HEAD /v3/roles -# Intended scope(s): system -"identity:list_roles": "rule:admin or rule:reader" - -# Create role. -# POST /v3/roles -# Intended scope(s): system -"identity:create_role": "rule:admin" - -# Update role. -# PATCH /v3/roles/{role_id} -# Intended scope(s): system -"identity:update_role": "rule:admin" - -# Delete role. -# DELETE /v3/roles/{role_id} -# Intended scope(s): system -"identity:delete_role": "rule:admin" - -# Show domain role. -# GET /v3/roles/{role_id} -# HEAD /v3/roles/{role_id} -# Intended scope(s): system -"identity:get_domain_role": "rule:admin or rule:reader" - -# List domain roles. -# GET /v3/roles?domain_id={domain_id} -# HEAD /v3/roles?domain_id={domain_id} -# Intended scope(s): system -"identity:list_domain_roles": "rule:admin or rule:reader" - -# Create domain role. -# POST /v3/roles -# Intended scope(s): system -"identity:create_domain_role": "rule:admin" - -# Update domain role. -# PATCH /v3/roles/{role_id} -# Intended scope(s): system -"identity:update_domain_role": "rule:admin" - -# Delete domain role. -# DELETE /v3/roles/{role_id} -# Intended scope(s): system -"identity:delete_domain_role": "rule:admin" - -# List role assignments. -# GET /v3/role_assignments -# HEAD /v3/role_assignments -# Intended scope(s): system -"identity:list_role_assignments": "rule:admin or rule:reader" - -# List all role assignments for a given tree of hierarchical projects. -# GET /v3/role_assignments?include_subtree -# HEAD /v3/role_assignments?include_subtree -# Intended scope(s): project -"identity:list_role_assignments_for_tree": "rule:admin or rule:reader" - -# Show service details. -# GET /v3/services/{service_id} -# Intended scope(s): system -"identity:get_service": "rule:admin or rule:reader" - -# List services. -# GET /v3/services -# Intended scope(s): system -"identity:list_services": "rule:admin or rule:reader" - -# Create service. -# POST /v3/services -# Intended scope(s): system -"identity:create_service": "rule:admin" - -# Update service. -# PATCH /v3/services/{service_id} -# Intended scope(s): system -"identity:update_service": "rule:admin" - -# Delete service. -# DELETE /v3/services/{service_id} -# Intended scope(s): system -"identity:delete_service": "rule:admin" - -# Create federated service provider. -# PUT /v3/OS-FEDERATION/service_providers/{service_provider_id} -# Intended scope(s): system -"identity:create_service_provider": "rule:admin" - -# List federated service providers. -# GET /v3/OS-FEDERATION/service_providers -# HEAD /v3/OS-FEDERATION/service_providers -# Intended scope(s): system -"identity:list_service_providers": "rule:admin or rule:reader" - -# Get federated service provider. -# GET /v3/OS-FEDERATION/service_providers/{service_provider_id} -# HEAD /v3/OS-FEDERATION/service_providers/{service_provider_id} -# Intended scope(s): system -"identity:get_service_provider": "rule:admin or rule:reader" - -# Update federated service provider. -# PATCH /v3/OS-FEDERATION/service_providers/{service_provider_id} -# Intended scope(s): system -"identity:update_service_provider": "rule:admin" - -# Delete federated service provider. -# DELETE /v3/OS-FEDERATION/service_providers/{service_provider_id} -# Intended scope(s): system -"identity:delete_service_provider": "rule:admin" - -# List revoked PKI tokens. -# GET /v3/auth/tokens/OS-PKI/revoked -# Intended scope(s): system, project -"identity:revocation_list": "rule:admin or rule:service_role or rule:reader" - -# Check a token. -# HEAD /v3/auth/tokens -"identity:check_token": "rule:admin or rule:token_subject" - -# Validate a token. -# GET /v3/auth/tokens -"identity:validate_token": "rule:admin or rule:service_role or rule:token_subject or rule:reader" - -# Revoke a token. -# DELETE /v3/auth/tokens -"identity:revoke_token": "rule:admin or rule:token_subject" - -# Create trust. -# POST /v3/OS-TRUST/trusts -# Intended scope(s): project -"identity:create_trust": "user_id:%(trust.trustor_user_id)s" - -# List trusts. -# GET /v3/OS-TRUST/trusts -# HEAD /v3/OS-TRUST/trusts -# Intended scope(s): project -"identity:list_trusts": "rule:admin or rule:member" - -# List roles delegated by a trust. -# GET /v3/OS-TRUST/trusts/{trust_id}/roles -# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles -# Intended scope(s): project -"identity:list_roles_for_trust": "rule:admin or rule:member" - -# Check if trust delegates a particular role. -# GET /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} -# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} -# Intended scope(s): project -"identity:get_role_for_trust": "rule:admin or rule:member" - -# Revoke trust. -# DELETE /v3/OS-TRUST/trusts/{trust_id} -# Intended scope(s): project -"identity:delete_trust": "rule:admin or rule:member" - -# Get trust. -# GET /v3/OS-TRUST/trusts/{trust_id} -# HEAD /v3/OS-TRUST/trusts/{trust_id} -# Intended scope(s): project -"identity:get_trust": "rule:admin or rule:member" - -# Show user details. -# GET /v3/users/{user_id} -# HEAD /v3/users/{user_id} -"identity:get_user": "rule:admin or rule:owner or rule:reader" - -# List users. -# GET /v3/users -# HEAD /v3/users -# Intended scope(s): system -"identity:list_users": "rule:admin or rule:reader" - -# List all projects a user has access to via role assignments. -# GET /v3/auth/projects -"identity:list_projects_for_user": "rule:admin or rule:member" - -# List all domains a user has access to via role assignments. -# GET /v3/auth/domains -"identity:list_domains_for_user": "rule:admin or rule:member" - -# Create a user. -# POST /v3/users -# Intended scope(s): system -"identity:create_user": "rule:admin" - -# Update a user, including administrative password resets. -# PATCH /v3/users/{user_id} -# Intended scope(s): system -"identity:update_user": "rule:admin" - -# Delete a user. -# DELETE /v3/users/{user_id} -# Intended scope(s): system -"identity:delete_user": "rule:admin" diff --git a/etc/manila/policy.yaml b/etc/manila/policy.yaml deleted file mode 100644 index fa5bee5..0000000 --- a/etc/manila/policy.yaml +++ /dev/null @@ -1,772 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -"default": "rule:admin or rule:member" - -### Policy Rules defined in manila.policies.availability_zone - -# Get all storage availability zones. -# GET /os-availability-zone -# GET /availability-zone -# -"availability_zone:index": "rule:default or rule:reader" - -### Policy Rules defined in manila.policies.base - -### Policy Rules defined in manila.policies.message - -# Get details of a given message. -# GET /messages/{message_id} -# -"message:get": "rule:default or rule:reader" - -# Get all messages. -# GET /messages -# GET /messages?{query} -# -"message:get_all": "rule:default or rule:reader" - -# Delete a message. -# DELETE /messages/{message_id} -# -"message:delete": "rule:default" - -### Policy Rules defined in manila.policies.quota_class_set - -# Update quota class. -# PUT /quota-class-sets/{class_name} -# PUT /os-quota-class-sets/{class_name} -# -"quota_class_set:update": "rule:admin" - -# Get quota class. -# GET /quota-class-sets/{class_name} -# GET /os-quota-class-sets/{class_name} -# -"quota_class_set:show": "rule:defaul or rule:readert" - -### Policy Rules defined in manila.policies.quota_set - -# Update the quotas for a project/user and/or share type. -# PUT /quota-sets/{tenant_id} -# PUT /quota-sets/{tenant_id}?user_id={user_id} -# PUT /quota-sets/{tenant_id}?share_type={share_type_id} -# PUT /os-quota-sets/{tenant_id} -# PUT /os-quota-sets/{tenant_id}?user_id={user_id} -# -"quota_set:update": "rule:admin" - -# List the quotas for a tenant/user. -# GET /quota-sets/{tenant_id}/defaults -# GET /os-quota-sets/{tenant_id}/defaults -# -"quota_set:show": "rule:default or rule:reader" - -# Delete quota for a tenant/user or tenant/share-type. The quota will revert back to default (Admin only). -# DELETE /quota-sets/{tenant_id} -# DELETE /quota-sets/{tenant_id}?user_id={user_id} -# DELETE /quota-sets/{tenant_id}?share_type={share_type_id} -# DELETE /os-quota-sets/{tenant_id} -# DELETE /os-quota-sets/{tenant_id}?user_id={user_id} -# -"quota_set:delete": "rule:admin" - -### Policy Rules defined in manila.policies.scheduler_stats - -# Get information regarding backends (and storage pools) known to the scheduler. -# GET /scheduler-stats/pools -# GET /scheduler-stats/pools?{query} -# -"scheduler_stats:pools:index": "rule:admin or rule:reader" - -# Get detailed information regarding backends (and storage pools) known to the scheduler. -# GET /scheduler-stats/pools/detail?{query} -# GET /scheduler-stats/pools/detail -# -"scheduler_stats:pools:detail": "rule:admin or rule:reader" - -### Policy Rules defined in manila.policies.security_service - -# Create security service. -# POST /security-services -# -"security_service:create": "rule:default" - -# Get details of a security service. -# GET /security-services/{security_service_id} -# -"security_service:show": "rule:default or rule:reader" - -# Get details of all security services. -# GET /security-services/detail?{query} -# GET /security-services/detail -# -"security_service:detail": "rule:default or rule:reader" - -# Get all security services. -# GET /security-services -# GET /security-services?{query} -# -"security_service:index": "rule:default or rule:reader" - -# Update a security service. -# PUT /security-services/{security_service_id} -# -"security_service:update": "rule:default" - -# Delete a security service. -# DELETE /security-services/{security_service_id} -# -"security_service:delete": "rule:default" - -# Get security services of all projects. -# GET /security-services?all_tenants=1 -# GET /security-services/detail?all_tenants=1 -# -"security_service:get_all_security_services": "rule:admin or rule:reader" - -### Policy Rules defined in manila.policies.service - -# Return a list of all running services. -# GET /os-services -# GET /os-services?{query} -# GET /services -# GET /services?{query} -# -"service:index": "rule:admin or rule:reader" - -# Enable/Disable scheduling for a service. -# PUT /os-services/disable -# PUT /os-services/enable -# PUT /services/disable -# PUT /services/enable -# -"service:update": "rule:admin" - -### Policy Rules defined in manila.policies.share_access - -### Policy Rules defined in manila.policies.share_access_metadata - -### Policy Rules defined in manila.policies.share_export_location - -# Get all export locations of a given share. -# GET /shares/{share_id}/export_locations -# -"share_export_location:index": "rule:default or rule:reader" - -# Get details about the requested export location. -# GET /shares/{share_id}/export_locations/{export_location_id} -# -"share_export_location:show": "rule:default or rule:reader" - -### Policy Rules defined in manila.policies.share_group - -# Create share group. -# POST /share-groups -# -"share_group:create": "rule:default" - -# Get details of a share group. -# GET /share-groups/{share_group_id} -# -"share_group:get": "rule:default or rule:reader" - -# Get all share groups. -# GET /share-groups -# GET /share-groups/detail -# GET /share-groups?{query} -# GET /share-groups/detail?{query} -# -"share_group:get_all": "rule:default or rule:reader" - -# Update share group. -# PUT /share-groups/{share_group_id} -# -"share_group:update": "rule:default" - -# Delete share group. -# DELETE /share-groups/{share_group_id} -# -"share_group:delete": "rule:default" - -# Force delete a share group. -# POST /share-groups/{share_group_id}/action -# -"share_group:force_delete": "rule:admin" - -# Reset share group's status. -# POST /share-groups/{share_group_id}/action -# -"share_group:reset_status": "rule:admin" - -### Policy Rules defined in manila.policies.share_group_snapshot - -# Create a new share group snapshot. -# POST /share-group-snapshots -# -"share_group_snapshot:create": "rule:default" - -# Get details of a share group snapshot. -# GET /share-group-snapshots/{share_group_snapshot_id} -# -"share_group_snapshot:get": "rule:default or rule:reader" - -# Get all share group snapshots. -# GET /share-group-snapshots -# GET /share-group-snapshots/detail -# GET /share-group-snapshots/{query} -# GET /share-group-snapshots/detail?{query} -# -"share_group_snapshot:get_all": "rule:default or rule:reader" - -# Update a share group snapshot. -# PUT /share-group-snapshots/{share_group_snapshot_id} -# -"share_group_snapshot:update": "rule:default" - -# Delete a share group snapshot. -# DELETE /share-group-snapshots/{share_group_snapshot_id} -# -"share_group_snapshot:delete": "rule:default" - -# Force delete a share group snapshot. -# POST /share-group-snapshots/{share_group_snapshot_id}/action -# -"share_group_snapshot:force_delete": "rule:admin" - -# Reset a share group snapshot's status. -# POST /share-group-snapshots/{share_group_snapshot_id}/action -# -"share_group_snapshot:reset_status": "rule:admin" - -### Policy Rules defined in manila.policies.share_group_type - -# Create a new share group type. -# POST /share-group-types -# -"share_group_type:create": "rule:admin" - -# Get the list of share group types. -# GET /share-group-types -# GET /share-group-types?is_public=all -# -"share_group_type:index": "rule:default or rule:reader" - -# Get details regarding the specified share group type. -# GET /share-group-types/{share_group_type_id} -# -"share_group_type:show": "rule:default or rule:reader" - -# Get the default share group type. -# GET /share-group-types/default -# -"share_group_type:default": "rule:default or rule:reader" - -# Delete an existing group type. -# DELETE /share-group-types/{share_group_type_id} -# -"share_group_type:delete": "rule:admin" - -# Get project access by share group type. -# POST /share-group-types/{share_group_type_id}/access -# -"share_group_type:list_project_access": "rule:admin or rule:reader" - -# Allow project to use the share group type. -# POST /share-group-types/{share_group_type_id}/action -# -"share_group_type:add_project_access": "rule:admin" - -# Deny project access to use the share group type. -# POST /share-group-types/{share_group_type_id}/action -# -"share_group_type:remove_project_access": "rule:admin" - -### Policy Rules defined in manila.policies.share_group_types_spec - -# Create share group type specs. -# POST /share-group-types/{share_group_type_id}/group-specs -# -"share_group_types_spec:create": "rule:admin" - -# Get share group type specs. -# GET /share-group-types/{share_group_type_id}/group-specs -# -"share_group_types_spec:index": "rule:admin or rule:reader" - -# Get details of a share group type spec. -# GET /share-group-types/{share_group_type_id}/group-specs/{key} -# -"share_group_types_spec:show": "rule:admin or rule:reader" - -# Update a share group type spec. -# PUT /share-group-types/{share_group_type_id}/group-specs/{key} -# -"share_group_types_spec:update": "rule:admin" - -# Delete a share group type spec. -# DELETE /share-group-types/{share_group_type_id}/group-specs/{key} -# -"share_group_types_spec:delete": "rule:admin" - -### Policy Rules defined in manila.policies.share_instance - -### Policy Rules defined in manila.policies.share_instance_export_location - -### Policy Rules defined in manila.policies.share_network - -# Create share network. -# POST /share-networks -# -"share_network:create": "rule:default" - -# Get details of a share network. -# GET /share-networks/{share_network_id} -# -"share_network:show": "rule:default or rule:reader" - -# Get all share networks. -# GET /share-networks -# GET /share-networks?{query} -# -"share_network:index": "rule:default or rule:reader" - -# Get details of share networks . -# GET /share-networks/detail?{query} -# GET /share-networks/detail -# -"share_network:detail": "rule:default or rule:reader" - -# Update a share network. -# PUT /share-networks/{share_network_id} -# -"share_network:update": "rule:default" - -# Delete a share network. -# DELETE /share-networks/{share_network_id} -# -"share_network:delete": "rule:default" - -# Add security service to share network. -# POST /share-networks/{share_network_id}/action -# -"share_network:add_security_service": "rule:default" - -# Remove security service from share network. -# POST /share-networks/{share_network_id}/action -# -"share_network:remove_security_service": "rule:default" - -# Get share networks belonging to all projects. -# GET /share-networks?all_tenants=1 -# GET /share-networks/detail?all_tenants=1 -# -"share_network:get_all_share_networks": "rule:admin or rule:reader" - -### Policy Rules defined in manila.policies.share_replica - -# Create share replica. -# POST /share-replicas -# -"share_replica:create": "rule:default" - -# Get all share replicas. -# GET /share-replicas -# GET /share-replicas/detail -# GET /share-replicas/detail?share_id={share_id} -# -"share_replica:get_all": "rule:default or rule:reader" - -# Get details of a share replica. -# GET /share-replicas/{share_replica_id} -# -"share_replica:show": "rule:default or rule:reader" - -# Delete a share replica. -# DELETE /share-replicas/{share_replica_id} -# -"share_replica:delete": "rule:default" - -# Force delete a share replica. -# POST /share-replicas/{share_replica_id}/action -# -"share_replica:force_delete": "rule:admin" - -# Promote a non-active share replica to active. -# POST /share-replicas/{share_replica_id}/action -# -"share_replica:promote": "rule:default" - -# Resync a share replica that is out of sync. -# POST /share-replicas/{share_replica_id}/action -# -"share_replica:resync": "rule:admin" - -# Reset share replica's replica_state attribute. -# POST /share-replicas/{share_replica_id}/action -# -"share_replica:reset_replica_state": "rule:admin" - -# Reset share replica's status. -# POST /share-replicas/{share_replica_id}/action -# -"share_replica:reset_status": "rule:admin" - -### Policy Rules defined in manila.policies.share_server - -# Get share servers. -# GET /share-servers -# GET /share-servers?{query} -# -"share_server:index": "rule:admin or rule:reader" - -# Show share server. -# GET /share-servers/{server_id} -# -"share_server:show": "rule:admin or rule:reader" - -# Get share server details. -# GET /share-servers/{server_id}/details -# -"share_server:details": "rule:admin or rule:reader" - -# Delete share server. -# DELETE /share-servers/{server_id} -# -"share_server:delete": "rule:admin" - -### Policy Rules defined in manila.policies.share_snapshot - -# Get share snapshot. -# GET /snapshots/{snapshot_id} -# -"share_snapshot:get_snapshot": "rule:default or rule:reader" - -# Get all share snapshots. -# GET /snapshots -# GET /snapshots/detail -# GET /snapshots?{query} -# GET /snapshots/detail?{query} -# -"share_snapshot:get_all_snapshots": "rule:default or rule:reader" - -# Force Delete a share snapshot. -# DELETE /snapshots/{snapshot_id} -# -"share_snapshot:force_delete": "rule:admin" - -# Manage share snapshot. -# POST /snapshots/manage -# -"share_snapshot:manage_snapshot": "rule:admin" - -# Unmanage share snapshot. -# POST /snapshots/{snapshot_id}/action -# -"share_snapshot:unmanage_snapshot": "rule:admin" - -# Reset status. -# POST /snapshots/{snapshot_id}/action -# -"share_snapshot:reset_status": "rule:admin" - -# List access rules of a share snapshot. -# GET /snapshots/{snapshot_id}/access-list -# -"share_snapshot:access_list": "rule:default or rule:reader" - -# Allow access to a share snapshot. -# POST /snapshots/{snapshot_id}/action -# -"share_snapshot:allow_access": "rule:default" - -# Deny access to a share snapshot. -# POST /snapshots/{snapshot_id}/action -# -"share_snapshot:deny_access": "rule:default" - -### Policy Rules defined in manila.policies.share_snapshot_export_location - -# List export locations of a share snapshot. -# GET /snapshots/{snapshot_id}/export-locations/ -# -"share_snapshot_export_location:index": "rule:default or rule:reader" - -# Get details of a specified export location of a share snapshot. -# GET /snapshots/{snapshot_id}/export-locations/{export_location_id} -# -"share_snapshot_export_location:show": "rule:default or rule:reader" - -### Policy Rules defined in manila.policies.share_snapshot_instance - -# Get share snapshot instance. -# GET /snapshot-instances/{snapshot_instance_id} -# -"share_snapshot_instance:show": "rule:admin or rule:reader" - -# Get all share snapshot instances. -# GET /snapshot-instances -# GET /snapshot-instances?{query} -# -"share_snapshot_instance:index": "rule:admin or rule:reader" - -# Get details of share snapshot instances. -# GET /snapshot-instances/detail -# GET /snapshot-instances/detail?{query} -# -"share_snapshot_instance:detail": "rule:admin or rule:reader" - -# Reset share snapshot instance's status. -# POST /snapshot-instances/{snapshot_instance_id}/action -# -"share_snapshot_instance:reset_status": "rule:admin" - -### Policy Rules defined in manila.policies.share_snapshot_instance_export_location - -# List export locations of a share snapshot instance. -# GET /snapshot-instances/{snapshot_instance_id}/export-locations -# -"share_snapshot_instance_export_location:index": "rule:admin or rule:reader" - -# Show details of a specified export location of a share snapshot instance. -# GET /snapshot-instances/{snapshot_instance_id}/export-locations/{export_location_id} -# -"share_snapshot_instance_export_location:show": "rule:admin or rule:reader" - -### Policy Rules defined in manila.policies.share_type - -# Create share type. -# POST /types -# -"share_type:create": "rule:admin" - -# Get share type. -# GET /types/{share_type_id} -# -"share_type:show": "rule:default or rule:reader" - -# List share types. -# GET /types -# GET /types?is_public=all -# -"share_type:index": "rule:default or rule:reader" - -# Get default share type. -# GET /types/default -# -"share_type:default": "rule:default or rule:reader" - -# Delete share type. -# DELETE /types/{share_type_id} -# -"share_type:delete": "rule:admin" - -# List share type project access. -# GET /types/{share_type_id} -# -"share_type:list_project_access": "rule:admin or rule:reader" - -# Add share type to project. -# POST /types/{share_type_id}/action -# -"share_type:add_project_access": "rule:admin" - -# Remove share type from project. -# POST /types/{share_type_id}/action -# -"share_type:remove_project_access": "rule:admin" - -### Policy Rules defined in manila.policies.share_types_extra_spec - -# Create share type extra spec. -# POST /types/{share_type_id}/extra_specs -# -"share_types_extra_spec:create": "rule:admin" - -# Get share type extra specs of a given share type. -# GET /types/{share_type_id}/extra_specs -# -"share_types_extra_spec:show": "rule:admin or rule:reader" - -# Get details of a share type extra spec. -# GET /types/{share_type_id}/extra_specs/{extra_spec_id} -# -"share_types_extra_spec:index": "rule:admin or rule:reader" - -# Update share type extra spec. -# PUT /types/{share_type_id}/extra_specs -# -"share_types_extra_spec:update": "rule:admin" - -# Delete share type extra spec. -# DELETE /types/{share_type_id}/extra_specs/{key} -# -"share_types_extra_spec:delete": "rule:admin" - -### Policy Rules defined in manila.policies.shares - -# Create share. -# POST /shares -# -"share:create": "rule:default" - -# Get share. -# GET /shares/{share_id} -# -"share:get": "rule:default or rule:reader" - -# List shares. -# GET /shares -# GET /shares/detail -# -"share:get_all": "rule:default or rule:reader" - -# Update share. -# PUT /shares -# -"share:update": "rule:default" - -# Delete share. -# DELETE /shares/{share_id} -# -"share:delete": "rule:default" - -# Force Delete a share. -# DELETE /shares/{share_id} -# -"share:force_delete": "rule:admin" - -# Manage share. -# POST /shares/manage -# -"share:manage": "rule:admin" - -# Unmanage share. -# POST /shares/unmanage -# -"share:unmanage": "rule:admin" - -# Create share snapshot. -# POST /snapshots -# -"share:create_snapshot": "rule:default" - -# List share by host. -# GET /shares -# GET /shares/detail -# -"share:list_by_host": "rule:admin or rule:reader" - -# List share by server id. -# GET /shares -# GET /shares/detail -# -"share:list_by_share_server_id": "rule:admin or rule:reader" - -# Get share access rule, it under deny access operation. -# POST /shares/{share_id}/action -# -"share:access_get": "rule:default or rule:reader" - -# List share access rules. -# GET /shares/{share_id}/action -# -"share:access_get_all": "rule:default or rule:reader" - -# Extend share. -# POST /shares/{share_id}/action -# -"share:extend": "rule:default" - -# Shrink share. -# POST /shares/{share_id}/action -# -"share:shrink": "rule:default" - -# Migrate a share to the specified host. -# POST /shares/{share_id}/action -# -"share:migration_start": "rule:admin" - -# Invokes 2nd phase of share migration. -# POST /shares/{share_id}/action -# -"share:migration_complete": "rule:admin" - -# Attempts to cancel share migration. -# POST /shares/{share_id}/action -# -"share:migration_cancel": "rule:admin" - -# Retrieve share migration progress for a given share. -# POST /shares/{share_id}/action -# -"share:migration_get_progress": "rule:admin or rule:reader" - -# Reset task state. -# POST /shares/{share_id}/action -# -"share:reset_task_state": "rule:admin" - -# Reset status. -# POST /shares/{share_id}/action -# -"share:reset_status": "rule:admin" - -# Revert a share to a snapshot. -# POST /shares/{share_id}/action -# -"share:revert_to_snapshot": "rule:default" - -# Add share access rule. -# POST /shares/{share_id}/action -# -"share:allow_access": "rule:default" - -# Remove share access rule. -# POST /shares/{share_id}/action -# -"share:deny_access": "rule:default" - -# Delete share snapshot. -# DELETE /snapshots/{snapshot_id} -# -"share:delete_snapshot": "rule:default" - -# Update share snapshot. -# PUT /snapshots/{snapshot_id}/action -# -"share:snapshot_update": "rule:default" - -# Update share metadata. -# PUT /shares/{share_id}/metadata -# -"share:update_share_metadata": "rule:default" - -# Delete share metadata. -# DELETE /shares/{share_id}/metadata/{key} -# -"share:delete_share_metadata": "rule:default" - -# Get share metadata. -# GET /shares/{share_id}/metadata -# -"share:get_share_metadata": "rule:default or rule:reader" diff --git a/etc/neutron/policy.json b/etc/neutron/policy.json deleted file mode 100644 index e867e5a..0000000 --- a/etc/neutron/policy.json +++ /dev/null @@ -1,211 +0,0 @@ -{ - "global_reader": "(role:global_reader)", - "reader": "((role:reader and project_id:%(project_id)s) or rule:global_reader)", - "_member_role": "(role:Member or role:member or role:_member_)", - "member": "(rule:_member_role and project_id:%(project_id)s)", - "admin": "(is_admin:True or role:admin)", - "owner": "(rule:_member_role and user_id:%(user_id)s)", - "context_is_advsvc": "role:advsvc", - "network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)", - "admin_or_data_plane_int": "rule:admin or role:data_plane_integrator", - "shared": "field:networks:shared=True", - "shared_subnetpools": "field:subnetpools:shared=True", - "shared_address_scopes": "field:address_scopes:shared=True", - "external": "field:networks:router:external=True", - "default": "rule:admin or rule:member", - "create_subnet": "rule:admin or rule:network_owner", - "create_subnet:segment_id": "rule:admin", - "create_subnet:service_types": "rule:admin", - "get_subnet": "rule:admin or rule:member or rule:shared or rule:reader", - "get_subnet:segment_id": "rule:admin or rule:reader", - "update_subnet": "rule:admin or rule:network_owner", - "update_subnet:service_types": "rule:admin", - "delete_subnet": "rule:admin or rule:network_owner", - "create_subnetpool": "rule:admin or rule:member", - "create_subnetpool:shared": "rule:admin", - "create_subnetpool:is_default": "rule:admin", - "get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader", - "update_subnetpool": "rule:admin or rule:member", - "update_subnetpool:is_default": "rule:admin", - "delete_subnetpool": "rule:admin or rule:member", - "create_address_scope": "rule:admin or rule:member", - "create_address_scope:shared": "rule:admin", - "get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader", - "update_address_scope": "rule:admin or rule:member", - "update_address_scope:shared": "rule:admin", - "delete_address_scope": "rule:admin or rule:member", - "create_network": "rule:admin or rule:member", - "get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader", - "get_network:router:external": "rule:admin or rule:member or rule:reader", - "get_network:segments": "rule:admin or rule:reader", - "get_network:provider:network_type": "rule:admin or rule:reader", - "get_network:provider:physical_network": "rule:admin or rule:reader", - "get_network:provider:segmentation_id": "rule:admin or rule:reader", - "get_network:queue_id": "rule:admin or rule:reader", - "get_network_ip_availabilities": "rule:admin or rule:reader", - "get_network_ip_availability": "rule:admin or rule:reader", - "create_network:shared": "rule:admin", - "create_network:router:external": "rule:admin", - "create_network:is_default": "rule:admin", - "create_network:segments": "rule:admin", - "create_network:provider:network_type": "rule:admin", - "create_network:provider:physical_network": "rule:admin", - "create_network:provider:segmentation_id": "rule:admin", - "update_network": "rule:admin or rule:member", - "update_network:segments": "rule:admin", - "update_network:shared": "rule:admin", - "update_network:provider:network_type": "rule:admin", - "update_network:provider:physical_network": "rule:admin", - "update_network:provider:segmentation_id": "rule:admin", - "update_network:router:external": "rule:admin", - "delete_network": "rule:admin or rule:member", - "create_segment": "rule:admin", - "get_segment": "rule:admin or rule:reader", - "update_segment": "rule:admin", - "delete_segment": "rule:admin", - "network_device": "field:port:device_owner=~^network:", - "create_port": "rule:admin or rule:member", - "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", - "create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", - "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "create_port:binding:host_id": "rule:admin", - "create_port:binding:profile": "rule:admin", - "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "create_port:allowed_address_pairs": "rule:admin or rule:network_owner", - "get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader", - "get_port:queue_id": "rule:admin or rule:reader", - "get_port:binding:vif_type": "rule:admin or rule:reader", - "get_port:binding:vif_details": "rule:admin or rule:reader", - "get_port:binding:host_id": "rule:admin or rule:reader", - "get_port:binding:profile": "rule:admin or rule:reader", - "update_port": "rule:admin or rule:member or rule:context_is_advsvc", - "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", - "update_port:mac_address": "rule:admin or rule:context_is_advsvc", - "update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", - "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "update_port:binding:host_id": "rule:admin", - "update_port:binding:profile": "rule:admin", - "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", - "update_port:allowed_address_pairs": "rule:admin or rule:network_owner", - "update_port:data_plane_status": "rule:admin_or_data_plane_int", - "delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner", - "get_router:ha": "rule:admin or rule:reader", - "create_router": "rule:admin or rule:member", - "create_router:external_gateway_info:enable_snat": "rule:admin", - "create_router:distributed": "rule:admin", - "create_router:ha": "rule:admin", - "get_router": "rule:admin or rule:member or rule:reader", - "get_router:distributed": "rule:admin or rule:reader", - "update_router": "rule:admin or rule:member", - "update_router:external_gateway_info": "rule:admin or rule:member", - "update_router:external_gateway_info:network_id": "rule:admin or rule:member", - "update_router:external_gateway_info:enable_snat": "rule:admin", - "update_router:distributed": "rule:admin", - "update_router:ha": "rule:admin", - "delete_router": "rule:admin or rule:member", - "add_router_interface": "rule:admin or rule:member", - "remove_router_interface": "rule:admin or rule:member", - "create_router:external_gateway_info:external_fixed_ips": "rule:admin", - "update_router:external_gateway_info:external_fixed_ips": "rule:admin", - "create_qos_queue": "rule:admin", - "get_qos_queue": "rule:admin or rule:reader", - "update_agent": "rule:admin", - "delete_agent": "rule:admin", - "get_agent": "rule:admin or rule:reader", - "create_dhcp-network": "rule:admin", - "delete_dhcp-network": "rule:admin", - "get_dhcp-networks": "rule:admin or rule:reader", - "create_l3-router": "rule:admin", - "delete_l3-router": "rule:admin", - "get_l3-routers": "rule:admin or rule:reader", - "get_dhcp-agents": "rule:admin or rule:reader", - "get_l3-agents": "rule:admin or rule:reader", - "get_loadbalancer-agent": "rule:admin or rule:reader", - "get_loadbalancer-pools": "rule:admin or rule:reader", - "get_agent-loadbalancers": "rule:admin or rule:reader", - "get_loadbalancer-hosting-agent": "rule:admin or rule:reader", - "create_floatingip": "rule:admin or rule:member", - "create_floatingip:floating_ip_address": "rule:admin", - "update_floatingip": "rule:admin or rule:member", - "delete_floatingip": "rule:admin or rule:member", - "get_floatingip": "rule:admin or rule:member or rule:reader", - "create_network_profile": "rule:admin", - "update_network_profile": "rule:admin", - "delete_network_profile": "rule:admin", - "get_network_profiles": "rule:admin or rule:member or rule:reader", - "get_network_profile": "rule:admin or rule:member or rule:reader", - "update_policy_profiles": "rule:admin", - "get_policy_profiles": "rule:admin or rule:member or rule:reader", - "get_policy_profile": "rule:admin or rule:member or rule:reader", - "create_metering_label": "rule:admin", - "delete_metering_label": "rule:admin", - "get_metering_label": "rule:admin or rule:reader", - "create_metering_label_rule": "rule:admin", - "delete_metering_label_rule": "rule:admin", - "get_metering_label_rule": "rule:admin or rule:reader", - "get_service_provider": "rule:admin or rule:member or rule:reader", - "get_lsn": "rule:admin or rule:reader", - "create_lsn": "rule:admin", - "create_flavor": "rule:admin", - "update_flavor": "rule:admin", - "delete_flavor": "rule:admin", - "get_flavors": "rule:admin or rule:member or rule:reader", - "get_flavor": "rule:admin or rule:member or rule:reader", - "create_service_profile": "rule:admin", - "update_service_profile": "rule:admin", - "delete_service_profile": "rule:admin", - "get_service_profiles": "rule:admin or rule:reader", - "get_service_profile": "rule:admin or rule:reader", - "get_policy": "rule:admin or rule:member or rule:reader", - "create_policy": "rule:admin", - "update_policy": "rule:admin", - "delete_policy": "rule:admin", - "get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader", - "create_policy_bandwidth_limit_rule": "rule:admin", - "delete_policy_bandwidth_limit_rule": "rule:admin", - "update_policy_bandwidth_limit_rule": "rule:admin", - "get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader", - "create_policy_dscp_marking_rule": "rule:admin", - "delete_policy_dscp_marking_rule": "rule:admin", - "update_policy_dscp_marking_rule": "rule:admin", - "get_rule_type": "rule:admin or rule:member or rule:reader", - "get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader", - "create_policy_minimum_bandwidth_rule": "rule:admin", - "delete_policy_minimum_bandwidth_rule": "rule:admin", - "update_policy_minimum_bandwidth_rule": "rule:admin", - "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin", - "create_rbac_policy": "rule:admin or rule:member", - "create_rbac_policy:target_tenant": "rule:restrict_wildcard", - "update_rbac_policy": "rule:admin or rule:member", - "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member", - "get_rbac_policy": "rule:admin or rule:member or rule:reader", - "delete_rbac_policy": "rule:admin or rule:member", - "create_flavor_service_profile": "rule:admin", - "delete_flavor_service_profile": "rule:admin", - "get_flavor_service_profile": "rule:admin or rule:member or rule:reader", - "get_auto_allocated_topology": "rule:admin or rule:member or rule:reader", - "create_trunk": "rule:admin or rule:member", - "get_trunk": "rule:admin or rule:member or rule:reader", - "delete_trunk": "rule:admin or rule:member", - "get_subports": "rule:admin or rule:member or rule:reader", - "add_subports": "rule:admin or rule:member", - "remove_subports": "rule:admin or rule:member", - "get_security_groups": "rule:admin or rule:member or rule:reader", - "get_security_group": "rule:admin or rule:member or rule:reader", - "create_security_group": "rule:admin or rule:member", - "update_security_group": "rule:admin or rule:member", - "delete_security_group": "rule:admin or rule:member", - "get_security_group_rules": "rule:admin or rule:member or rule:reader", - "get_security_group_rule": "rule:admin or rule:member or rule:reader", - "create_security_group_rule": "rule:admin or rule:member", - "delete_security_group_rule": "rule:admin or rule:member", - "get_loggable_resources": "rule:admin or rule:reader", - "create_log": "rule:admin", - "update_log": "rule:admin", - "delete_log": "rule:admin", - "get_logs": "rule:admin or rule:reader", - "get_log": "rule:admin or rule:reader" -} diff --git a/etc/neutron/policy.yaml b/etc/neutron/policy.yaml deleted file mode 100644 index 604ab95..0000000 --- a/etc/neutron/policy.yaml +++ /dev/null @@ -1,258 +0,0 @@ -# FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON - -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -"context_is_advsvc": "role:advsvc" -"network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)" -"admin_or_data_plane_int": "rule:admin or role:data_plane_integrator" -"shared": "field:networks:shared=True" -"shared_subnetpools": "field:subnetpools:shared=True" -"shared_address_scopes": "field:address_scopes:shared=True" -"external": "field:networks:router:external=True" - -# "context_is_admin": "role:admin" -# "owner": "tenant_id:%(tenant_id)s" -# "admin_or_owner": "rule:context_is_admin or rule:owner" -# "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s" -# "admin_owner_or_network_owner": "rule:owner or rule:admin or rule:network_owner" -# "admin_only": "rule:context_is_admin" -# "regular_user": "rule:admin or rule:member" -"default": "rule:admin or rule:member" - -"create_subnet": "rule:admin or rule:network_owner" -"create_subnet:segment_id": "rule:admin" -"create_subnet:service_types": "rule:admin" -"get_subnet": "rule:admin or rule:member or rule:shared or rule:reader" -"get_subnet:segment_id": "rule:admin or rule:reader" -"update_subnet": "rule:admin or rule:network_owner" -"update_subnet:service_types": "rule:admin" -"delete_subnet": "rule:admin or rule:network_owner" - -"create_subnetpool": "rule:admin or rule:member" -"create_subnetpool:shared": "rule:admin" -"create_subnetpool:is_default": "rule:admin" -"get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader" -"update_subnetpool": "rule:admin or rule:member" -"update_subnetpool:is_default": "rule:admin" -"delete_subnetpool": "rule:admin or rule:member" - -"create_address_scope": "rule:admin or rule:member" -"create_address_scope:shared": "rule:admin" -"get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader" -"update_address_scope": "rule:admin or rule:member" -"update_address_scope:shared": "rule:admin" -"delete_address_scope": "rule:admin or rule:member" - -"create_network": "rule:admin or rule:member" -"get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader" -"get_network:router:external": "rule:admin or rule:member or rule:reader" -"get_network:segments": "rule:admin or rule:reader" -"get_network:provider:network_type": "rule:admin or rule:reader" -"get_network:provider:physical_network": "rule:admin or rule:reader" -"get_network:provider:segmentation_id": "rule:admin or rule:reader" -"get_network:queue_id": "rule:admin or rule:reader" -"get_network_ip_availabilities": "rule:admin or rule:reader" -"get_network_ip_availability": "rule:admin or rule:reader" -"create_network:shared": "rule:admin" -"create_network:router:external": "rule:admin" -"create_network:is_default": "rule:admin" -"create_network:segments": "rule:admin" -"create_network:provider:network_type": "rule:admin" -"create_network:provider:physical_network": "rule:admin" -"create_network:provider:segmentation_id": "rule:admin" -"update_network": "rule:admin or rule:member" -"update_network:segments": "rule:admin" -"update_network:shared": "rule:admin" -"update_network:provider:network_type": "rule:admin" -"update_network:provider:physical_network": "rule:admin" -"update_network:provider:segmentation_id": "rule:admin" -"update_network:router:external": "rule:admin" -"delete_network": "rule:admin or rule:member" - -"create_segment": "rule:admin" -"get_segment": "rule:admin or rule:reader" -"update_segment": "rule:admin" -"delete_segment": "rule:admin" - -"network_device": "field:port:device_owner=~^network:" -"create_port": "rule:admin or rule:member" -"create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" -"create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" -"create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"create_port:binding:host_id": "rule:admin" -"create_port:binding:profile": "rule:admin" -"create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"create_port:allowed_address_pairs": "rule:admin or rule:network_owner" -"get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader" -"get_port:queue_id": "rule:admin or rule:reader" -"get_port:binding:vif_type": "rule:admin or rule:reader" -"get_port:binding:vif_details": "rule:admin or rule:reader" -"get_port:binding:host_id": "rule:admin or rule:reader" -"get_port:binding:profile": "rule:admin or rule:reader" -"update_port": "rule:admin or rule:member or rule:context_is_advsvc" -"update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" -"update_port:mac_address": "rule:admin or rule:context_is_advsvc" -"update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" -"update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"update_port:binding:host_id": "rule:admin" -"update_port:binding:profile": "rule:admin" -"update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" -"update_port:allowed_address_pairs": "rule:admin or rule:network_owner" -"update_port:data_plane_status": "rule:admin_or_data_plane_int" -"delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" - -"get_router:ha": "rule:admin or rule:reader" -"create_router": "rule:admin or rule:member" -"create_router:external_gateway_info:enable_snat": "rule:admin" -"create_router:distributed": "rule:admin" -"create_router:ha": "rule:admin" -"get_router": "rule:admin or rule:member or rule:reader" -"get_router:distributed": "rule:admin or rule:reader" -"update_router": "rule:admin or rule:member" -"update_router:external_gateway_info": "rule:admin or rule:member" -"update_router:external_gateway_info:network_id": "rule:admin or rule:member" -"update_router:external_gateway_info:enable_snat": "rule:admin" -"update_router:distributed": "rule:admin" -"update_router:ha": "rule:admin" -"delete_router": "rule:admin or rule:member" - -"add_router_interface": "rule:admin or rule:member" -"remove_router_interface": "rule:admin or rule:member" - -"create_router:external_gateway_info:external_fixed_ips": "rule:admin" -"update_router:external_gateway_info:external_fixed_ips": "rule:admin" - -"create_qos_queue": "rule:admin" -"get_qos_queue": "rule:admin or rule:reader" - -"update_agent": "rule:admin" -"delete_agent": "rule:admin" -"get_agent": "rule:admin or rule:reader" - -"create_dhcp-network": "rule:admin" -"delete_dhcp-network": "rule:admin" -"get_dhcp-networks": "rule:admin or rule:reader" -"create_l3-router": "rule:admin" -"delete_l3-router": "rule:admin" -"get_l3-routers": "rule:admin or rule:reader" -"get_dhcp-agents": "rule:admin or rule:reader" -"get_l3-agents": "rule:admin or rule:reader" -"get_loadbalancer-agent": "rule:admin or rule:reader" -"get_loadbalancer-pools": "rule:admin or rule:reader" -"get_agent-loadbalancers": "rule:admin or rule:reader" -"get_loadbalancer-hosting-agent": "rule:admin or rule:reader" - -"create_floatingip": "rule:admin or rule:member" -"create_floatingip:floating_ip_address": "rule:admin" -"update_floatingip": "rule:admin or rule:member" -"delete_floatingip": "rule:admin or rule:member" -"get_floatingip": "rule:admin or rule:member or rule:reader" - -"create_network_profile": "rule:admin" -"update_network_profile": "rule:admin" -"delete_network_profile": "rule:admin" -"get_network_profiles": "rule:admin or rule:member or rule:reader" -"get_network_profile": "rule:admin or rule:member or rule:reader" -"update_policy_profiles": "rule:admin" -"get_policy_profiles": "rule:admin or rule:member or rule:reader" -"get_policy_profile": "rule:admin or rule:member or rule:reader" - -"create_metering_label": "rule:admin" -"delete_metering_label": "rule:admin" -"get_metering_label": "rule:admin or rule:reader" - -"create_metering_label_rule": "rule:admin" -"delete_metering_label_rule": "rule:admin" -"get_metering_label_rule": "rule:admin or rule:reader" - -"get_service_provider": "rule:admin or rule:member or rule:reader" -"get_lsn": "rule:admin or rule:reader" -"create_lsn": "rule:admin" - -"create_flavor": "rule:admin" -"update_flavor": "rule:admin" -"delete_flavor": "rule:admin" -"get_flavors": "rule:admin or rule:member or rule:reader" -"get_flavor": "rule:admin or rule:member or rule:reader" -"create_service_profile": "rule:admin" -"update_service_profile": "rule:admin" -"delete_service_profile": "rule:admin" -"get_service_profiles": "rule:admin or rule:reader" -"get_service_profile": "rule:admin or rule:reader" - -"get_policy": "rule:admin or rule:member or rule:reader" -"create_policy": "rule:admin" -"update_policy": "rule:admin" -"delete_policy": "rule:admin" -"get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader" -"create_policy_bandwidth_limit_rule": "rule:admin" -"delete_policy_bandwidth_limit_rule": "rule:admin" -"update_policy_bandwidth_limit_rule": "rule:admin" -"get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader" -"create_policy_dscp_marking_rule": "rule:admin" -"delete_policy_dscp_marking_rule": "rule:admin" -"update_policy_dscp_marking_rule": "rule:admin" -"get_rule_type": "rule:admin or rule:member or rule:reader" -"get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader" -"create_policy_minimum_bandwidth_rule": "rule:admin" -"delete_policy_minimum_bandwidth_rule": "rule:admin" -"update_policy_minimum_bandwidth_rule": "rule:admin" - -"restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin" -"create_rbac_policy": "rule:admin or rule:member" -"create_rbac_policy:target_tenant": "rule:restrict_wildcard" -"update_rbac_policy": "rule:admin or rule:member" -"update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member" -"get_rbac_policy": "rule:admin or rule:member or rule:reader" -"delete_rbac_policy": "rule:admin or rule:member" - -"create_flavor_service_profile": "rule:admin" -"delete_flavor_service_profile": "rule:admin" -"get_flavor_service_profile": "rule:admin or rule:member or rule:reader" -"get_auto_allocated_topology": "rule:admin or rule:member or rule:reader" - -"create_trunk": "rule:admin or rule:member" -"get_trunk": "rule:admin or rule:member or rule:reader" -"delete_trunk": "rule:admin or rule:member" -"get_subports": "rule:admin or rule:member or rule:reader" -"add_subports": "rule:admin or rule:member" -"remove_subports": "rule:admin or rule:member" - -"get_security_groups": "rule:admin or rule:member or rule:reader" -"get_security_group": "rule:admin or rule:member or rule:reader" -"create_security_group": "rule:admin or rule:member" -"update_security_group": "rule:admin or rule:member" -"delete_security_group": "rule:admin or rule:member" -"get_security_group_rules": "rule:admin or rule:member or rule:reader" -"get_security_group_rule": "rule:admin or rule:member or rule:reader" -"create_security_group_rule": "rule:admin or rule:member" -"delete_security_group_rule": "rule:admin or rule:member" - -"get_loggable_resources": "rule:admin or rule:reader" -"create_log": "rule:admin" -"update_log": "rule:admin" -"delete_log": "rule:admin" -"get_logs": "rule:admin or rule:reader" -"get_log": "rule:admin or rule:reader" diff --git a/etc/nova/policy.yaml b/etc/nova/policy.yaml deleted file mode 100644 index d83de2f..0000000 --- a/etc/nova/policy.yaml +++ /dev/null @@ -1,989 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# RULES: - -# Reset the state of a given server -# POST /servers/{server_id}/action (os-resetState) -"os_compute_api:os-admin-actions:reset_state": "rule:admin" - -# Inject network information into the server -# POST /servers/{server_id}/action (injectNetworkInfo) -"os_compute_api:os-admin-actions:inject_network_info": "rule:admin" - -# Reset networking on a server -# POST /servers/{server_id}/action (resetNetwork) -"os_compute_api:os-admin-actions:reset_network": "rule:admin" - -# Change the administrative password for a server -# POST /servers/{server_id}/action (changePassword) -"os_compute_api:os-admin-password": "rule:admin or rule:member" - -# Create, list, update, and delete guest agent builds -# -# This is XenAPI driver specific. -# It is used to force the upgrade of the XenAPI guest agent on -# instance boot. -# GET /os-agents -# POST /os-agents -# PUT /os-agents/{agent_build_id} -# DELETE /os-agents/{agent_build_id} -"os_compute_api:os-agents": "rule:admin" - -# Create or replace metadata for an aggregate -# POST /os-aggregates/{aggregate_id}/action (set_metadata) -"os_compute_api:os-aggregates:set_metadata": "rule:admin" - -# Add a host to an aggregate -# POST /os-aggregates/{aggregate_id}/action (add_host) -"os_compute_api:os-aggregates:add_host": "rule:admin" - -# Create an aggregate -# POST /os-aggregates -"os_compute_api:os-aggregates:create": "rule:admin" - -# Remove a host from an aggregate -# POST /os-aggregates/{aggregate_id}/action (remove_host) -"os_compute_api:os-aggregates:remove_host": "rule:admin" - -# Update name and/or availability zone for an aggregate -# PUT /os-aggregates/{aggregate_id} -"os_compute_api:os-aggregates:update": "rule:admin" - -# List all aggregates -# GET /os-aggregates -"os_compute_api:os-aggregates:index": "rule:admin or rule:reader" - -# Delete an aggregate -# DELETE /os-aggregates/{aggregate_id} -"os_compute_api:os-aggregates:delete": "rule:admin" - -# Show details for an aggregate -# GET /os-aggregates/{aggregate_id} -"os_compute_api:os-aggregates:show": "rule:admin or rule:reader" - -# Create an assisted volume snapshot -# POST /os-assisted-volume-snapshots -"os_compute_api:os-assisted-volume-snapshots:create": "rule:admin" - -# Delete an assisted volume snapshot -# DELETE /os-assisted-volume-snapshots/{snapshot_id} -"os_compute_api:os-assisted-volume-snapshots:delete": "rule:admin" - -# List port interfaces or show details of a port interface attached to -# a server -# GET /servers/{server_id}/os-interface -# GET /servers/{server_id}/os-interface/{port_id} -"os_compute_api:os-attach-interfaces": "rule:admin or rule:member or rule:reader" - -# Attach an interface to a server -# POST /servers/{server_id}/os-interface -"os_compute_api:os-attach-interfaces:create": "rule:admin or rule:member" - -# Detach an interface from a server -# DELETE /servers/{server_id}/os-interface/{port_id} -"os_compute_api:os-attach-interfaces:delete": "rule:admin or rule:member" - -# List availability zone information without host information -# GET /os-availability-zone -"os_compute_api:os-availability-zone:list": "rule:admin or rule:member or rule:reader" - -# List detailed availability zone information with host information -# GET /os-availability-zone/detail -"os_compute_api:os-availability-zone:detail": "rule:admin or rule:reader" - -# List and show details of bare metal nodes. -# -# These APIs are proxy calls to the Ironic service and are deprecated. -# GET /os-baremetal-nodes -# GET /os-baremetal-nodes/{node_id} -"os_compute_api:os-baremetal-nodes": "rule:admin or rule:reader" - -# Update an existing cell -# PUT /os-cells/{cell_id} -"os_compute_api:os-cells:update": "rule:admin" - -# Create a new cell -# POST /os-cells -"os_compute_api:os-cells:create": "rule:admin" - -# List and show detailed info for a given cell or all cells -# GET /os-cells -# GET /os-cells/detail -# GET /os-cells/info -# GET /os-cells/capacities -# GET /os-cells/{cell_id} -"os_compute_api:os-cells": "rule:admin or rule:reader" - -# Sync instances info in all cells -# POST /os-cells/sync_instances -"os_compute_api:os-cells:sync_instances": "rule:admin" - -# Remove a cell -# DELETE /os-cells/{cell_id} -"os_compute_api:os-cells:delete": "rule:admin" - -# Different cell filter to route a build away from a particular cell -# -# This policy is read by nova-scheduler process. -"cells_scheduler_filter:DifferentCellFilter": "rule:admin" - -# Target cell filter to route a build to a particular cell -# -# This policy is read by nova-scheduler process. -"cells_scheduler_filter:TargetCellFilter": "rule:admin" - -# DEPRECATED -# "os_compute_api:os-config-drive" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-config-drive" policy which was -# added for extensions is not needed any more -# Add 'config_drive' attribute in the server response -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-config-drive": "rule:admin or rule:member" - -# Show console connection information for a given console -# authentication token -# GET /os-console-auth-tokens/{console_token} -"os_compute_api:os-console-auth-tokens": "rule:admin or rule:reader" - -# Show console output for a server -# POST /servers/{server_id}/action (os-getConsoleOutput) -"os_compute_api:os-console-output": "rule:admin or rule:member or rule:reader" - -# Create a console for a server instance -# POST /servers/{server_id}/consoles -"os_compute_api:os-consoles:create": "rule:admin or rule:member" - -# Show console details for a server instance -# GET /servers/{server_id}/consoles/{console_id} -"os_compute_api:os-consoles:show": "rule:admin or rule:member or rule:reader" - -# Delete a console for a server instance -# DELETE /servers/{server_id}/consoles/{console_id} -"os_compute_api:os-consoles:delete": "rule:admin or rule:member" - -# List all consoles for a server instance -# GET /servers/{server_id}/consoles -"os_compute_api:os-consoles:index": "rule:admin or rule:member or rule:reader" - -# Create a back up of a server -# POST /servers/{server_id}/action (createBackup) -"os_compute_api:os-create-backup": "rule:admin or rule:member" - -# Restore a soft deleted server or force delete a server before -# deferred cleanup -# POST /servers/{server_id}/action (restore) -# POST /servers/{server_id}/action (forceDelete) -"os_compute_api:os-deferred-delete": "rule:admin or rule:member" - -# Evacuate a server from a failed host to a new host -# POST /servers/{server_id}/action (evacuate) -"os_compute_api:os-evacuate": "rule:admin" - -# DEPRECATED -# "os_compute_api:os-extended-availability-zone" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-extended-availability-zone" -# policy which was added for extensions is not needed any more -# Add `OS-EXT-AZ:availability_zone` into the server response -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-extended-availability-zone": "rule:admin or rule:member" - -# Return extended attributes for server. -# -# This rule will control the visibility for a set of servers -# attributes: -# -# - ``OS-EXT-SRV-ATTR:host`` -# - ``OS-EXT-SRV-ATTR:instance_name`` -# - ``OS-EXT-SRV-ATTR:reservation_id`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:launch_index`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:hostname`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:kernel_id`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:ramdisk_id`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:root_device_name`` (since microversion 2.3) -# - ``OS-EXT-SRV-ATTR:user_data`` (since microversion 2.3) -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-extended-server-attributes": "rule:admin or rule:member or rule:reader" - -# DEPRECATED -# "os_compute_api:os-extended-status" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-extended-status" policy which was -# added for extensions is not needed any more -# Return extended status in the response of server. -# -# This policy will control the visibility for a set of attributes: -# -# - ``OS-EXT-STS:task_state`` -# - ``OS-EXT-STS:vm_state`` -# - ``OS-EXT-STS:power_state`` -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-extended-status": "rule:admin or rule:member or rule:reader" - -# DEPRECATED -# "os_compute_api:os-extended-volumes" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-extended-volumes" policy which -# was added for extensions is not needed any more -# Return 'os-extended-volumes:volumes_attached' in the response of -# server -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-extended-volumes": "rule:admin or rule:member or rule:reader" - -# List available extensions and show information for an extension by -# alias -# GET /extensions -# GET /extensions/{alias} -"os_compute_api:extensions": "rule:admin or rule:member or rule:reader" - -# Add flavor access to a tenant -# POST /flavors/{flavor_id}/action (addTenantAccess) -"os_compute_api:os-flavor-access:add_tenant_access": "rule:admin" - -# Remove flavor access from a tenant -# POST /flavors/{flavor_id}/action (removeTenantAccess) -"os_compute_api:os-flavor-access:remove_tenant_access": "rule:admin" - -# DEPRECATED -# "os_compute_api:os-flavor-access" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-flavor-access" policy for POST, -# PUT, GET /flavors which was added for extensions is not needed any -# more. NOTE: This policy is deprecated only for POST /flavors, PUT -# /flavors, GET /flavors/{flavor_id} & GET /flavors/detail. This -# policy for other API operations is still valid and not deprecated -# List flavor access information -# -# Adds the os-flavor-access:is_public key into several flavor APIs. -# -# It also allows access to the full list of tenants that have access -# to a flavor via an os-flavor-access API. -# GET /flavors/{flavor_id}/os-flavor-access -# GET /flavors/detail -# GET /flavors/{flavor_id} -# POST /flavors -# PUT /flavors/{flavor_id} -"os_compute_api:os-flavor-access": "rule:admin or rule:member" - -# Show an extra spec for a flavor -# GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} -"os_compute_api:os-flavor-extra-specs:show": "rule:admin or rule:member or rule:reader" - -# Create extra specs for a flavor -# POST /flavors/{flavor_id}/os-extra_specs/ -"os_compute_api:os-flavor-extra-specs:create": "rule:admin" - -# Update an extra spec for a flavor -# PUT /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} -"os_compute_api:os-flavor-extra-specs:update": "rule:admin" - -# Delete an extra spec for a flavor -# DELETE /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} -"os_compute_api:os-flavor-extra-specs:delete": "rule:admin" - -# List extra specs for a flavor. Starting with microversion 2.47, the -# flavor used for a server is also returned in the response when -# showing server details, updating a server or rebuilding a server. -# Starting with microversion 2.61, extra specs may be returned in -# responses for the flavor resource. -# GET /flavors/{flavor_id}/os-extra_specs/ -# GET /servers/detail -# GET /servers/{server_id} -# PUT /servers/{server_id} -# POST /servers/{server_id}/action (rebuild) -# POST /flavors -# GET /flavors/detail -# GET /flavors/{flavor_id} -# PUT /flavors/{flavor_id} -"os_compute_api:os-flavor-extra-specs:index": "rule:admin or rule:member" - -# Create and delete Flavors. Deprecated in Pike and will be removed in -# future release -# POST /flavors -# DELETE /flavors/{flavor_id} -"os_compute_api:os-flavor-manage": "rule:admin" - -# Create a flavor -# POST /flavors -"os_compute_api:os-flavor-manage:create": "rule:os_compute_api:os-flavor-manage" - -# Update a flavor -# PUT /flavors/{flavor_id} -"os_compute_api:os-flavor-manage:update": "rule:admin" - -# Delete a flavor -# DELETE /flavors/{flavor_id} -"os_compute_api:os-flavor-manage:delete": "rule:os_compute_api:os-flavor-manage" - -# DEPRECATED -# "os_compute_api:os-flavor-rxtx" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-flavor-rxtx" policy which was -# added for extensions is not needed any more -# Add the rxtx_factor key into some Flavor APIs -# GET /flavors/detail -# GET /flavors/{flavor_id} -# POST /flavors -# PUT /flavors/{flavor_id} -"os_compute_api:os-flavor-rxtx": "rule:admin or rule:member" - -# Deprecated in Pike and will be removed in next release -"os_compute_api:flavors": "rule:admin or rule:member" - -# List floating IP pools. This API is deprecated. -# GET /os-floating-ip-pools -"os_compute_api:os-floating-ip-pools": "rule:admin or rule:member or rule:reader" - -# Manage a project's floating IPs. These APIs are all deprecated. -# POST /servers/{server_id}/action (addFloatingIp) -# POST /servers/{server_id}/action (removeFloatingIp) -# GET /os-floating-ips -# POST /os-floating-ips -# GET /os-floating-ips/{floating_ip_id} -# DELETE /os-floating-ips/{floating_ip_id} -"os_compute_api:os-floating-ips": "rule:admin or rule:member" - -# DEPRECATED -# "os_compute_api:os-hide-server-addresses" has been deprecated since 17.0.0. -# Capability of configuring the server states to hide the address has -# been deprecated for removal. Now this policy is not needed to -# control the server address -# Hide server's 'addresses' key in the server response. -# -# This set the 'addresses' key in the server response to an empty -# dictionary when the server is in a specific set of states as -# defined in CONF.api.hide_server_address_states. -# By default 'addresses' is hidden only when the server is in -# 'BUILDING' state. -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-hide-server-addresses": "rule:admin or rule:member" - -# List, show and manage physical hosts. -# -# These APIs are all deprecated in favor of os-hypervisors and os- -# services. -# GET /os-hosts -# GET /os-hosts/{host_name} -# PUT /os-hosts/{host_name} -# GET /os-hosts/{host_name}/reboot -# GET /os-hosts/{host_name}/shutdown -# GET /os-hosts/{host_name}/startup -"os_compute_api:os-hosts": "rule:admin" - -# Policy rule for hypervisor related APIs. -# -# This rule will be checked for the following APIs: -# -# List all hypervisors, list all hypervisors with details, show -# summary statistics for all hypervisors over all compute nodes, -# show details for a hypervisor, show the uptime of a hypervisor, -# search hypervisor by hypervisor_hostname pattern and list all -# servers on hypervisors that can match the provided -# hypervisor_hostname pattern. -# GET /os-hypervisors -# GET /os-hypervisors/details -# GET /os-hypervisors/statistics -# GET /os-hypervisors/{hypervisor_id} -# GET /os-hypervisors/{hypervisor_id}/uptime -# GET /os-hypervisors/{hypervisor_hostname_pattern}/search -# GET /os-hypervisors/{hypervisor_hostname_pattern}/servers -"os_compute_api:os-hypervisors": "rule:admin or rule:reader" - -# DEPRECATED -# "os_compute_api:image-size" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:image-size" policy which was added -# for extensions is not needed any more -# Add 'OS-EXT-IMG-SIZE:size' attribute in the image response. -# GET /images/{id} -# GET /images/detail -"os_compute_api:image-size": "rule:admin or rule:member or rule:reader" - -# Add events details in action details for a server. -# -# This check is performed only after the check -# os_compute_api:os-instance-actions passes. Beginning with -# Microversion 2.51, events details are always included; traceback -# information is provided per event if policy enforcement passes. -# Beginning with Microversion 2.62, each event includes a hashed -# host identifier and, if policy enforcement passes, the name of -# the host. -# GET /servers/{server_id}/os-instance-actions/{request_id} -"os_compute_api:os-instance-actions:events": "rule:admin or rule:reader" - -# List actions and show action details for a server. -# GET /servers/{server_id}/os-instance-actions -# GET /servers/{server_id}/os-instance-actions/{request_id} -"os_compute_api:os-instance-actions": "rule:admin or rule:member or rule:reader" - -# List all usage audits and that occurred before a specified time for -# all servers on all compute hosts where usage auditing is configured -# GET /os-instance_usage_audit_log -# GET /os-instance_usage_audit_log/{before_timestamp} -"os_compute_api:os-instance-usage-audit-log": "rule:admin or rule:reader" - -# Show IP addresses details for a network label of a server -# GET /servers/{server_id}/ips/{network_label} -"os_compute_api:ips:show": "rule:admin or rule:member or rule:reader" - -# List IP addresses that are assigned to a server -# GET /servers/{server_id}/ips -"os_compute_api:ips:index": "rule:admin or rule:member or rule:reader" - -# List all keypairs -# GET /os-keypairs -"os_compute_api:os-keypairs:index": "rule:admin or rule:owner" - -# Create a keypair -# POST /os-keypairs -"os_compute_api:os-keypairs:create": "rule:admin or rule:owner" - -# Delete a keypair -# DELETE /os-keypairs/{keypair_name} -"os_compute_api:os-keypairs:delete": "rule:admin or rule:owner" - -# Show details of a keypair -# GET /os-keypairs/{keypair_name} -"os_compute_api:os-keypairs:show": "rule:admin or rule:owner" - -# DEPRECATED -# "os_compute_api:os-keypairs" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-keypairs" policy which was added -# for extensions is not needed any more -# Return 'key_name' in the response of server. -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-keypairs": "rule:admin or rule:member" - -# Show rate and absolute limits for the project -# GET /limits -"os_compute_api:limits": "rule:admin or rule:member or rule:reader" - -# Lock a server -# POST /servers/{server_id}/action (lock) -"os_compute_api:os-lock-server:lock": "rule:admin or rule:member" - -# Unlock a server -# POST /servers/{server_id}/action (unlock) -"os_compute_api:os-lock-server:unlock": "rule:admin or rule:member" - -# Unlock a server, regardless who locked the server. -# -# This check is performed only after the check -# os_compute_api:os-lock-server:unlock passes -# POST /servers/{server_id}/action (unlock) -"os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin" - -# Cold migrate a server to a host -# POST /servers/{server_id}/action (migrate) -"os_compute_api:os-migrate-server:migrate": "rule:admin" - -# Live migrate a server to a new host without a reboot -# POST /servers/{server_id}/action (os-migrateLive) -"os_compute_api:os-migrate-server:migrate_live": "rule:admin" - -# List migrations -# GET /os-migrations -"os_compute_api:os-migrations:index": "rule:admin or rule:reader" - -# Add or remove a fixed IP address from a server. -# -# These APIs are proxy calls to the Network service. These are all -# deprecated. -# POST /servers/{server_id}/action (addFixedIp) -# POST /servers/{server_id}/action (removeFixedIp) -"os_compute_api:os-multinic": "rule:admin or rule:member" - -# Create and delete a network, add and disassociate a network -# from a project. -# -# These APIs are only available with nova-network which is deprecated. -# POST /os-networks -# POST /os-networks/add -# DELETE /os-networks/{network_id} -# POST /os-networks/{network_id}/action (disassociate) -"os_compute_api:os-networks": "rule:admin" - -# List networks for the project and show details for a network. -# -# These APIs are proxy calls to the Network service. These are all -# deprecated. -# GET /os-networks -# GET /os-networks/{network_id} -"os_compute_api:os-networks:view": "rule:admin or rule:member or rule:reader" - -# Associate or disassociate a network from a host or project. -# -# These APIs are only available with nova-network which is deprecated. -# POST /os-networks/{network_id}/action (disassociate_host) -# POST /os-networks/{network_id}/action (disassociate_project) -# POST /os-networks/{network_id}/action (associate_host) -"os_compute_api:os-networks-associate": "rule:admin" - -# Pause a server -# POST /servers/{server_id}/action (pause) -"os_compute_api:os-pause-server:pause": "rule:admin or rule:member" - -# Unpause a paused server -# POST /servers/{server_id}/action (unpause) -"os_compute_api:os-pause-server:unpause": "rule:admin or rule:member" - -# List quotas for specific quota classs -# GET /os-quota-class-sets/{quota_class} -"os_compute_api:os-quota-class-sets:show": "rule:admin or quota_class:%(quota_class)s or rule:reader" - -# Update quotas for specific quota class -# PUT /os-quota-class-sets/{quota_class} -"os_compute_api:os-quota-class-sets:update": "rule:admin" - -# Update the quotas -# PUT /os-quota-sets/{tenant_id} -"os_compute_api:os-quota-sets:update": "rule:admin" - -# List default quotas -# GET /os-quota-sets/{tenant_id}/defaults -"os_compute_api:os-quota-sets:defaults": "@" - -# Show a quota -# GET /os-quota-sets/{tenant_id} -"os_compute_api:os-quota-sets:show": "rule:admin or rule:member or rule:reader" - -# Revert quotas to defaults -# DELETE /os-quota-sets/{tenant_id} -"os_compute_api:os-quota-sets:delete": "rule:admin" - -# Show the detail of quota -# GET /os-quota-sets/{tenant_id}/detail -"os_compute_api:os-quota-sets:detail": "rule:admin or rule:member or rule:reader" - -# Generate a URL to access remove server console -# POST /servers/{server_id}/action (os-getRDPConsole) -# POST /servers/{server_id}/action (os-getSerialConsole) -# POST /servers/{server_id}/action (os-getSPICEConsole) -# POST /servers/{server_id}/action (os-getVNCConsole) -# POST /servers/{server_id}/remote-consoles -"os_compute_api:os-remote-consoles": "rule:admin or rule:member" - -# Rescue/unrescue a server -# POST /servers/{server_id}/action (rescue) -# POST /servers/{server_id}/action (unrescue) -"os_compute_api:os-rescue": "rule:admin or rule:member" - -# List, show information for, create, or delete default security -# group rules. -# -# These APIs are only available with nova-network which is now -# deprecated. -# GET /os-security-group-default-rules -# GET /os-security-group-default-rules/{security_group_default_rule_id} -# POST /os-security-group-default-rules -# DELETE /os-security-group-default-rules/{security_group_default_rule_id} -"os_compute_api:os-security-group-default-rules": "rule:admin" - -# DEPRECATED -# "os_compute_api:os-security-groups" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-security-groups" policy for POST, -# GET /servers which was added for extensions is not needed any more. -# NOTE: This policy is deprecated only for POST /servers, GET -# /servers/{server_id} & GET /servers/detail. This policy for other -# API operations is still valid and not deprecated -# List, show, add, or remove security groups. -# -# APIs which are directly related to security groups resource are -# deprecated: -# Lists, shows information for, creates, updates and deletes -# security groups. Creates and deletes security group rules. All these -# APIs are deprecated. -# -# APIs which are related to server resource are not deprecated: -# Lists Security Groups for a server. Add Security Group to a server -# and remove security group from a server. Expand security_groups in -# server representation -# GET /os-security-groups -# GET /os-security-groups/{security_group_id} -# POST /os-security-groups -# PUT /os-security-groups/{security_group_id} -# DELETE /os-security-groups/{security_group_id} -# GET /servers/{server_id}/os-security-groups -# POST /servers/{server_id}/action (addSecurityGroup) -# POST /servers/{server_id}/action (removeSecurityGroup) -# POST /servers -# GET /servers/{server_id} -# GET /servers/detail -"os_compute_api:os-security-groups": "rule:admin or rule:member" - -# Show the usage data for a server -# GET /servers/{server_id}/diagnostics -"os_compute_api:os-server-diagnostics": "rule:admin or rule:member or rule:reader" - -# Create one or more external events -# POST /os-server-external-events -"os_compute_api:os-server-external-events:create": "rule:admin" - -# Deprecated in Pike and will be removed in next release -"os_compute_api:os-server-groups": "rule:admin or rule:member" - -# Create a new server group -# POST /os-server-groups -"os_compute_api:os-server-groups:create": "rule:admin or rule:member" - -# Delete a server group -# DELETE /os-server-groups/{server_group_id} -"os_compute_api:os-server-groups:delete": "rule:admin or rule:member" - -# List all server groups -# GET /os-server-groups -"os_compute_api:os-server-groups:index": "rule:admin or rule:member or rule:reader" - -# Show details of a server group -# GET /os-server-groups/{server_group_id} -"os_compute_api:os-server-groups:show": "rule:admin or rule:member or rule:reader" - -# List all metadata of a server -# GET /servers/{server_id}/metadata -"os_compute_api:server-metadata:index": "rule:admin or rule:member or rule:reader" - -# Show metadata for a server -# GET /servers/{server_id}/metadata/{key} -"os_compute_api:server-metadata:show": "rule:admin or rule:member or rule:reader" - -# Create metadata for a server -# POST /servers/{server_id}/metadata -"os_compute_api:server-metadata:create": "rule:admin or rule:member" - -# Replace metadata for a server -# PUT /servers/{server_id}/metadata -"os_compute_api:server-metadata:update_all": "rule:admin or rule:member" - -# Update metadata from a server -# PUT /servers/{server_id}/metadata/{key} -"os_compute_api:server-metadata:update": "rule:admin or rule:member" - -# Delete metadata from a server -# DELETE /servers/{server_id}/metadata/{key} -"os_compute_api:server-metadata:delete": "rule:admin or rule:member" - -# Show and clear the encrypted administrative password of a server -# GET /servers/{server_id}/os-server-password -# DELETE /servers/{server_id}/os-server-password -"os_compute_api:os-server-password": "rule:admin or rule:member" - -# Delete all the server tags -# DELETE /servers/{server_id}/tags -"os_compute_api:os-server-tags:delete_all": "rule:admin or rule:member" - -# List all tags for given server -# GET /servers/{server_id}/tags -"os_compute_api:os-server-tags:index": "rule:admin or rule:member or rule:reader" - -# Replace all tags on specified server with the new set of tags. -# PUT /servers/{server_id}/tags -"os_compute_api:os-server-tags:update_all": "rule:admin or rule:member" - -# Delete a single tag from the specified server -# DELETE /servers/{server_id}/tags/{tag} -"os_compute_api:os-server-tags:delete": "rule:admin or rule:member" - -# Add a single tag to the server if server has no specified tag -# PUT /servers/{server_id}/tags/{tag} -"os_compute_api:os-server-tags:update": "rule:admin or rule:member" - -# Check tag existence on the server. -# GET /servers/{server_id}/tags/{tag} -"os_compute_api:os-server-tags:show": "rule:admin or rule:member or rule:reader" - -# DEPRECATED -# "os_compute_api:os-server-usage" has been deprecated since 17.0.0. -# Nova API extension concept has been removed in Pike. Those -# extensions have their own policies enforcement. As there is no -# extensions now, "os_compute_api:os-server-usage" policy which was -# added for extensions is not needed any more -# Add 'OS-SRV-USG:launched_at' & 'OS-SRV-USG:terminated_at' attribute -# in the server response. -# -# This check is performed only after the check -# 'os_compute_api:servers:show' for GET /servers/{id} and -# 'os_compute_api:servers:detail' for GET /servers/detail passes -# GET /servers/{id} -# GET /servers/detail -"os_compute_api:os-server-usage": "rule:admin or rule:member or rule:reader" - -# List all servers -# GET /servers -"os_compute_api:servers:index": "rule:admin or rule:member or rule:reader" - -# List all servers with detailed information -# GET /servers/detail -"os_compute_api:servers:detail": "rule:admin or rule:member or rule:reader" - -# List all servers for all projects -# GET /servers -"os_compute_api:servers:index:get_all_tenants": "rule:admin or rule:global_reader" - -# List all servers with detailed information for all projects -# GET /servers/detail -"os_compute_api:servers:detail:get_all_tenants": "rule:admin or rule:reader" - -# Show a server -# GET /servers/{server_id} -"os_compute_api:servers:show": "rule:admin or rule:member or rule:reader" - -# Show a server with additional host status information -# GET /servers/{server_id} -# GET /servers/detail -"os_compute_api:servers:show:host_status": "rule:admin or rule:reader" - -# Create a server -# POST /servers -"os_compute_api:servers:create": "rule:admin or rule:member" - -# Create a server on the specified host -# POST /servers -"os_compute_api:servers:create:forced_host": "rule:admin" - -# Create a server with the requested volume attached to it -# POST /servers -"os_compute_api:servers:create:attach_volume": "rule:admin or rule:member" - -# Create a server with the requested network attached to it -# POST /servers -"os_compute_api:servers:create:attach_network": "rule:admin or rule:member" - -# Create a server with trusted image certificate IDs -# POST /servers -"os_compute_api:servers:create:trusted_certs": "rule:admin or rule:member" - -# -# This rule controls the compute API validation behavior of creating a -# server -# with a flavor that has 0 disk, indicating the server should be -# volume-backed. -# -# For a flavor with disk=0, the root disk will be set to exactly the -# size of the -# image used to deploy the instance. However, in this case the -# filter_scheduler -# cannot select the compute host based on the virtual image size. -# Therefore, 0 -# should only be used for volume booted instances or for testing -# purposes. -# -# WARNING: It is a potential security exposure to enable this policy -# rule -# if users can upload their own images since repeated attempts to -# create a disk=0 flavor instance with a large image can exhaust -# the local disk of the compute (or shared storage cluster). See bug -# https://bugs.launchpad.net/nova/+bug/1739646 for details. -# -# This rule defaults to ``rule:admin or rule:member`` for backward -# compatibility but -# will be changed to default to ``rule:admin`` in a subsequent -# release. -# POST /servers -"os_compute_api:servers:create:zero_disk_flavor": "rule:admin or rule:member" - -# Attach an unshared external network to a server -# POST /servers -# POST /servers/{server_id}/os-interface -"network:attach_external_network": "rule:admin" - -# Delete a server -# DELETE /servers/{server_id} -"os_compute_api:servers:delete": "rule:admin or rule:member" - -# Update a server -# PUT /servers/{server_id} -"os_compute_api:servers:update": "rule:admin or rule:member" - -# Confirm a server resize -# POST /servers/{server_id}/action (confirmResize) -"os_compute_api:servers:confirm_resize": "rule:admin or rule:member" - -# Revert a server resize -# POST /servers/{server_id}/action (revertResize) -"os_compute_api:servers:revert_resize": "rule:admin or rule:member" - -# Reboot a server -# POST /servers/{server_id}/action (reboot) -"os_compute_api:servers:reboot": "rule:admin or rule:member" - -# Resize a server -# POST /servers/{server_id}/action (resize) -"os_compute_api:servers:resize": "rule:admin or rule:member" - -# Rebuild a server -# POST /servers/{server_id}/action (rebuild) -"os_compute_api:servers:rebuild": "rule:admin or rule:member" - -# Rebuild a server with trusted image certificate IDs -# POST /servers/{server_id}/action (rebuild) -"os_compute_api:servers:rebuild:trusted_certs": "rule:admin or rule:member" - -# Create an image from a server -# POST /servers/{server_id}/action (createImage) -"os_compute_api:servers:create_image": "rule:admin or rule:member" - -# Create an image from a volume backed server -# POST /servers/{server_id}/action (createImage) -"os_compute_api:servers:create_image:allow_volume_backed": "rule:admin or rule:member" - -# Start a server -# POST /servers/{server_id}/action (os-start) -"os_compute_api:servers:start": "rule:admin or rule:member" - -# Stop a server -# POST /servers/{server_id}/action (os-stop) -"os_compute_api:servers:stop": "rule:admin or rule:member" - -# Trigger crash dump in a server -# POST /servers/{server_id}/action (trigger_crash_dump) -"os_compute_api:servers:trigger_crash_dump": "rule:admin or rule:member" - -# Show details for an in-progress live migration for a given server -# GET /servers/{server_id}/migrations/{migration_id} -"os_compute_api:servers:migrations:show": "rule:admin or rule:reader" - -# Force an in-progress live migration for a given server to complete -# POST /servers/{server_id}/migrations/{migration_id}/action (force_complete) -"os_compute_api:servers:migrations:force_complete": "rule:admin" - -# Delete(Abort) an in-progress live migration -# DELETE /servers/{server_id}/migrations/{migration_id} -"os_compute_api:servers:migrations:delete": "rule:admin" - -# Lists in-progress live migrations for a given server -# GET /servers/{server_id}/migrations -"os_compute_api:servers:migrations:index": "rule:admin or rule:reader" - -# List all running Compute services in a region, enables or disable -# scheduling for a Compute service, logs disabled Compute service -# information, set or unset forced_down flag for the compute service -# and delete a Compute service -# GET /os-services -# PUT /os-services/enable -# PUT /os-services/disable -# PUT /os-services/disable-log-reason -# PUT /os-services/force-down -# PUT /os-services/{service_id} -# DELETE /os-services/{service_id} -"os_compute_api:os-services": "rule:admin" - -# Shelve server -# POST /servers/{server_id}/action (shelve) -"os_compute_api:os-shelve:shelve": "rule:admin or rule:member" - -# Unshelve (restore) shelved server -# POST /servers/{server_id}/action (unshelve) -"os_compute_api:os-shelve:unshelve": "rule:admin or rule:member" - -# Shelf-offload (remove) server -# POST /servers/{server_id}/action (shelveOffload) -"os_compute_api:os-shelve:shelve_offload": "rule:admin" - -# Show usage statistics for a specific tenant -# GET /os-simple-tenant-usage/{tenant_id} -"os_compute_api:os-simple-tenant-usage:show": "rule:admin or rule:member or rule:reader" - -# List per tenant usage statistics for all tenants -# GET /os-simple-tenant-usage -"os_compute_api:os-simple-tenant-usage:list": "rule:admin or rule:reader" - -# Resume suspended server -# POST /servers/{server_id}/action (resume) -"os_compute_api:os-suspend-server:resume": "rule:admin or rule:member" - -# Suspend server -# POST /servers/{server_id}/action (suspend) -"os_compute_api:os-suspend-server:suspend": "rule:admin or rule:member" - -# Create, list, show information for, and delete project networks. -# -# These APIs are proxy calls to the Network service. These are all -# deprecated. -# GET /os-tenant-networks -# POST /os-tenant-networks -# GET /os-tenant-networks/{network_id} -# DELETE /os-tenant-networks/{network_id} -"os_compute_api:os-tenant-networks": "rule:admin or rule:member" - -# Show rate and absolute limits for the project. -# -# This policy only checks if the user has access to the requested -# project limits. And this check is performed only after the check -# os_compute_api:limits passes -# GET /limits -"os_compute_api:os-used-limits": "rule:admin or rule:reader" - -# Manage volumes for use with the Compute API. -# -# Lists, shows details, creates, and deletes volumes and -# snapshots. These APIs are proxy calls to the Volume service. -# These are all deprecated. -# GET /os-volumes -# POST /os-volumes -# GET /os-volumes/detail -# GET /os-volumes/{volume_id} -# DELETE /os-volumes/{volume_id} -# GET /os-snapshots -# POST /os-snapshots -# GET /os-snapshots/detail -# GET /os-snapshots/{snapshot_id} -# DELETE /os-snapshots/{snapshot_id} -"os_compute_api:os-volumes": "rule:admin or rule:member" - -# List volume attachments for an instance -# GET /servers/{server_id}/os-volume_attachments -"os_compute_api:os-volumes-attachments:index": "rule:admin or rule:member or rule:reader" - -# Attach a volume to an instance -# POST /servers/{server_id}/os-volume_attachments -"os_compute_api:os-volumes-attachments:create": "rule:admin or rule:member" - -# Show details of a volume attachment -# GET /servers/{server_id}/os-volume_attachments/{attachment_id} -"os_compute_api:os-volumes-attachments:show": "rule:admin or rule:member or rule:reader" - -# Update a volume attachment -# PUT /servers/{server_id}/os-volume_attachments/{attachment_id} -"os_compute_api:os-volumes-attachments:update": "rule:admin" - -# Detach a volume from an instance -# DELETE /servers/{server_id}/os-volume_attachments/{attachment_id} -"os_compute_api:os-volumes-attachments:delete": "rule:admin or rule:member" diff --git a/etc/panko/policy.yaml b/etc/panko/policy.yaml deleted file mode 100644 index 73c4a89..0000000 --- a/etc/panko/policy.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - - -### Policy Rules defined in panko.policies.segregation - -# Return the user and project the requestshould be limited to -# GET /v2/events -# GET /v2/events/{message_id} -# -"segregation": "rule:admin or rule:member or rule:reader" - -### Policy Rules defined in panko.policies.telemetry - -# Return all events matching the query filters. -# GET /v2/events -# -"telemetry:events:index": "rule:admin or rule:member or rule:reader" - -# Return a single event with the given message id. -# GET /v2/events/{message_id} -# -"telemetry:events:show": "rule:admin or rule:member or rule:reader" diff --git a/services/aodh/policy.yaml b/services/aodh/policy.yaml new file mode 100644 index 0000000..eeb4d55 --- /dev/null +++ b/services/aodh/policy.yaml @@ -0,0 +1,62 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +# Get an alarm. +# GET /v2/alarms/{alarm_id} +"telemetry:get_alarm": "rule:admin or rule:member or rule:reader" + +# Get all alarms, based on the query provided. +# GET /v2/alarms +"telemetry:get_alarms": "rule:admin or rule:member or rule:reader" + +# Get all alarms, based on the query provided. +# POST /v2/query/alarms +"telemetry:query_alarm": "rule:admin or rule:member" + +# Create a new alarm. +# POST /v2/alarms +"telemetry:create_alarm": "rule:admin or rule:member" + +# Modify this alarm. +# PUT /v2/alarms/{alarm_id} +"telemetry:change_alarm": "rule:admin or rule:member" + +# Delete this alarm. +# DELETE /v2/alarms/{alarm_id} +"telemetry:delete_alarm": "rule:admin or rule:member" + +# Get the state of this alarm. +# GET /v2/alarms/{alarm_id}/state +"telemetry:get_alarm_state": "rule:admin or rule:member or rule:reader" + +# Set the state of this alarm. +# PUT /v2/alarms/{alarm_id}/state +"telemetry:change_alarm_state": "rule:admin or rule:member" + +# Assembles the alarm history requested. +# GET /v2/alarms/{alarm_id}/history +"telemetry:alarm_history": "rule:admin or rule:member or rule:reader" + +# Define query for retrieving AlarmChange data. +# POST /v2/query/alarms/history +"telemetry:query_alarm_history": "rule:admin or rule:member" diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml new file mode 100644 index 0000000..b7812e8 --- /dev/null +++ b/services/cinder/policy.yaml @@ -0,0 +1,623 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# Decides what is required for the 'is_admin:True' check to succeed. +# "context_is_admin": "role:admin" + +# RULES + + +# Create attachment. +# POST /attachments +"volume:attachment_create": "rule:admin or rule:member" + +# Update attachment. +# PUT /attachments/{attachment_id} +"volume:attachment_update": "rule:admin or rule:member" + +# Delete attachment. +# DELETE /attachments/{attachment_id} +"volume:attachment_delete": "rule:admin or rule:member" + +# Mark a volume attachment process as completed (in-use) +# POST /attachments/{attachment_id}/action (os-complete) +"volume:attachment_complete": "rule:admin or rule:member" + +# Allow multiattach of bootable volumes. +# POST /attachments +"volume:multiattach_bootable_volume": "rule:admin or rule:member" + +# List messages. +# GET /messages +"message:get_all": "rule:admin or rule:member or rule:reader" + +# Show message. +# GET /messages/{message_id} +"message:get": "rule:admin or rule:member or rule:reader" + +# Delete message. +# DELETE /messages/{message_id} +"message:delete": "rule:admin or rule:member" + +# List clusters. +# GET /clusters +# GET /clusters/detail +"clusters:get_all": "rule:admin or rule:reader" + +# Show cluster. +# GET /clusters/{cluster_id} +"clusters:get": "rule:admin or rule:reader" + +# Update cluster. +# PUT /clusters/{cluster_id} +"clusters:update": "rule:admin" + +# Clean up workers. +# POST /workers/cleanup +"workers:cleanup": "rule:admin" + +# Show snapshot's metadata or one specified metadata with a given key. +# GET /snapshots/{snapshot_id}/metadata +# GET /snapshots/{snapshot_id}/metadata/{key} +"volume:get_snapshot_metadata": "rule:admin or rule:member or rule:reader" + +# Update snapshot's metadata or one specified metadata with a given +# key. +# PUT /snapshots/{snapshot_id}/metadata +# PUT /snapshots/{snapshot_id}/metadata/{key} +"volume:update_snapshot_metadata": "rule:admin or rule:member" + +# Delete snapshot's specified metadata with a given key. +# DELETE /snapshots/{snapshot_id}/metadata/{key} +"volume:delete_snapshot_metadata": "rule:admin or rule:member" + +# List snapshots. +# GET /snapshots +# GET /snapshots/detail +"volume:get_all_snapshots": "rule:admin or rule:member or rule:reader" + +# List or show snapshots with extended attributes. +# GET /snapshots/{snapshot_id} +# GET /snapshots/detail +"volume_extension:extended_snapshot_attributes": "rule:admin or rule:member or rule:reader" + +# Create snapshot. +# POST /snapshots +"volume:create_snapshot": "rule:admin or rule:member" + +# Show snapshot. +# GET /snapshots/{snapshot_id} +"volume:get_snapshot": "rule:admin or rule:member or rule:reader" + +# Update snapshot. +# PUT /snapshots/{snapshot_id} +"volume:update_snapshot": "rule:admin or rule:member" + +# Delete snapshot. +# DELETE /snapshots/{snapshot_id} +"volume:delete_snapshot": "rule:admin or rule:member" + +# Reset status of a snapshot. +# POST /snapshots/{snapshot_id}/action (os-reset_status) +"volume_extension:snapshot_admin_actions:reset_status": "rule:admin" + +# Update database fields of snapshot. +# POST /snapshots/{snapshot_id}/action (update_snapshot_status) +"snapshot_extension:snapshot_actions:update_snapshot_status": "rule:admin or rule:member" + +# Force delete a snapshot. +# POST /snapshots/{snapshot_id}/action (os-force_delete) +"volume_extension:snapshot_admin_actions:force_delete": "rule:admin" + +# List (in detail) of snapshots which are available to manage. +# GET /manageable_snapshots +# GET /manageable_snapshots/detail +"snapshot_extension:list_manageable": "rule:admin or rule:reader" + +# Manage an existing snapshot. +# POST /manageable_snapshots +"snapshot_extension:snapshot_manage": "rule:admin" + +# Stop managing a snapshot. +# POST /snapshots/{snapshot_id}/action (os-unmanage) +"snapshot_extension:snapshot_unmanage": "rule:admin" + +# List backups. +# GET /backups +# GET /backups/detail +"backup:get_all": "rule:admin or rule:member or rule:reader" + +# List backups or show backup with project attributes. +# GET /backups/{backup_id} +# GET /backups/detail +"backup:backup_project_attribute": "rule:admin or rule:reader" + +# Create backup. +# POST /backups +"backup:create": "rule:admin or rule:member" + +# Show backup. +# GET /backups/{backup_id} +"backup:get": "rule:admin or rule:member or rule:reader" + +# Update backup. +# PUT /backups/{backup_id} +"backup:update": "rule:admin or rule:member" + +# Delete backup. +# DELETE /backups/{backup_id} +"backup:delete": "rule:admin or rule:member" + +# Restore backup. +# POST /backups/{backup_id}/restore +"backup:restore": "rule:admin or rule:member" + +# Import backup. +# POST /backups/{backup_id}/import_record +"backup:backup-import": "rule:admin" + +# Export backup. +# POST /backups/{backup_id}/export_record +"backup:export-import": "rule:admin" + +# Reset status of a backup. +# POST /backups/{backup_id}/action (os-reset_status) +"volume_extension:backup_admin_actions:reset_status": "rule:admin" + +# Force delete a backup. +# POST /backups/{backup_id}/action (os-force_delete) +"volume_extension:backup_admin_actions:force_delete": "rule:admin" + +# List groups. +# GET /groups +# GET /groups/detail +"group:get_all": "rule:admin or rule:member or rule:reader" + +# Create group. +# POST /groups +"group:create": "rule:admin or rule:member" + +# Show group. +# GET /groups/{group_id} +"group:get": "rule:admin or rule:member or rule:reader" + +# Update group. +# PUT /groups/{group_id} +"group:update": "rule:admin or rule:member" + +# Create, update or delete a group type. +# POST /group_types/ +# PUT /group_types/{group_type_id} +# DELETE /group_types/{group_type_id} +"group:group_types_manage": "rule:admin" + +# Show group type with type specs attributes. +# GET /group_types/{group_type_id} +"group:access_group_types_specs": "rule:admin or rule:reader" + +# Create, show, update and delete group type spec. +# GET /group_types/{group_type_id}/group_specs/{g_spec_id} +# GET /group_types/{group_type_id}/group_specs +# POST /group_types/{group_type_id}/group_specs +# PUT /group_types/{group_type_id}/group_specs/{g_spec_id} +# DELETE /group_types/{group_type_id}/group_specs/{g_spec_id} +"group:group_types_specs": "rule:admin" + +# List group snapshots. +# GET /group_snapshots +# GET /group_snapshots/detail +"group:get_all_group_snapshots": "rule:admin or rule:member or rule:reader" + +# Create group snapshot. +# POST /group_snapshots +"group:create_group_snapshot": "rule:admin or rule:member" + +# Show group snapshot. +# GET /group_snapshots/{group_snapshot_id} +"group:get_group_snapshot": "rule:admin or rule:member or rule:reader" + +# Delete group snapshot. +# DELETE /group_snapshots/{group_snapshot_id} +"group:delete_group_snapshot": "rule:admin or rule:member" + +# Update group snapshot. +# PUT /group_snapshots/{group_snapshot_id} +"group:update_group_snapshot": "rule:admin or rule:member or rule:reader" + +# Reset status of group snapshot. +# POST /group_snapshots/{g_snapshot_id}/action (reset_status) +"group:reset_group_snapshot_status": "rule:admin or rule:member" + +# Delete group. +# POST /groups/{group_id}/action (delete) +"group:delete": "rule:admin or rule:member" + +# Reset status of group. +# POST /groups/{group_id}/action (reset_status) +"group:reset_status": "rule:admin" + +# Enable replication. +# POST /groups/{group_id}/action (enable_replication) +"group:enable_replication": "rule:admin or rule:member" + +# Disable replication. +# POST /groups/{group_id}/action (disable_replication) +"group:disable_replication": "rule:admin or rule:member" + +# Fail over replication. +# POST /groups/{group_id}/action (failover_replication) +"group:failover_replication": "rule:admin or rule:member" + +# List failover replication. +# POST /groups/{group_id}/action (list_replication_targets) +"group:list_replication_targets": "rule:admin or rule:member" + +# List qos specs or list all associations. +# GET /qos-specs +# GET /qos-specs/{qos_id}/associations +"volume_extension:qos_specs_manage:get_all": "rule:admin or rule:reader" + +# Show qos specs. +# GET /qos-specs/{qos_id} +"volume_extension:qos_specs_manage:get": "rule:admin or rule:reader" + +# Create qos specs. +# POST /qos-specs +"volume_extension:qos_specs_manage:create": "rule:admin" + +# Update qos specs (including updating association). +# PUT /qos-specs/{qos_id} +# GET /qos-specs/{qos_id}/disassociate_all +# GET /qos-specs/{qos_id}/associate +# GET /qos-specs/{qos_id}/disassociate +"volume_extension:qos_specs_manage:update": "rule:admin or rule:reader" + +# delete qos specs or unset one specified qos key. +# DELETE /qos-specs/{qos_id} +# PUT /qos-specs/{qos_id}/delete_keys +"volume_extension:qos_specs_manage:delete": "rule:admin" + +# Show or update project quota class. +# GET /os-quota-class-sets/{project_id} +# PUT /os-quota-class-sets/{project_id} +"volume_extension:quota_classes": "rule:admin" + +# Show project quota (including usage and default). +# GET /os-quota-sets/{project_id} +# GET /os-quota-sets/{project_id}/default +# GET /os-quota-sets/{project_id}?usage=True +"volume_extension:quotas:show": "rule:admin or rule:member or rule:reader" + +# Update project quota. +# PUT /os-quota-sets/{project_id} +"volume_extension:quotas:update": "rule:admin" + +# Delete project quota. +# DELETE /os-quota-sets/{project_id} +"volume_extension:quotas:delete": "rule:admin" + +# Validate setup for nested quota. +# GET /os-quota-sets/validate_setup_for_nested_quota_use +"volume_extension:quota_classes:validate_setup_for_nested_quota_use": "rule:admin or rule:reader" + +# Show backend capabilities. +# GET /capabilities/{host_name} +"volume_extension:capabilities": "rule:admin or rule:reader" + +# List all services. +# GET /os-services +"volume_extension:services:index": "rule:admin or rule:reader" + +# Update service, including failover_host, thaw, freeze, disable, +# enable, set-log and get-log actions. +# PUT /os-services/{action} +"volume_extension:services:update": "rule:admin" + +# Freeze a backend host. +# PUT /os-services/freeze +"volume:freeze_host": "rule:admin" + +# Thaw a backend host. +# PUT /os-services/thaw +"volume:thaw_host": "rule:admin" + +# Failover a backend host. +# PUT /os-services/failover_host +"volume:failover_host": "rule:admin" + +# List all backend pools. +# GET /scheduler-stats/get_pools +"scheduler_extension:scheduler_stats:get_pools": "rule:admin or rule:reader" + +# List, update or show hosts for a project. +# GET /os-hosts +# PUT /os-hosts/{host_name} +# GET /os-hosts/{host_id} +"volume_extension:hosts": "rule:admin" + +# Show limits with used limit attributes. +# GET /limits +"limits_extension:used_limits": "rule:admin or rule:member or rule:reader" + +# List (in detail) of volumes which are available to manage. +# GET /manageable_volumes +# GET /manageable_volumes/detail +"volume_extension:list_manageable": "rule:admin or rule:reader" + +# Manage existing volumes. +# POST /manageable_volumes +"volume_extension:volume_manage": "rule:admin" + +# Stop managing a volume. +# POST /volumes/{volume_id}/action (os-unmanage) +"volume_extension:volume_unmanage": "rule:admin" + +# Create, update and delete volume type. +# POST /types +# PUT /types +# DELETE /types +"volume_extension:types_manage": "rule:admin" + +# List, show, create, update and delete volume type encryption. +# POST /types/{type_id}/encryption +# PUT /types/{type_id}/encryption/{encryption_id} +# GET /types/{type_id}/encryption +# GET /types/{type_id}/encryption/{encryption_id} +# DELETE /types/{type_id}/encryption/{encryption_id} +"volume_extension:volume_type_encryption": "rule:admin" + +# List or show volume type with access type extra specs attribute. +# GET /types/{type_id} +# GET /types +"volume_extension:access_types_extra_specs": "rule:admin or rule:reader" + +# List or show volume type with access type qos specs id attribute. +# GET /types/{type_id} +# GET /types +"volume_extension:access_types_qos_specs_id": "rule:admin or rule:reader" + +# Volume type access related APIs. +# GET /types +# GET /types/detail +# GET /types/{type_id} +# POST /types +"volume_extension:volume_type_access": "rule:admin or rule:member" + +# Add volume type access for project. +# POST /types/{type_id}/action (addProjectAccess) +"volume_extension:volume_type_access:addProjectAccess": "rule:admin" + +# Remove volume type access for project. +# POST /types/{type_id}/action (removeProjectAccess) +"volume_extension:volume_type_access:removeProjectAccess": "rule:admin" + +# Extend a volume. +# POST /volumes/{volume_id}/action (os-extend) +"volume:extend": "rule:admin or rule:member" + +# Extend a attached volume. +# POST /volumes/{volume_id}/action (os-extend) +"volume:extend_attached_volume": "rule:admin or rule:member" + +# Revert a volume to a snapshot. +# POST /volumes/{volume_id}/action (revert) +"volume:revert_to_snapshot": "rule:admin or rule:member" + +# Reset status of a volume. +# POST /volumes/{volume_id}/action (os-reset_status) +"volume_extension:volume_admin_actions:reset_status": "rule:admin" + +# Retype a volume. +# POST /volumes/{volume_id}/action (os-retype) +"volume:retype": "rule:admin or rule:member" + +# Update a volume's readonly flag. +# POST /volumes/{volume_id}/action (os-update_readonly_flag) +"volume:update_readonly_flag": "rule:admin or rule:member" + +# Force delete a volume. +# POST /volumes/{volume_id}/action (os-force_delete) +"volume_extension:volume_admin_actions:force_delete": "rule:admin" + +# Upload a volume to image with public visibility. +# POST /volumes/{volume_id}/action (os-volume_upload_image) +"volume_extension:volume_actions:upload_public": "rule:admin" + +# Upload a volume to image. +# POST /volumes/{volume_id}/action (os-volume_upload_image) +"volume_extension:volume_actions:upload_image": "rule:admin or rule:member" + +# Force detach a volume. +# POST /volumes/{volume_id}/action (os-force_detach) +"volume_extension:volume_admin_actions:force_detach": "rule:admin" + +# migrate a volume to a specified host. +# POST /volumes/{volume_id}/action (os-migrate_volume) +"volume_extension:volume_admin_actions:migrate_volume": "rule:admin" + +# Complete a volume migration. +# POST /volumes/{volume_id}/action (os-migrate_volume_completion) +"volume_extension:volume_admin_actions:migrate_volume_completion": "rule:admin" + +# Initialize volume attachment. +# POST /volumes/{volume_id}/action (os-initialize_connection) +"volume_extension:volume_actions:initialize_connection": "rule:admin or rule:member" + +# Terminate volume attachment. +# POST /volumes/{volume_id}/action (os-terminate_connection) +"volume_extension:volume_actions:terminate_connection": "rule:admin or rule:member" + +# Roll back volume status to 'in-use'. +# POST /volumes/{volume_id}/action (os-roll_detaching) +"volume_extension:volume_actions:roll_detaching": "rule:admin or rule:member" + +# Mark volume as reserved. +# POST /volumes/{volume_id}/action (os-reserve) +"volume_extension:volume_actions:reserve": "rule:admin or rule:member" + +# Unmark volume as reserved. +# POST /volumes/{volume_id}/action (os-unreserve) +"volume_extension:volume_actions:unreserve": "rule:admin or rule:member" + +# Begin detach volumes. +# POST /volumes/{volume_id}/action (os-begin_detaching) +"volume_extension:volume_actions:begin_detaching": "rule:admin or rule:member" + +# Add attachment metadata. +# POST /volumes/{volume_id}/action (os-attach) +"volume_extension:volume_actions:attach": "rule:admin or rule:member" + +# Clear attachment metadata. +# POST /volumes/{volume_id}/action (os-detach) +"volume_extension:volume_actions:detach": "rule:admin or rule:member" + +# List volume transfer. +# GET /os-volume-transfer +# GET /os-volume-transfer/detail +# GET /volume_transfers +# GET /volume_transfers/detail +"volume:get_all_transfers": "rule:admin or rule:member or rule:reader" + +# Create a volume transfer. +# POST /os-volume-transfer +# POST /volume_transfers +"volume:create_transfer": "rule:admin or rule:member" + +# Show one specified volume transfer. +# GET /os-volume-transfer/{transfer_id} +# GET /volume_transfers/{transfer_id} +"volume:get_transfer": "rule:admin or rule:member or rule:reader" + +# Accept a volume transfer. +# POST /os-volume-transfer/{transfer_id}/accept +# POST /volume_transfers/{transfer_id}/accept +"volume:accept_transfer": "rule:admin or rule:member" + +# Delete volume transfer. +# DELETE /os-volume-transfer/{transfer_id} +# DELETE /volume_transfers/{transfer_id} +"volume:delete_transfer": "rule:admin or rule:member" + +# Show volume's metadata or one specified metadata with a given key. +# GET /volumes/{volume_id}/metadata +# GET /volumes/{volume_id}/metadata/{key} +"volume:get_volume_metadata": "rule:admin or rule:member or rule:reader" + +# Create volume metadata. +# POST /volumes/{volume_id}/metadata +"volume:create_volume_metadata": "rule:admin or rule:member" + +# Update volume's metadata or one specified metadata with a given key. +# PUT /volumes/{volume_id}/metadata +# PUT /volumes/{volume_id}/metadata/{key} +"volume:update_volume_metadata": "rule:admin or rule:member" + +# Delete volume's specified metadata with a given key. +# DELETE /volumes/{volume_id}/metadata/{key} +"volume:delete_volume_metadata": "rule:admin or rule:member" + +# Volume's image metadata related operation, create, delete, show and +# list. +# GET /volumes/detail +# GET /volumes/{volume_id} +# POST /volumes/{volume_id}/action (os-set_image_metadata) +# POST /volumes/{volume_id}/action (os-unset_image_metadata) +"volume_extension:volume_image_metadata": "rule:admin or rule:member" + +# Update volume admin metadata. It's used in `attach` and `os- +# update_readonly_flag` APIs +# POST /volumes/{volume_id}/action (os-update_readonly_flag) +# POST /volumes/{volume_id}/action (os-attach) +"volume:update_volume_admin_metadata": "rule:admin" + +# List type extra specs. +# GET /types/{type_id}/extra_specs +"volume_extension:types_extra_specs:index": "rule:admin or rule:reader" + +# Create type extra specs. +# POST /types/{type_id}/extra_specs +"volume_extension:types_extra_specs:create": "rule:admin" + +# Show one specified type extra specs. +# GET /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:show": "rule:admin or rule:reader" + +# Update type extra specs. +# PUT /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:update": "rule:admin" + +# Delete type extra specs. +# DELETE /types/{type_id}/extra_specs/{extra_spec_key} +"volume_extension:types_extra_specs:delete": "rule:admin" + +# Create volume. +# POST /volumes +"volume:create": "rule:admin or rule:member" + +# Create volume from image. +# POST /volumes +"volume:create_from_image": "rule:admin or rule:member" + +# Show volume. +# GET /volumes/{volume_id} +"volume:get": "rule:admin or rule:member or rule:reader" + +# List volumes or get summary of volumes. +# GET /volumes +# GET /volumes/detail +# GET /volumes/summary +"volume:get_all": "rule:admin or rule:member or rule:reader" + +# Update volume. +# PUT /volumes +"volume:update": "rule:admin or rule:member" + +# Delete volume. +# DELETE /volumes/{volume_id} +"volume:delete": "rule:admin or rule:member" + +# Force Delete a volume. +# DELETE /volumes/{volume_id} +"volume:force_delete": "rule:admin" + +# List or show volume with host attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_host_attribute": "rule:admin or rule:reader" + +# List or show volume with tenant attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_tenant_attribute": "rule:admin or rule:member or rule:reader" + +# List or show volume with migration status attribute. +# GET /volumes/{volume_id} +# GET /volumes/detail +"volume_extension:volume_mig_status_attribute": "rule:admin or rule:reader" + +# Show volume's encryption metadata. +# GET /volumes/{volume_id}/encryption +# GET /volumes/{volume_id}/encryption/{encryption_key} +"volume_extension:volume_encryption_metadata": "rule:admin or rule:member or rule:reader" + +# Create multiattach capable volume. +# POST /volumes +"volume:multiattach": "rule:admin or rule:member" diff --git a/services/glance/policy.yaml b/services/glance/policy.yaml new file mode 100644 index 0000000..c9167c8 --- /dev/null +++ b/services/glance/policy.yaml @@ -0,0 +1,101 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +# We add here a check for if the image is public, allowing a member to use public images on the cloud +member: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + + +# List available image entities +# GET /v1/images +# GET /v1/images/detail +# GET /v2/images +"get_images": "rule:admin or rule:member or rule:reader" + +# Retrieve a specific image entity +# HEAD /v1/images/ +# GET /v1/images/ +# GET /v2/images/ +"get_image": "rule:admin or rule:member or rule:reader" + +# Download binary image data +# GET /v1/images/ +# GET /v2/images//file +"download_image": "rule:admin or rule:member or rule:reader" + +# Upload binary image data +# POST /v1/images +# PUT /v1/images/ +# PUT /v2/images//file +"upload_image": "rule:admin or rule:member" + +# Copy binary image data from URL +# POST /v1/images +# PUT /v1/images/ +"copy_from": "rule:admin or rule:member" + +# Create an image entity +# POST /v1/images +# POST /v2/images +"add_image": "rule:admin or rule:member" + +# Update an image entity +# PUT /v1/images/ +# PUT /v2/images/ +"modify_image": "rule:admin or rule:member" + +# Create or update public images +# POST /v1/images with attribute is_public = true +# PUT /v1/images/ with attribute is_public = true +# POST /v2/images with attribute visibility = public +# PUT /v2/images/ with attribute visibility = public +"publicize_image": "rule:admin or rule:member" + +# Create or update community images +# POST /v2/images with attribute visibility = community +# PUT /v2/images/ with attribute visibility = community +"communitize_image": "rule:admin or rule:member" + +# Delete an image entity and associated binary data +# DELETE /v1/images/ +# DELETE /v2/images/ +"delete_image": "rule:admin or rule:member" + +# Add a membership to the member repo of an image +# POST /v2/images//members +"add_member": "rule:admin or rule:member" + +# List the members of an image +# GET /v1/images//members +# GET /v2/images//members +"get_members": "rule:admin or rule:member or rule:reader" + +# Delete a membership of an image +# DELETE /v1/images//members/ +# DELETE /v2/images//members/ +"delete_member": "rule:admin or rule:member" + +# Create or update the membership of an image +# PUT /v1/images//members/ +# PUT /v1/images//members +# POST /v2/images//members +# PUT /v2/images//members/ +"modify_member": "rule:admin or rule:member" + +# Allowed to use the image cache management API +"manage_image_cache": "rule:admin or rule:member" diff --git a/services/gnocchi/policy.yaml b/services/gnocchi/policy.yaml new file mode 100644 index 0000000..22a0fc3 --- /dev/null +++ b/services/gnocchi/policy.yaml @@ -0,0 +1,61 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +# For gnocchi, this also adds a check to who created the resource +_member_role: "(role:Member or role:member or role:_member_ or user:%(creator)s)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +# For gnocchi, this also adds a check for the resource to be part of the user's project +member: "(rule:_member_role and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +"get status": "rule:admin or rule:reader" + +"create resource": "rule:admin or rule:member" +"get resource": "rule:admin or rule:member or rule:reader" +"update resource": "rule:admin or rule:member" +"delete resource": "rule:admin or rule:member" +"delete resources": "rule:admin or rule:member" +"list resource": "rule:admin or rule:member or rule:reader" +"search resource": "rule:admin or rule:member or rule:reader" + +"create resource type": "rule:admin" +"delete resource type": "rule:admin" +"update resource type": "rule:admin" +"list resource type": "rule:admin or rule:member or rule:reader" +"get resource type": "rule:admin or rule:member or rule:reader" + +"get archive policy": "rule:admin or rule:member or rule:reader" +"list archive policy": "rule:admin or rule:member or rule:reader" +"create archive policy": "rule:admin" +"update archive policy": "rule:admin" +"delete archive policy": "rule:admin" + +"create archive policy rule": "rule:admin" +"get archive policy rule": "rule:admin or rule:member or rule:reader" +"list archive policy rule": "rule:admin or rule:member or rule:reader" +"update archive policy rule": "rule:admin" +"delete archive policy rule": "rule:admin" + +"create metric": "rule:admin or rule:member" +"delete metric": "rule:admin or rule:member" +"get metric": "rule:admin or rule:member or rule:reader" +"search metric": "rule:admin or rule:member or rule:reader" +"list metric": "rule:admin or rule:member or rule:reader" + +"get measures": "rule:admin or rule:member or rule:reader" +"post measures": "rule:admin or rule:member" diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml new file mode 100644 index 0000000..4c20394 --- /dev/null +++ b/services/heat/policy.yaml @@ -0,0 +1,343 @@ +# An additional rule that prevents users created via stack from creating additional stacks +"deny_stack_user": "(not role:heat_stack_user)" + +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader and rule:deny_stack_user)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) and rule:deny_stack_user)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "((rule:_member_role and project_id:%(project_id)s) and rule:deny_stack_user)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "((is_admin:True or role:admin) and rule:deny_stack_user)" + +# This rule is specific for a user's own objects +owner: "((rule:_member_role and user_id:%(user_id)s) and rule:deny_stack_user)" + +# Decides what is required for the 'is_admin:True' check to succeed. +"context_is_admin": "role:admin" + +### Policy Rules defined in heat.policies.base + +# Default rule for deny everybody. +# +"deny_everybody": "!" + +# Default rule for allow everybody. +# +"allow_everybody": "" + +### Policy Rules defined in heat.policies.actions + +# Performs non-lifecycle operations on the stack (Snapshot, Resume, Cancel update, or check stack resources). +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/actions +"actions:action": "rule:admin or rule:member" + +### Policy Rules defined in heat.policies.build_info + +# Show build information. +# GET /v1/{tenant_id}/build_info +"build_info:build_info": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.cloudformation + +# +"cloudformation:ListStacks": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:CreateStack": "rule:admin or rule:member" + +# +"cloudformation:DescribeStacks": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DeleteStack": "rule:admin or rule:member" + +# +"cloudformation:UpdateStack": "rule:admin or rule:member" + +# +"cloudformation:CancelUpdateStack": "rule:admin or rule:member" + +# +"cloudformation:DescribeStackEvents": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:ValidateTemplate": "rule:admin or rule:member" + +# +"cloudformation:GetTemplate": "rule:admin or rule:member" + +# +"cloudformation:EstimateTemplateCost": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DescribeStackResource": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:DescribeStackResources": "rule:admin or rule:member or rule:reader" + +# +"cloudformation:ListStackResources": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.events + +# List events. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/events +"events:index": "rule:admin or rule:member or rule:reader" + +# Show event. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/events/{event_id} +"events:show": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.resource + +# List resources. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources +"resource:index": "rule:admin or rule:member or rule:reader" + +# Show resource metadata. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/metadata +"resource:metadata": "rule:admin or rule:member or rule:reader" + +# Signal resource. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name}/signal +"resource:signal": "rule:admin or rule:member or rule:reader" + +# Mark resource as unhealthy. +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name_or_physical_id} +"resource:mark_unhealthy": "rule:admin or rule:member" + +# Show resource. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/resources/{resource_name} +"resource:show": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.resource_types + +# +"resource_types:OS::Nova::Flavor": "rule:admin" + +# +"resource_types:OS::Cinder::EncryptedVolumeType": "rule:admin" + +# +"resource_types:OS::Cinder::VolumeType": "rule:admin" + +# +"resource_types:OS::Cinder::Quota": "rule:admin" + +# +"resource_types:OS::Neutron::Quota": "rule:admin" + +# +"resource_types:OS::Nova::Quota": "rule:admin" + +# +"resource_types:OS::Manila::ShareType": "rule:admin" + +# +"resource_types:OS::Neutron::ProviderNet": "rule:admin" + +# +"resource_types:OS::Neutron::QoSPolicy": "rule:admin" + +# +"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:admin" + +# +"resource_types:OS::Neutron::Segment": "rule:admin" + +# +"resource_types:OS::Nova::HostAggregate": "rule:admin" + +# +"resource_types:OS::Cinder::QoSSpecs": "rule:admin" + +# +"resource_types:OS::Cinder::QoSAssociation": "rule:admin" + +# +"resource_types:OS::Keystone::*": "rule:admin" + +### Policy Rules defined in heat.policies.service + +# +"service:index": "rule:admin or rule:reader" + +### Policy Rules defined in heat.policies.software_configs + +# List configs globally. +# GET /v1/{tenant_id}/software_configs +"software_configs:global_index": "rule:deny_everybody" + +# List configs. +# GET /v1/{tenant_id}/software_configs +"software_configs:index": "rule:admin or rule:member or rule:reader" + +# Create config. +# POST /v1/{tenant_id}/software_configs +"software_configs:create": "rule:admin or rule:member" + +# Show config details. +# GET /v1/{tenant_id}/software_configs/{config_id} +"software_configs:show": "rule:admin or rule:member or rule:reader" + +# Delete config. +# DELETE /v1/{tenant_id}/software_configs/{config_id} +"software_configs:delete": "rule:admin or rule:member" + +### Policy Rules defined in heat.policies.software_deployments + +# List deployments. +# GET /v1/{tenant_id}/software_deployments +"software_deployments:index": "rule:admin or rule:member or rule:reader" + +# Create deployment. +# POST /v1/{tenant_id}/software_deployments +"software_deployments:create": "rule:admin or rule:member" + +# Show deployment details. +# GET /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:show": "rule:admin or rule:member or rule:reader" + +# Update deployment. +# PUT /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:update": "rule:admin or rule:member" + +# Delete deployment. +# DELETE /v1/{tenant_id}/software_deployments/{deployment_id} +"software_deployments:delete": "rule:admin or rule:member" + +# Show server configuration metadata. +# GET /v1/{tenant_id}/software_deployments/metadata/{server_id} +"software_deployments:metadata": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in heat.policies.stacks + +# Abandon stack. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/abandon +"stacks:abandon": "rule:admin or rule:member" + +# Create stack. +# POST /v1/{tenant_id}/stacks +"stacks:create": "rule:admin or rule:member" + +# Delete stack. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:delete": "rule:admin or rule:member" + +# List stacks in detail. +# GET /v1/{tenant_id}/stacks +"stacks:detail": "rule:admin or rule:member or rule:reader" + +# Export stack. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/export +"stacks:export": "rule:admin or rule:member or rule:reader" + +# Generate stack template. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template +"stacks:generate_template": "rule:admin or rule:member or rule:reader" + +# List stacks globally. +# GET /v1/{tenant_id}/stacks +"stacks:global_index": "rule:deny_everybody" + +# List stacks. +# GET /v1/{tenant_id}/stacks +"stacks:index": "rule:admin or rule:member or rule:reader" + +# List resource types. +# GET /v1/{tenant_id}/resource_types +"stacks:list_resource_types": "rule:admin or rule:member or rule:reader" + +# List template versions. +# GET /v1/{tenant_id}/template_versions +"stacks:list_template_versions": "rule:admin or rule:member or rule:reader" + +# List template functions. +# GET /v1/{tenant_id}/template_versions/{template_version}/functions +"stacks:list_template_functions": "rule:admin or rule:member or rule:reader" + +# Find stack. +# GET /v1/{tenant_id}/stacks/{stack_identity} +"stacks:lookup": "rule:admin or rule:member or rule:reader" + +# Preview stack. +# POST /v1/{tenant_id}/stacks/preview +"stacks:preview": "rule:admin or rule:member" + +# Show resource type schema. +# GET /v1/{tenant_id}/resource_types/{type_name} +"stacks:resource_schema": "rule:admin or rule:member or rule:reader" + +# Show stack. +# GET /v1/{tenant_id}/stacks/{stack_identity} +"stacks:show": "rule:admin or rule:member or rule:reader" + +# Get stack template. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/template +"stacks:template": "rule:admin or rule:member" + +# Get stack environment. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/environment +"stacks:environment": "rule:admin or rule:member" + +# Get stack files. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/files +"stacks:files": "rule:admin or rule:member" + +# Update stack. +# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:update": "rule:admin or rule:member" + +# Update stack (PATCH). +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id} +"stacks:update_patch": "rule:admin or rule:member" + +# Preview update stack. +# PUT /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview +"stacks:preview_update": "rule:admin or rule:member" + +# Preview update stack (PATCH). +# PATCH /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/preview +"stacks:preview_update_patch": "rule:admin or rule:member" + +# Validate template. +# POST /v1/{tenant_id}/validate +"stacks:validate_template": "rule:admin or rule:member" + +# Snapshot Stack. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots +"stacks:snapshot": "rule:admin or rule:member" + +# Show snapshot. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} +"stacks:show_snapshot": "rule:admin or rule:member or rule:reader" + +# Delete snapshot. +# DELETE /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id} +"stacks:delete_snapshot": "rule:admin or rule:member" + +# List snapshots. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots +"stacks:list_snapshots": "rule:admin or rule:member or rule:reader" + +# Restore snapshot. +# POST /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/snapshots/{snapshot_id}/restore +"stacks:restore_snapshot": "rule:admin or rule:member" + +# List outputs. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs +"stacks:list_outputs": "rule:admin or rule:member" + +# Show outputs. +# GET /v1/{tenant_id}/stacks/{stack_name}/{stack_id}/outputs/{output_key} +"stacks:show_output": "rule:admin or rule:member" diff --git a/services/keystone/policy.yaml b/services/keystone/policy.yaml new file mode 100644 index 0000000..5aba840 --- /dev/null +++ b/services/keystone/policy.yaml @@ -0,0 +1,1081 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# The role used by openstack services +"service_role": "(role:service)" + +# +"token_subject": "user_id:%(target.token.user_id)s" + +# RULES: + +# Show application credential details. +# GET /v3/users/{user_id}/application_credentials/{application_credential_id} +# HEAD /v3/users/{user_id}/application_credentials/{application_credential_id} +"identity:get_application_credential": "rule:admin or rule:owner or rule:reader" + +# List application credentials for a user. +# GET /v3/users/{user_id}/application_credentials +# HEAD /v3/users/{user_id}/application_credentials +"identity:list_application_credentials": "rule:admin or rule:owner or rule:reader" + +# Create an application credential. +# POST /v3/users/{user_id}/application_credentials +"identity:create_application_credential": "rule:admin or rule:owner" + +# Delete an application credential. +# DELETE /v3/users/{user_id}/application_credentials/{application_credential_id} +"identity:delete_application_credential": "rule:admin or rule:owner" + +# Authorize OAUTH1 request token. +# PUT /v3/OS-OAUTH1/authorize/{request_token_id} +# Intended scope(s): project +"identity:authorize_request_token": "rule:admin" + +# Get OAUTH1 access token for user by access token ID. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +"identity:get_access_token": "rule:admin" + +# Get role for user OAUTH1 access token. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id} +# Intended scope(s): project +"identity:get_access_token_role": "rule:admin" + +# List OAUTH1 access tokens for user. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens +# Intended scope(s): project +"identity:list_access_tokens": "rule:admin" + +# List OAUTH1 access token roles. +# GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles +# Intended scope(s): project +"identity:list_access_token_roles": "rule:admin" + +# Delete OAUTH1 access token. +# DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} +# Intended scope(s): project +"identity:delete_access_token": "rule:admin" + +# Get service catalog. +# GET /v3/auth/catalog +# HEAD /v3/auth/catalog +"identity:get_auth_catalog": "rule:admin or rule:member" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +# HEAD /v3/auth/projects +"identity:get_auth_projects": "rule:admin or rule:member" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +# HEAD /v3/auth/domains +"identity:get_auth_domains": "rule:admin or rule:member" + +# List systems a user has access to via role assignments. +# GET /v3/auth/system +# HEAD /v3/auth/system +"identity:get_auth_system": "rule:admin or rule:member" + +# Show OAUTH1 consumer details. +# GET /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:get_consumer": "rule:admin" + +# List OAUTH1 consumers. +# GET /v3/OS-OAUTH1/consumers +# Intended scope(s): system +"identity:list_consumers": "rule:admin" + +# Create OAUTH1 consumer. +# POST /v3/OS-OAUTH1/consumers +# Intended scope(s): system +"identity:create_consumer": "rule:admin" + +# Update OAUTH1 consumer. +# PATCH /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:update_consumer": "rule:admin" + +# Delete OAUTH1 consumer. +# DELETE /v3/OS-OAUTH1/consumers/{consumer_id} +# Intended scope(s): system +"identity:delete_consumer": "rule:admin" + +# Show credentials details. +# GET /v3/credentials/{credential_id} +"identity:get_credential": "rule:admin" + +# List credentials. +# GET /v3/credentials +"identity:list_credentials": "rule:admin" + +# Create credential. +# POST /v3/credentials +"identity:create_credential": "rule:admin" + +# Update credential. +# PATCH /v3/credentials/{credential_id} +"identity:update_credential": "rule:admin" + +# Delete credential. +# DELETE /v3/credentials/{credential_id} +"identity:delete_credential": "rule:admin" + +# Show domain details. +# GET /v3/domains/{domain_id} +# Intended scope(s): system +"identity:get_domain": "rule:admin or token.project.domain.id:%(target.domain.id)s or rule:reader" + +# List domains. +# GET /v3/domains +# Intended scope(s): system +"identity:list_domains": "rule:admin or rule:reader" + +# Create domain. +# POST /v3/domains +# Intended scope(s): system +"identity:create_domain": "rule:admin" + +# Update domain. +# PATCH /v3/domains/{domain_id} +# Intended scope(s): system +"identity:update_domain": "rule:admin" + +# Delete domain. +# DELETE /v3/domains/{domain_id} +# Intended scope(s): system +"identity:delete_domain": "rule:admin" + +# Create domain configuration. +# PUT /v3/domains/{domain_id}/config +# Intended scope(s): system +"identity:create_domain_config": "rule:admin" + +# Get the entire domain configuration for a domain, an option group +# within a domain, or a specific configuration option within a group +# for a domain. +# GET /v3/domains/{domain_id}/config +# HEAD /v3/domains/{domain_id}/config +# GET /v3/domains/{domain_id}/config/{group} +# HEAD /v3/domains/{domain_id}/config/{group} +# GET /v3/domains/{domain_id}/config/{group}/{option} +# HEAD /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:get_domain_config": "rule:admin or rule:reader" + +# Get security compliance domain configuration for either a domain or +# a specific option in a domain. +# GET /v3/domains/{domain_id}/config/security_compliance +# HEAD /v3/domains/{domain_id}/config/security_compliance +# GET v3/domains/{domain_id}/config/security_compliance/{option} +# HEAD v3/domains/{domain_id}/config/security_compliance/{option} +# Intended scope(s): system, project +"identity:get_security_compliance_domain_config": "rule:admin or rule:member" + +# Update domain configuration for either a domain, specific group or a +# specific option in a group. +# PATCH /v3/domains/{domain_id}/config +# PATCH /v3/domains/{domain_id}/config/{group} +# PATCH /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:update_domain_config": "rule:admin" + +# Delete domain configuration for either a domain, specific group or a +# specific option in a group. +# DELETE /v3/domains/{domain_id}/config +# DELETE /v3/domains/{domain_id}/config/{group} +# DELETE /v3/domains/{domain_id}/config/{group}/{option} +# Intended scope(s): system +"identity:delete_domain_config": "rule:admin" + +# Get domain configuration default for either a domain, specific group +# or a specific option in a group. +# GET /v3/domains/config/default +# HEAD /v3/domains/config/default +# GET /v3/domains/config/{group}/default +# HEAD /v3/domains/config/{group}/default +# GET /v3/domains/config/{group}/{option}/default +# HEAD /v3/domains/config/{group}/{option}/default +# Intended scope(s): system +"identity:get_domain_config_default": "rule:admin or rule:reader" + +# Show ec2 credential details. +# GET /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +"identity:ec2_get_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s) or rule:reader" + +# List ec2 credentials. +# GET /v3/users/{user_id}/credentials/OS-EC2 +"identity:ec2_list_credentials": "rule:admin or rule:owner" + +# Create ec2 credential. +# POST /v3/users/{user_id}/credentials/OS-EC2 +"identity:ec2_create_credential": "rule:admin or rule:owner" + +# Delete ec2 credential. +# DELETE /v3/users/{user_id}/credentials/OS-EC2/{credential_id} +"identity:ec2_delete_credential": "rule:admin or (rule:owner and user_id:%(target.credential.user_id)s)" + +# Show endpoint details. +# GET /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:get_endpoint": "rule:admin or rule:reader" + +# List endpoints. +# GET /v3/endpoints +# Intended scope(s): system +"identity:list_endpoints": "rule:admin or rule:reader" + +# Create endpoint. +# POST /v3/endpoints +# Intended scope(s): system +"identity:create_endpoint": "rule:admin" + +# Update endpoint. +# PATCH /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:update_endpoint": "rule:admin" + +# Delete endpoint. +# DELETE /v3/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:delete_endpoint": "rule:admin" + +# Create endpoint group. +# POST /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +"identity:create_endpoint_group": "rule:admin" + +# List endpoint groups. +# GET /v3/OS-EP-FILTER/endpoint_groups +# Intended scope(s): system +"identity:list_endpoint_groups": "rule:admin or rule:reader" + +# Get endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:get_endpoint_group": "rule:admin or rule:reader" + +# Update endpoint group. +# PATCH /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:update_endpoint_group": "rule:admin" + +# Delete endpoint group. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id} +# Intended scope(s): system +"identity:delete_endpoint_group": "rule:admin" + +# List all projects associated with a specific endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects +# Intended scope(s): system +"identity:list_projects_associated_with_endpoint_group": "rule:admin or rule:reader" + +# List all endpoints associated with an endpoint group. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints +# Intended scope(s): system +"identity:list_endpoints_associated_with_endpoint_group": "rule:admin or rule:reader" + +# Check if an endpoint group is associated with a project. +# GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:get_endpoint_group_in_project": "rule:admin or rule:reader" + +# List endpoint groups associated with a specific project. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoint_groups +# Intended scope(s): system +"identity:list_endpoint_groups_for_project": "rule:admin or rule:reader" + +# Allow a project to access an endpoint group. +# PUT /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:add_endpoint_group_to_project": "rule:admin" + +# Remove endpoint group from project. +# DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id} +# Intended scope(s): system +"identity:remove_endpoint_group_from_project": "rule:admin" + +# Check a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# HEAD /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# GET /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# GET /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# GET /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# HEAD /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# HEAD /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:check_grant": "rule:admin or rule:reader" + +# List roles granted to an actor on a target. A target can be either a +# domain or a project. An actor can be either a user or a group. For +# the OS-INHERIT APIs, it is possible to list inherited role grants +# for actors on domains, where grants are inherited to all projects in +# the specified domain. +# GET /v3/projects/{project_id}/users/{user_id}/roles +# HEAD /v3/projects/{project_id}/users/{user_id}/roles +# GET /v3/projects/{project_id}/groups/{group_id}/roles +# HEAD /v3/projects/{project_id}/groups/{group_id}/roles +# GET /v3/domains/{domain_id}/users/{user_id}/roles +# HEAD /v3/domains/{domain_id}/users/{user_id}/roles +# GET /v3/domains/{domain_id}/groups/{group_id}/roles +# HEAD /v3/domains/{domain_id}/groups/{group_id}/roles +# GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects +# GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects +# Intended scope(s): system +"identity:list_grants": "rule:admin or rule:reader" + +# Create a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. +# PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# PUT /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# PUT /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# PUT /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:create_grant": "rule:admin" + +# Revoke a role grant between a target and an actor. A target can be +# either a domain or a project. An actor can be either a user or a +# group. These terms also apply to the OS-INHERIT APIs, where grants +# on the target are inherited to all projects in the subtree, if +# applicable. In that case, revoking the role grant in the target +# would remove the logical effect of inheriting it to the target's +# projects subtree. +# DELETE /v3/projects/{project_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/users/{user_id}/roles/{role_id} +# DELETE /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} +# DELETE /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects +# DELETE /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects +# Intended scope(s): system +"identity:revoke_grant": "rule:admin" + +# List all grants a specific user has on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles +# Intended scope(s): system +"identity:list_system_grants_for_user": "rule:admin or rule:reader" + +# Check if a user has a role on the system. +# ['HEAD', 'GET'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:check_system_grant_for_user": "rule:admin or rule:reader" + +# Grant a user a role on the system. +# ['PUT'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:create_system_grant_for_user": "rule:admin" + +# Remove a role from a user on the system. +# ['DELETE'] /v3/system/users/{user_id}/roles/{role_id} +# Intended scope(s): system +"identity:revoke_system_grant_for_user": "rule:admin" + +# List all grants a specific group has on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles +# Intended scope(s): system +"identity:list_system_grants_for_group": "rule:admin or rule:reader" + +# Check if a group has a role on the system. +# ['HEAD', 'GET'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:check_system_grant_for_group": "rule:admin or rule:reader" + +# Grant a group a role on the system. +# ['PUT'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:create_system_grant_for_group": "rule:admin" + +# Remove a role from a group on the system. +# ['DELETE'] /v3/system/groups/{group_id}/roles/{role_id} +# Intended scope(s): system +"identity:revoke_system_grant_for_group": "rule:admin" + +# Show group details. +# GET /v3/groups/{group_id} +# HEAD /v3/groups/{group_id} +# Intended scope(s): system +"identity:get_group": "rule:admin or rule:reader" + +# List groups. +# GET /v3/groups +# HEAD /v3/groups +# Intended scope(s): system +"identity:list_groups": "rule:admin or rule:reader" + +# List groups to which a user belongs. +# GET /v3/users/{user_id}/groups +# HEAD /v3/users/{user_id}/groups +# Intended scope(s): system +"identity:list_groups_for_user": "rule:admin or rule:owner or rule:reader" + +# Create group. +# POST /v3/groups +# Intended scope(s): system +"identity:create_group": "rule:admin" + +# Update group. +# PATCH /v3/groups/{group_id} +# Intended scope(s): system +"identity:update_group": "rule:admin" + +# Delete group. +# DELETE /v3/groups/{group_id} +# Intended scope(s): system +"identity:delete_group": "rule:admin" + +# List members of a specific group. +# GET /v3/groups/{group_id}/users +# HEAD /v3/groups/{group_id}/users +# Intended scope(s): system +"identity:list_users_in_group": "rule:admin or rule:reader" + +# Remove user from group. +# DELETE /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:remove_user_from_group": "rule:admin" + +# Check whether a user is a member of a group. +# HEAD /v3/groups/{group_id}/users/{user_id} +# GET /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:check_user_in_group": "rule:admin or rule:reader" + +# Add user to group. +# PUT /v3/groups/{group_id}/users/{user_id} +# Intended scope(s): system +"identity:add_user_to_group": "rule:admin" + +# Create identity provider. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:create_identity_provider": "rule:admin" + +# List identity providers. +# GET /v3/OS-FEDERATION/identity_providers +# HEAD /v3/OS-FEDERATION/identity_providers +# Intended scope(s): system +"identity:list_identity_providers": "rule:admin or rule:reader" + +# Get identity provider. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id} +# HEAD /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:get_identity_provider": "rule:admin or rule:reader" + +# Update identity provider. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:update_identity_provider": "rule:admin" + +# Delete identity provider. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id} +# Intended scope(s): system +"identity:delete_identity_provider": "rule:admin" + +# Get information about an association between two roles. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:get_implied_role": "rule:admin or rule:reader" + +# List associations between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. This +# will return all the implied roles that would be assumed by the user +# who gets the specified prior role. +# GET /v3/roles/{prior_role_id}/implies +# HEAD /v3/roles/{prior_role_id}/implies +# Intended scope(s): system +"identity:list_implied_roles": "rule:admin or rule:reader" + +# Create an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# PUT /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:create_implied_role": "rule:admin" + +# Delete the association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. Removing +# the association will cause that effect to be eliminated. +# DELETE /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:delete_implied_role": "rule:admin" + +# List all associations between two roles in the system. When a +# relationship exists between a prior role and an implied role and the +# prior role is assigned to a user, the user also assumes the implied +# role. +# GET /v3/role_inferences +# HEAD /v3/role_inferences +# Intended scope(s): system +"identity:list_role_inference_rules": "rule:admin or rule:reader" + +# Check an association between two roles. When a relationship exists +# between a prior role and an implied role and the prior role is +# assigned to a user, the user also assumes the implied role. +# HEAD /v3/roles/{prior_role_id}/implies/{implied_role_id} +# Intended scope(s): system +"identity:check_implied_role": "rule:admin or rule:reader" + +# Get limit enforcement model. +# GET /v3/limits/model +# HEAD /v3/limits/model +# Intended scope(s): system, project +"identity:get_limit_model": "rule:admin or rule:member" + +# Show limit details. +# GET /v3/limits/{limit_id} +# HEAD /v3/limits/{limit_id} +# Intended scope(s): system, project +"identity:get_limit": "rule:admin or rule:member" + +# List limits. +# GET /v3/limits +# HEAD /v3/limits +# Intended scope(s): system, project +"identity:list_limits": "rule:admin or rule:member" + +# Create limits. +# POST /v3/limits +# Intended scope(s): system +"identity:create_limits": "rule:admin" + +# Update limit. +# PATCH /v3/limits/{limit_id} +# Intended scope(s): system +"identity:update_limit": "rule:admin" + +# Delete limit. +# DELETE /v3/limits/{limit_id} +# Intended scope(s): system +"identity:delete_limit": "rule:admin" + +# Create a new federated mapping containing one or more sets of rules. +# PUT /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:create_mapping": "rule:admin" + +# Get a federated mapping. +# GET /v3/OS-FEDERATION/mappings/{mapping_id} +# HEAD /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:get_mapping": "rule:admin or rule:reader" + +# List federated mappings. +# GET /v3/OS-FEDERATION/mappings +# HEAD /v3/OS-FEDERATION/mappings +# Intended scope(s): system +"identity:list_mappings": "rule:admin or rule:reader" + +# Delete a federated mapping. +# DELETE /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:delete_mapping": "rule:admin" + +# Update a federated mapping. +# PATCH /v3/OS-FEDERATION/mappings/{mapping_id} +# Intended scope(s): system +"identity:update_mapping": "rule:admin" + +# Show policy details. +# GET /v3/policy/{policy_id} +# Intended scope(s): system +"identity:get_policy": "rule:admin or rule:reader" + +# List policies. +# GET /v3/policies +# Intended scope(s): system +"identity:list_policies": "rule:admin or rule:reader" + +# Create policy. +# POST /v3/policies +# Intended scope(s): system +"identity:create_policy": "rule:admin" + +# Update policy. +# PATCH /v3/policies/{policy_id} +# Intended scope(s): system +"identity:update_policy": "rule:admin" + +# Delete policy. +# DELETE /v3/policies/{policy_id} +# Intended scope(s): system +"identity:delete_policy": "rule:admin" + +# Associate a policy to a specific endpoint. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:create_policy_association_for_endpoint": "rule:admin" + +# Check policy association for endpoint. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:check_policy_association_for_endpoint": "rule:admin or rule:reader" + +# Delete policy association for endpoint. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:delete_policy_association_for_endpoint": "rule:admin" + +# Associate a policy to a specific service. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:create_policy_association_for_service": "rule:admin" + +# Check policy association for service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:check_policy_association_for_service": "rule:admin or rule:reader" + +# Delete policy association for service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id} +# Intended scope(s): system +"identity:delete_policy_association_for_service": "rule:admin" + +# Associate a policy to a specific region and service combination. +# PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:create_policy_association_for_region_and_service": "rule:admin" + +# Check policy association for region and service. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:check_policy_association_for_region_and_service": "rule:admin or rule:reader" + +# Delete policy association for region and service. +# DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id} +# Intended scope(s): system +"identity:delete_policy_association_for_region_and_service": "rule:admin" + +# Get policy for endpoint. +# GET /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# HEAD /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy +# Intended scope(s): system +"identity:get_policy_for_endpoint": "rule:admin or rule:reader" + +# List endpoints for policy. +# GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints +# Intended scope(s): system +"identity:list_endpoints_for_policy": "rule:admin or rule:reader" + +# Show project details. +# GET /v3/projects/{project_id} +"identity:get_project": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# List projects. +# GET /v3/projects +# Intended scope(s): system +"identity:list_projects": "rule:admin or rule:reader" + +# List projects for user. +# GET /v3/users/{user_id}/projects +"identity:list_user_projects": "rule:admin or rule:owner or rule:reader" + +# Create project. +# POST /v3/projects +# Intended scope(s): system +"identity:create_project": "rule:admin" + +# Update project. +# PATCH /v3/projects/{project_id} +# Intended scope(s): system +"identity:update_project": "rule:admin" + +# Delete project. +# DELETE /v3/projects/{project_id} +# Intended scope(s): system +"identity:delete_project": "rule:admin" + +# List tags for a project. +# GET /v3/projects/{project_id}/tags +# HEAD /v3/projects/{project_id}/tags +"identity:list_project_tags": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# Check if project contains a tag. +# GET /v3/projects/{project_id}/tags/{value} +# HEAD /v3/projects/{project_id}/tags/{value} +"identity:get_project_tag": "rule:admin or project_id:%(target.project.id)s or rule:reader" + +# Replace all tags on a project with the new set of tags. +# PUT /v3/projects/{project_id}/tags +# Intended scope(s): system +"identity:update_project_tags": "rule:admin" + +# Add a single tag to a project. +# PUT /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +"identity:create_project_tag": "rule:admin" + +# Remove all tags from a project. +# DELETE /v3/projects/{project_id}/tags +# Intended scope(s): system +"identity:delete_project_tags": "rule:admin" + +# Delete a specified tag from project. +# DELETE /v3/projects/{project_id}/tags/{value} +# Intended scope(s): system +"identity:delete_project_tag": "rule:admin" + +# List projects allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/endpoints/{endpoint_id}/projects +# Intended scope(s): system +"identity:list_projects_for_endpoint": "rule:admin or rule:reader" + +# Allow project to access an endpoint. +# PUT /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:add_endpoint_to_project": "rule:admin" + +# Check if a project is allowed to access an endpoint. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# HEAD /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:check_endpoint_in_project": "rule:admin or rule:reader" + +# List the endpoints a project is allowed to access. +# GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints +# Intended scope(s): system +"identity:list_endpoints_for_project": "rule:admin or rule:reader" + +# Remove access to an endpoint from a project that has previously been +# given explicit access. +# DELETE /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id} +# Intended scope(s): system +"identity:remove_endpoint_from_project": "rule:admin" + +# Create federated protocol. +# PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:create_protocol": "rule:admin" + +# Update federated protocol. +# PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:update_protocol": "rule:admin" + +# Get federated protocol. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:get_protocol": "rule:admin or rule:reader" + +# List federated protocols. +# GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols +# Intended scope(s): system +"identity:list_protocols": "rule:admin or rule:reader" + +# Delete federated protocol. +# DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id} +# Intended scope(s): system +"identity:delete_protocol": "rule:admin" + +# Show region details. +# GET /v3/regions/{region_id} +# HEAD /v3/regions/{region_id} +# Intended scope(s): system, project +"identity:get_region": "rule:admin or rule:member" + +# List regions. +# GET /v3/regions +# HEAD /v3/regions +# Intended scope(s): system, project +"identity:list_regions": "rule:admin or rule:member" + +# Create region. +# POST /v3/regions +# PUT /v3/regions/{region_id} +# Intended scope(s): system +"identity:create_region": "rule:admin" + +# Update region. +# PATCH /v3/regions/{region_id} +# Intended scope(s): system +"identity:update_region": "rule:admin" + +# Delete region. +# DELETE /v3/regions/{region_id} +# Intended scope(s): system +"identity:delete_region": "rule:admin" + +# Show registered limit details. +# GET /v3/registered_limits/{registered_limit_id} +# HEAD /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system, project +"identity:get_registered_limit": "rule:admin or rule:member" + +# List registered limits. +# GET /v3/registered_limits +# HEAD /v3/registered_limits +# Intended scope(s): system, project +"identity:list_registered_limits": "rule:admin or rule:member" + +# Create registered limits. +# POST /v3/registered_limits +# Intended scope(s): system +"identity:create_registered_limits": "rule:admin" + +# Update registered limit. +# PATCH /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +"identity:update_registered_limit": "rule:admin" + +# Delete registered limit. +# DELETE /v3/registered_limits/{registered_limit_id} +# Intended scope(s): system +"identity:delete_registered_limit": "rule:admin" + +# List revocation events. +# GET /v3/OS-REVOKE/events +# Intended scope(s): system +"identity:list_revoke_events": "rule:admin or rule:service_role or rule:reader" + +# Show role details. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +"identity:get_role": "rule:admin or rule:reader" + +# List roles. +# GET /v3/roles +# HEAD /v3/roles +# Intended scope(s): system +"identity:list_roles": "rule:admin or rule:reader" + +# Create role. +# POST /v3/roles +# Intended scope(s): system +"identity:create_role": "rule:admin" + +# Update role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +"identity:update_role": "rule:admin" + +# Delete role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +"identity:delete_role": "rule:admin" + +# Show domain role. +# GET /v3/roles/{role_id} +# HEAD /v3/roles/{role_id} +# Intended scope(s): system +"identity:get_domain_role": "rule:admin or rule:reader" + +# List domain roles. +# GET /v3/roles?domain_id={domain_id} +# HEAD /v3/roles?domain_id={domain_id} +# Intended scope(s): system +"identity:list_domain_roles": "rule:admin or rule:reader" + +# Create domain role. +# POST /v3/roles +# Intended scope(s): system +"identity:create_domain_role": "rule:admin" + +# Update domain role. +# PATCH /v3/roles/{role_id} +# Intended scope(s): system +"identity:update_domain_role": "rule:admin" + +# Delete domain role. +# DELETE /v3/roles/{role_id} +# Intended scope(s): system +"identity:delete_domain_role": "rule:admin" + +# List role assignments. +# GET /v3/role_assignments +# HEAD /v3/role_assignments +# Intended scope(s): system +"identity:list_role_assignments": "rule:admin or rule:reader" + +# List all role assignments for a given tree of hierarchical projects. +# GET /v3/role_assignments?include_subtree +# HEAD /v3/role_assignments?include_subtree +# Intended scope(s): project +"identity:list_role_assignments_for_tree": "rule:admin or rule:reader" + +# Show service details. +# GET /v3/services/{service_id} +# Intended scope(s): system +"identity:get_service": "rule:admin or rule:reader" + +# List services. +# GET /v3/services +# Intended scope(s): system +"identity:list_services": "rule:admin or rule:reader" + +# Create service. +# POST /v3/services +# Intended scope(s): system +"identity:create_service": "rule:admin" + +# Update service. +# PATCH /v3/services/{service_id} +# Intended scope(s): system +"identity:update_service": "rule:admin" + +# Delete service. +# DELETE /v3/services/{service_id} +# Intended scope(s): system +"identity:delete_service": "rule:admin" + +# Create federated service provider. +# PUT /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:create_service_provider": "rule:admin" + +# List federated service providers. +# GET /v3/OS-FEDERATION/service_providers +# HEAD /v3/OS-FEDERATION/service_providers +# Intended scope(s): system +"identity:list_service_providers": "rule:admin or rule:reader" + +# Get federated service provider. +# GET /v3/OS-FEDERATION/service_providers/{service_provider_id} +# HEAD /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:get_service_provider": "rule:admin or rule:reader" + +# Update federated service provider. +# PATCH /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:update_service_provider": "rule:admin" + +# Delete federated service provider. +# DELETE /v3/OS-FEDERATION/service_providers/{service_provider_id} +# Intended scope(s): system +"identity:delete_service_provider": "rule:admin" + +# List revoked PKI tokens. +# GET /v3/auth/tokens/OS-PKI/revoked +# Intended scope(s): system, project +"identity:revocation_list": "rule:admin or rule:service_role or rule:reader" + +# Check a token. +# HEAD /v3/auth/tokens +"identity:check_token": "rule:admin or rule:token_subject" + +# Validate a token. +# GET /v3/auth/tokens +"identity:validate_token": "rule:admin or rule:service_role or rule:token_subject or rule:reader" + +# Revoke a token. +# DELETE /v3/auth/tokens +"identity:revoke_token": "rule:admin or rule:token_subject" + +# Create trust. +# POST /v3/OS-TRUST/trusts +# Intended scope(s): project +"identity:create_trust": "user_id:%(trust.trustor_user_id)s" + +# List trusts. +# GET /v3/OS-TRUST/trusts +# HEAD /v3/OS-TRUST/trusts +# Intended scope(s): project +"identity:list_trusts": "rule:admin or rule:member" + +# List roles delegated by a trust. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles +# Intended scope(s): project +"identity:list_roles_for_trust": "rule:admin or rule:member" + +# Check if trust delegates a particular role. +# GET /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id} +# Intended scope(s): project +"identity:get_role_for_trust": "rule:admin or rule:member" + +# Revoke trust. +# DELETE /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +"identity:delete_trust": "rule:admin or rule:member" + +# Get trust. +# GET /v3/OS-TRUST/trusts/{trust_id} +# HEAD /v3/OS-TRUST/trusts/{trust_id} +# Intended scope(s): project +"identity:get_trust": "rule:admin or rule:member" + +# Show user details. +# GET /v3/users/{user_id} +# HEAD /v3/users/{user_id} +"identity:get_user": "rule:admin or rule:owner or rule:reader" + +# List users. +# GET /v3/users +# HEAD /v3/users +# Intended scope(s): system +"identity:list_users": "rule:admin or rule:reader" + +# List all projects a user has access to via role assignments. +# GET /v3/auth/projects +"identity:list_projects_for_user": "rule:admin or rule:member" + +# List all domains a user has access to via role assignments. +# GET /v3/auth/domains +"identity:list_domains_for_user": "rule:admin or rule:member" + +# Create a user. +# POST /v3/users +# Intended scope(s): system +"identity:create_user": "rule:admin" + +# Update a user, including administrative password resets. +# PATCH /v3/users/{user_id} +# Intended scope(s): system +"identity:update_user": "rule:admin" + +# Delete a user. +# DELETE /v3/users/{user_id} +# Intended scope(s): system +"identity:delete_user": "rule:admin" diff --git a/services/manila/policy.yaml b/services/manila/policy.yaml new file mode 100644 index 0000000..fa5bee5 --- /dev/null +++ b/services/manila/policy.yaml @@ -0,0 +1,772 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +"default": "rule:admin or rule:member" + +### Policy Rules defined in manila.policies.availability_zone + +# Get all storage availability zones. +# GET /os-availability-zone +# GET /availability-zone +# +"availability_zone:index": "rule:default or rule:reader" + +### Policy Rules defined in manila.policies.base + +### Policy Rules defined in manila.policies.message + +# Get details of a given message. +# GET /messages/{message_id} +# +"message:get": "rule:default or rule:reader" + +# Get all messages. +# GET /messages +# GET /messages?{query} +# +"message:get_all": "rule:default or rule:reader" + +# Delete a message. +# DELETE /messages/{message_id} +# +"message:delete": "rule:default" + +### Policy Rules defined in manila.policies.quota_class_set + +# Update quota class. +# PUT /quota-class-sets/{class_name} +# PUT /os-quota-class-sets/{class_name} +# +"quota_class_set:update": "rule:admin" + +# Get quota class. +# GET /quota-class-sets/{class_name} +# GET /os-quota-class-sets/{class_name} +# +"quota_class_set:show": "rule:defaul or rule:readert" + +### Policy Rules defined in manila.policies.quota_set + +# Update the quotas for a project/user and/or share type. +# PUT /quota-sets/{tenant_id} +# PUT /quota-sets/{tenant_id}?user_id={user_id} +# PUT /quota-sets/{tenant_id}?share_type={share_type_id} +# PUT /os-quota-sets/{tenant_id} +# PUT /os-quota-sets/{tenant_id}?user_id={user_id} +# +"quota_set:update": "rule:admin" + +# List the quotas for a tenant/user. +# GET /quota-sets/{tenant_id}/defaults +# GET /os-quota-sets/{tenant_id}/defaults +# +"quota_set:show": "rule:default or rule:reader" + +# Delete quota for a tenant/user or tenant/share-type. The quota will revert back to default (Admin only). +# DELETE /quota-sets/{tenant_id} +# DELETE /quota-sets/{tenant_id}?user_id={user_id} +# DELETE /quota-sets/{tenant_id}?share_type={share_type_id} +# DELETE /os-quota-sets/{tenant_id} +# DELETE /os-quota-sets/{tenant_id}?user_id={user_id} +# +"quota_set:delete": "rule:admin" + +### Policy Rules defined in manila.policies.scheduler_stats + +# Get information regarding backends (and storage pools) known to the scheduler. +# GET /scheduler-stats/pools +# GET /scheduler-stats/pools?{query} +# +"scheduler_stats:pools:index": "rule:admin or rule:reader" + +# Get detailed information regarding backends (and storage pools) known to the scheduler. +# GET /scheduler-stats/pools/detail?{query} +# GET /scheduler-stats/pools/detail +# +"scheduler_stats:pools:detail": "rule:admin or rule:reader" + +### Policy Rules defined in manila.policies.security_service + +# Create security service. +# POST /security-services +# +"security_service:create": "rule:default" + +# Get details of a security service. +# GET /security-services/{security_service_id} +# +"security_service:show": "rule:default or rule:reader" + +# Get details of all security services. +# GET /security-services/detail?{query} +# GET /security-services/detail +# +"security_service:detail": "rule:default or rule:reader" + +# Get all security services. +# GET /security-services +# GET /security-services?{query} +# +"security_service:index": "rule:default or rule:reader" + +# Update a security service. +# PUT /security-services/{security_service_id} +# +"security_service:update": "rule:default" + +# Delete a security service. +# DELETE /security-services/{security_service_id} +# +"security_service:delete": "rule:default" + +# Get security services of all projects. +# GET /security-services?all_tenants=1 +# GET /security-services/detail?all_tenants=1 +# +"security_service:get_all_security_services": "rule:admin or rule:reader" + +### Policy Rules defined in manila.policies.service + +# Return a list of all running services. +# GET /os-services +# GET /os-services?{query} +# GET /services +# GET /services?{query} +# +"service:index": "rule:admin or rule:reader" + +# Enable/Disable scheduling for a service. +# PUT /os-services/disable +# PUT /os-services/enable +# PUT /services/disable +# PUT /services/enable +# +"service:update": "rule:admin" + +### Policy Rules defined in manila.policies.share_access + +### Policy Rules defined in manila.policies.share_access_metadata + +### Policy Rules defined in manila.policies.share_export_location + +# Get all export locations of a given share. +# GET /shares/{share_id}/export_locations +# +"share_export_location:index": "rule:default or rule:reader" + +# Get details about the requested export location. +# GET /shares/{share_id}/export_locations/{export_location_id} +# +"share_export_location:show": "rule:default or rule:reader" + +### Policy Rules defined in manila.policies.share_group + +# Create share group. +# POST /share-groups +# +"share_group:create": "rule:default" + +# Get details of a share group. +# GET /share-groups/{share_group_id} +# +"share_group:get": "rule:default or rule:reader" + +# Get all share groups. +# GET /share-groups +# GET /share-groups/detail +# GET /share-groups?{query} +# GET /share-groups/detail?{query} +# +"share_group:get_all": "rule:default or rule:reader" + +# Update share group. +# PUT /share-groups/{share_group_id} +# +"share_group:update": "rule:default" + +# Delete share group. +# DELETE /share-groups/{share_group_id} +# +"share_group:delete": "rule:default" + +# Force delete a share group. +# POST /share-groups/{share_group_id}/action +# +"share_group:force_delete": "rule:admin" + +# Reset share group's status. +# POST /share-groups/{share_group_id}/action +# +"share_group:reset_status": "rule:admin" + +### Policy Rules defined in manila.policies.share_group_snapshot + +# Create a new share group snapshot. +# POST /share-group-snapshots +# +"share_group_snapshot:create": "rule:default" + +# Get details of a share group snapshot. +# GET /share-group-snapshots/{share_group_snapshot_id} +# +"share_group_snapshot:get": "rule:default or rule:reader" + +# Get all share group snapshots. +# GET /share-group-snapshots +# GET /share-group-snapshots/detail +# GET /share-group-snapshots/{query} +# GET /share-group-snapshots/detail?{query} +# +"share_group_snapshot:get_all": "rule:default or rule:reader" + +# Update a share group snapshot. +# PUT /share-group-snapshots/{share_group_snapshot_id} +# +"share_group_snapshot:update": "rule:default" + +# Delete a share group snapshot. +# DELETE /share-group-snapshots/{share_group_snapshot_id} +# +"share_group_snapshot:delete": "rule:default" + +# Force delete a share group snapshot. +# POST /share-group-snapshots/{share_group_snapshot_id}/action +# +"share_group_snapshot:force_delete": "rule:admin" + +# Reset a share group snapshot's status. +# POST /share-group-snapshots/{share_group_snapshot_id}/action +# +"share_group_snapshot:reset_status": "rule:admin" + +### Policy Rules defined in manila.policies.share_group_type + +# Create a new share group type. +# POST /share-group-types +# +"share_group_type:create": "rule:admin" + +# Get the list of share group types. +# GET /share-group-types +# GET /share-group-types?is_public=all +# +"share_group_type:index": "rule:default or rule:reader" + +# Get details regarding the specified share group type. +# GET /share-group-types/{share_group_type_id} +# +"share_group_type:show": "rule:default or rule:reader" + +# Get the default share group type. +# GET /share-group-types/default +# +"share_group_type:default": "rule:default or rule:reader" + +# Delete an existing group type. +# DELETE /share-group-types/{share_group_type_id} +# +"share_group_type:delete": "rule:admin" + +# Get project access by share group type. +# POST /share-group-types/{share_group_type_id}/access +# +"share_group_type:list_project_access": "rule:admin or rule:reader" + +# Allow project to use the share group type. +# POST /share-group-types/{share_group_type_id}/action +# +"share_group_type:add_project_access": "rule:admin" + +# Deny project access to use the share group type. +# POST /share-group-types/{share_group_type_id}/action +# +"share_group_type:remove_project_access": "rule:admin" + +### Policy Rules defined in manila.policies.share_group_types_spec + +# Create share group type specs. +# POST /share-group-types/{share_group_type_id}/group-specs +# +"share_group_types_spec:create": "rule:admin" + +# Get share group type specs. +# GET /share-group-types/{share_group_type_id}/group-specs +# +"share_group_types_spec:index": "rule:admin or rule:reader" + +# Get details of a share group type spec. +# GET /share-group-types/{share_group_type_id}/group-specs/{key} +# +"share_group_types_spec:show": "rule:admin or rule:reader" + +# Update a share group type spec. +# PUT /share-group-types/{share_group_type_id}/group-specs/{key} +# +"share_group_types_spec:update": "rule:admin" + +# Delete a share group type spec. +# DELETE /share-group-types/{share_group_type_id}/group-specs/{key} +# +"share_group_types_spec:delete": "rule:admin" + +### Policy Rules defined in manila.policies.share_instance + +### Policy Rules defined in manila.policies.share_instance_export_location + +### Policy Rules defined in manila.policies.share_network + +# Create share network. +# POST /share-networks +# +"share_network:create": "rule:default" + +# Get details of a share network. +# GET /share-networks/{share_network_id} +# +"share_network:show": "rule:default or rule:reader" + +# Get all share networks. +# GET /share-networks +# GET /share-networks?{query} +# +"share_network:index": "rule:default or rule:reader" + +# Get details of share networks . +# GET /share-networks/detail?{query} +# GET /share-networks/detail +# +"share_network:detail": "rule:default or rule:reader" + +# Update a share network. +# PUT /share-networks/{share_network_id} +# +"share_network:update": "rule:default" + +# Delete a share network. +# DELETE /share-networks/{share_network_id} +# +"share_network:delete": "rule:default" + +# Add security service to share network. +# POST /share-networks/{share_network_id}/action +# +"share_network:add_security_service": "rule:default" + +# Remove security service from share network. +# POST /share-networks/{share_network_id}/action +# +"share_network:remove_security_service": "rule:default" + +# Get share networks belonging to all projects. +# GET /share-networks?all_tenants=1 +# GET /share-networks/detail?all_tenants=1 +# +"share_network:get_all_share_networks": "rule:admin or rule:reader" + +### Policy Rules defined in manila.policies.share_replica + +# Create share replica. +# POST /share-replicas +# +"share_replica:create": "rule:default" + +# Get all share replicas. +# GET /share-replicas +# GET /share-replicas/detail +# GET /share-replicas/detail?share_id={share_id} +# +"share_replica:get_all": "rule:default or rule:reader" + +# Get details of a share replica. +# GET /share-replicas/{share_replica_id} +# +"share_replica:show": "rule:default or rule:reader" + +# Delete a share replica. +# DELETE /share-replicas/{share_replica_id} +# +"share_replica:delete": "rule:default" + +# Force delete a share replica. +# POST /share-replicas/{share_replica_id}/action +# +"share_replica:force_delete": "rule:admin" + +# Promote a non-active share replica to active. +# POST /share-replicas/{share_replica_id}/action +# +"share_replica:promote": "rule:default" + +# Resync a share replica that is out of sync. +# POST /share-replicas/{share_replica_id}/action +# +"share_replica:resync": "rule:admin" + +# Reset share replica's replica_state attribute. +# POST /share-replicas/{share_replica_id}/action +# +"share_replica:reset_replica_state": "rule:admin" + +# Reset share replica's status. +# POST /share-replicas/{share_replica_id}/action +# +"share_replica:reset_status": "rule:admin" + +### Policy Rules defined in manila.policies.share_server + +# Get share servers. +# GET /share-servers +# GET /share-servers?{query} +# +"share_server:index": "rule:admin or rule:reader" + +# Show share server. +# GET /share-servers/{server_id} +# +"share_server:show": "rule:admin or rule:reader" + +# Get share server details. +# GET /share-servers/{server_id}/details +# +"share_server:details": "rule:admin or rule:reader" + +# Delete share server. +# DELETE /share-servers/{server_id} +# +"share_server:delete": "rule:admin" + +### Policy Rules defined in manila.policies.share_snapshot + +# Get share snapshot. +# GET /snapshots/{snapshot_id} +# +"share_snapshot:get_snapshot": "rule:default or rule:reader" + +# Get all share snapshots. +# GET /snapshots +# GET /snapshots/detail +# GET /snapshots?{query} +# GET /snapshots/detail?{query} +# +"share_snapshot:get_all_snapshots": "rule:default or rule:reader" + +# Force Delete a share snapshot. +# DELETE /snapshots/{snapshot_id} +# +"share_snapshot:force_delete": "rule:admin" + +# Manage share snapshot. +# POST /snapshots/manage +# +"share_snapshot:manage_snapshot": "rule:admin" + +# Unmanage share snapshot. +# POST /snapshots/{snapshot_id}/action +# +"share_snapshot:unmanage_snapshot": "rule:admin" + +# Reset status. +# POST /snapshots/{snapshot_id}/action +# +"share_snapshot:reset_status": "rule:admin" + +# List access rules of a share snapshot. +# GET /snapshots/{snapshot_id}/access-list +# +"share_snapshot:access_list": "rule:default or rule:reader" + +# Allow access to a share snapshot. +# POST /snapshots/{snapshot_id}/action +# +"share_snapshot:allow_access": "rule:default" + +# Deny access to a share snapshot. +# POST /snapshots/{snapshot_id}/action +# +"share_snapshot:deny_access": "rule:default" + +### Policy Rules defined in manila.policies.share_snapshot_export_location + +# List export locations of a share snapshot. +# GET /snapshots/{snapshot_id}/export-locations/ +# +"share_snapshot_export_location:index": "rule:default or rule:reader" + +# Get details of a specified export location of a share snapshot. +# GET /snapshots/{snapshot_id}/export-locations/{export_location_id} +# +"share_snapshot_export_location:show": "rule:default or rule:reader" + +### Policy Rules defined in manila.policies.share_snapshot_instance + +# Get share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id} +# +"share_snapshot_instance:show": "rule:admin or rule:reader" + +# Get all share snapshot instances. +# GET /snapshot-instances +# GET /snapshot-instances?{query} +# +"share_snapshot_instance:index": "rule:admin or rule:reader" + +# Get details of share snapshot instances. +# GET /snapshot-instances/detail +# GET /snapshot-instances/detail?{query} +# +"share_snapshot_instance:detail": "rule:admin or rule:reader" + +# Reset share snapshot instance's status. +# POST /snapshot-instances/{snapshot_instance_id}/action +# +"share_snapshot_instance:reset_status": "rule:admin" + +### Policy Rules defined in manila.policies.share_snapshot_instance_export_location + +# List export locations of a share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id}/export-locations +# +"share_snapshot_instance_export_location:index": "rule:admin or rule:reader" + +# Show details of a specified export location of a share snapshot instance. +# GET /snapshot-instances/{snapshot_instance_id}/export-locations/{export_location_id} +# +"share_snapshot_instance_export_location:show": "rule:admin or rule:reader" + +### Policy Rules defined in manila.policies.share_type + +# Create share type. +# POST /types +# +"share_type:create": "rule:admin" + +# Get share type. +# GET /types/{share_type_id} +# +"share_type:show": "rule:default or rule:reader" + +# List share types. +# GET /types +# GET /types?is_public=all +# +"share_type:index": "rule:default or rule:reader" + +# Get default share type. +# GET /types/default +# +"share_type:default": "rule:default or rule:reader" + +# Delete share type. +# DELETE /types/{share_type_id} +# +"share_type:delete": "rule:admin" + +# List share type project access. +# GET /types/{share_type_id} +# +"share_type:list_project_access": "rule:admin or rule:reader" + +# Add share type to project. +# POST /types/{share_type_id}/action +# +"share_type:add_project_access": "rule:admin" + +# Remove share type from project. +# POST /types/{share_type_id}/action +# +"share_type:remove_project_access": "rule:admin" + +### Policy Rules defined in manila.policies.share_types_extra_spec + +# Create share type extra spec. +# POST /types/{share_type_id}/extra_specs +# +"share_types_extra_spec:create": "rule:admin" + +# Get share type extra specs of a given share type. +# GET /types/{share_type_id}/extra_specs +# +"share_types_extra_spec:show": "rule:admin or rule:reader" + +# Get details of a share type extra spec. +# GET /types/{share_type_id}/extra_specs/{extra_spec_id} +# +"share_types_extra_spec:index": "rule:admin or rule:reader" + +# Update share type extra spec. +# PUT /types/{share_type_id}/extra_specs +# +"share_types_extra_spec:update": "rule:admin" + +# Delete share type extra spec. +# DELETE /types/{share_type_id}/extra_specs/{key} +# +"share_types_extra_spec:delete": "rule:admin" + +### Policy Rules defined in manila.policies.shares + +# Create share. +# POST /shares +# +"share:create": "rule:default" + +# Get share. +# GET /shares/{share_id} +# +"share:get": "rule:default or rule:reader" + +# List shares. +# GET /shares +# GET /shares/detail +# +"share:get_all": "rule:default or rule:reader" + +# Update share. +# PUT /shares +# +"share:update": "rule:default" + +# Delete share. +# DELETE /shares/{share_id} +# +"share:delete": "rule:default" + +# Force Delete a share. +# DELETE /shares/{share_id} +# +"share:force_delete": "rule:admin" + +# Manage share. +# POST /shares/manage +# +"share:manage": "rule:admin" + +# Unmanage share. +# POST /shares/unmanage +# +"share:unmanage": "rule:admin" + +# Create share snapshot. +# POST /snapshots +# +"share:create_snapshot": "rule:default" + +# List share by host. +# GET /shares +# GET /shares/detail +# +"share:list_by_host": "rule:admin or rule:reader" + +# List share by server id. +# GET /shares +# GET /shares/detail +# +"share:list_by_share_server_id": "rule:admin or rule:reader" + +# Get share access rule, it under deny access operation. +# POST /shares/{share_id}/action +# +"share:access_get": "rule:default or rule:reader" + +# List share access rules. +# GET /shares/{share_id}/action +# +"share:access_get_all": "rule:default or rule:reader" + +# Extend share. +# POST /shares/{share_id}/action +# +"share:extend": "rule:default" + +# Shrink share. +# POST /shares/{share_id}/action +# +"share:shrink": "rule:default" + +# Migrate a share to the specified host. +# POST /shares/{share_id}/action +# +"share:migration_start": "rule:admin" + +# Invokes 2nd phase of share migration. +# POST /shares/{share_id}/action +# +"share:migration_complete": "rule:admin" + +# Attempts to cancel share migration. +# POST /shares/{share_id}/action +# +"share:migration_cancel": "rule:admin" + +# Retrieve share migration progress for a given share. +# POST /shares/{share_id}/action +# +"share:migration_get_progress": "rule:admin or rule:reader" + +# Reset task state. +# POST /shares/{share_id}/action +# +"share:reset_task_state": "rule:admin" + +# Reset status. +# POST /shares/{share_id}/action +# +"share:reset_status": "rule:admin" + +# Revert a share to a snapshot. +# POST /shares/{share_id}/action +# +"share:revert_to_snapshot": "rule:default" + +# Add share access rule. +# POST /shares/{share_id}/action +# +"share:allow_access": "rule:default" + +# Remove share access rule. +# POST /shares/{share_id}/action +# +"share:deny_access": "rule:default" + +# Delete share snapshot. +# DELETE /snapshots/{snapshot_id} +# +"share:delete_snapshot": "rule:default" + +# Update share snapshot. +# PUT /snapshots/{snapshot_id}/action +# +"share:snapshot_update": "rule:default" + +# Update share metadata. +# PUT /shares/{share_id}/metadata +# +"share:update_share_metadata": "rule:default" + +# Delete share metadata. +# DELETE /shares/{share_id}/metadata/{key} +# +"share:delete_share_metadata": "rule:default" + +# Get share metadata. +# GET /shares/{share_id}/metadata +# +"share:get_share_metadata": "rule:default or rule:reader" diff --git a/services/neutron/policy.json b/services/neutron/policy.json new file mode 100644 index 0000000..e867e5a --- /dev/null +++ b/services/neutron/policy.json @@ -0,0 +1,211 @@ +{ + "global_reader": "(role:global_reader)", + "reader": "((role:reader and project_id:%(project_id)s) or rule:global_reader)", + "_member_role": "(role:Member or role:member or role:_member_)", + "member": "(rule:_member_role and project_id:%(project_id)s)", + "admin": "(is_admin:True or role:admin)", + "owner": "(rule:_member_role and user_id:%(user_id)s)", + "context_is_advsvc": "role:advsvc", + "network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)", + "admin_or_data_plane_int": "rule:admin or role:data_plane_integrator", + "shared": "field:networks:shared=True", + "shared_subnetpools": "field:subnetpools:shared=True", + "shared_address_scopes": "field:address_scopes:shared=True", + "external": "field:networks:router:external=True", + "default": "rule:admin or rule:member", + "create_subnet": "rule:admin or rule:network_owner", + "create_subnet:segment_id": "rule:admin", + "create_subnet:service_types": "rule:admin", + "get_subnet": "rule:admin or rule:member or rule:shared or rule:reader", + "get_subnet:segment_id": "rule:admin or rule:reader", + "update_subnet": "rule:admin or rule:network_owner", + "update_subnet:service_types": "rule:admin", + "delete_subnet": "rule:admin or rule:network_owner", + "create_subnetpool": "rule:admin or rule:member", + "create_subnetpool:shared": "rule:admin", + "create_subnetpool:is_default": "rule:admin", + "get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader", + "update_subnetpool": "rule:admin or rule:member", + "update_subnetpool:is_default": "rule:admin", + "delete_subnetpool": "rule:admin or rule:member", + "create_address_scope": "rule:admin or rule:member", + "create_address_scope:shared": "rule:admin", + "get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader", + "update_address_scope": "rule:admin or rule:member", + "update_address_scope:shared": "rule:admin", + "delete_address_scope": "rule:admin or rule:member", + "create_network": "rule:admin or rule:member", + "get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader", + "get_network:router:external": "rule:admin or rule:member or rule:reader", + "get_network:segments": "rule:admin or rule:reader", + "get_network:provider:network_type": "rule:admin or rule:reader", + "get_network:provider:physical_network": "rule:admin or rule:reader", + "get_network:provider:segmentation_id": "rule:admin or rule:reader", + "get_network:queue_id": "rule:admin or rule:reader", + "get_network_ip_availabilities": "rule:admin or rule:reader", + "get_network_ip_availability": "rule:admin or rule:reader", + "create_network:shared": "rule:admin", + "create_network:router:external": "rule:admin", + "create_network:is_default": "rule:admin", + "create_network:segments": "rule:admin", + "create_network:provider:network_type": "rule:admin", + "create_network:provider:physical_network": "rule:admin", + "create_network:provider:segmentation_id": "rule:admin", + "update_network": "rule:admin or rule:member", + "update_network:segments": "rule:admin", + "update_network:shared": "rule:admin", + "update_network:provider:network_type": "rule:admin", + "update_network:provider:physical_network": "rule:admin", + "update_network:provider:segmentation_id": "rule:admin", + "update_network:router:external": "rule:admin", + "delete_network": "rule:admin or rule:member", + "create_segment": "rule:admin", + "get_segment": "rule:admin or rule:reader", + "update_segment": "rule:admin", + "delete_segment": "rule:admin", + "network_device": "field:port:device_owner=~^network:", + "create_port": "rule:admin or rule:member", + "create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", + "create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:binding:host_id": "rule:admin", + "create_port:binding:profile": "rule:admin", + "create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "create_port:allowed_address_pairs": "rule:admin or rule:network_owner", + "get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader", + "get_port:queue_id": "rule:admin or rule:reader", + "get_port:binding:vif_type": "rule:admin or rule:reader", + "get_port:binding:vif_details": "rule:admin or rule:reader", + "get_port:binding:host_id": "rule:admin or rule:reader", + "get_port:binding:profile": "rule:admin or rule:reader", + "update_port": "rule:admin or rule:member or rule:context_is_advsvc", + "update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:mac_address": "rule:admin or rule:context_is_advsvc", + "update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared", + "update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:binding:host_id": "rule:admin", + "update_port:binding:profile": "rule:admin", + "update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner", + "update_port:allowed_address_pairs": "rule:admin or rule:network_owner", + "update_port:data_plane_status": "rule:admin_or_data_plane_int", + "delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner", + "get_router:ha": "rule:admin or rule:reader", + "create_router": "rule:admin or rule:member", + "create_router:external_gateway_info:enable_snat": "rule:admin", + "create_router:distributed": "rule:admin", + "create_router:ha": "rule:admin", + "get_router": "rule:admin or rule:member or rule:reader", + "get_router:distributed": "rule:admin or rule:reader", + "update_router": "rule:admin or rule:member", + "update_router:external_gateway_info": "rule:admin or rule:member", + "update_router:external_gateway_info:network_id": "rule:admin or rule:member", + "update_router:external_gateway_info:enable_snat": "rule:admin", + "update_router:distributed": "rule:admin", + "update_router:ha": "rule:admin", + "delete_router": "rule:admin or rule:member", + "add_router_interface": "rule:admin or rule:member", + "remove_router_interface": "rule:admin or rule:member", + "create_router:external_gateway_info:external_fixed_ips": "rule:admin", + "update_router:external_gateway_info:external_fixed_ips": "rule:admin", + "create_qos_queue": "rule:admin", + "get_qos_queue": "rule:admin or rule:reader", + "update_agent": "rule:admin", + "delete_agent": "rule:admin", + "get_agent": "rule:admin or rule:reader", + "create_dhcp-network": "rule:admin", + "delete_dhcp-network": "rule:admin", + "get_dhcp-networks": "rule:admin or rule:reader", + "create_l3-router": "rule:admin", + "delete_l3-router": "rule:admin", + "get_l3-routers": "rule:admin or rule:reader", + "get_dhcp-agents": "rule:admin or rule:reader", + "get_l3-agents": "rule:admin or rule:reader", + "get_loadbalancer-agent": "rule:admin or rule:reader", + "get_loadbalancer-pools": "rule:admin or rule:reader", + "get_agent-loadbalancers": "rule:admin or rule:reader", + "get_loadbalancer-hosting-agent": "rule:admin or rule:reader", + "create_floatingip": "rule:admin or rule:member", + "create_floatingip:floating_ip_address": "rule:admin", + "update_floatingip": "rule:admin or rule:member", + "delete_floatingip": "rule:admin or rule:member", + "get_floatingip": "rule:admin or rule:member or rule:reader", + "create_network_profile": "rule:admin", + "update_network_profile": "rule:admin", + "delete_network_profile": "rule:admin", + "get_network_profiles": "rule:admin or rule:member or rule:reader", + "get_network_profile": "rule:admin or rule:member or rule:reader", + "update_policy_profiles": "rule:admin", + "get_policy_profiles": "rule:admin or rule:member or rule:reader", + "get_policy_profile": "rule:admin or rule:member or rule:reader", + "create_metering_label": "rule:admin", + "delete_metering_label": "rule:admin", + "get_metering_label": "rule:admin or rule:reader", + "create_metering_label_rule": "rule:admin", + "delete_metering_label_rule": "rule:admin", + "get_metering_label_rule": "rule:admin or rule:reader", + "get_service_provider": "rule:admin or rule:member or rule:reader", + "get_lsn": "rule:admin or rule:reader", + "create_lsn": "rule:admin", + "create_flavor": "rule:admin", + "update_flavor": "rule:admin", + "delete_flavor": "rule:admin", + "get_flavors": "rule:admin or rule:member or rule:reader", + "get_flavor": "rule:admin or rule:member or rule:reader", + "create_service_profile": "rule:admin", + "update_service_profile": "rule:admin", + "delete_service_profile": "rule:admin", + "get_service_profiles": "rule:admin or rule:reader", + "get_service_profile": "rule:admin or rule:reader", + "get_policy": "rule:admin or rule:member or rule:reader", + "create_policy": "rule:admin", + "update_policy": "rule:admin", + "delete_policy": "rule:admin", + "get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader", + "create_policy_bandwidth_limit_rule": "rule:admin", + "delete_policy_bandwidth_limit_rule": "rule:admin", + "update_policy_bandwidth_limit_rule": "rule:admin", + "get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader", + "create_policy_dscp_marking_rule": "rule:admin", + "delete_policy_dscp_marking_rule": "rule:admin", + "update_policy_dscp_marking_rule": "rule:admin", + "get_rule_type": "rule:admin or rule:member or rule:reader", + "get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader", + "create_policy_minimum_bandwidth_rule": "rule:admin", + "delete_policy_minimum_bandwidth_rule": "rule:admin", + "update_policy_minimum_bandwidth_rule": "rule:admin", + "restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin", + "create_rbac_policy": "rule:admin or rule:member", + "create_rbac_policy:target_tenant": "rule:restrict_wildcard", + "update_rbac_policy": "rule:admin or rule:member", + "update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member", + "get_rbac_policy": "rule:admin or rule:member or rule:reader", + "delete_rbac_policy": "rule:admin or rule:member", + "create_flavor_service_profile": "rule:admin", + "delete_flavor_service_profile": "rule:admin", + "get_flavor_service_profile": "rule:admin or rule:member or rule:reader", + "get_auto_allocated_topology": "rule:admin or rule:member or rule:reader", + "create_trunk": "rule:admin or rule:member", + "get_trunk": "rule:admin or rule:member or rule:reader", + "delete_trunk": "rule:admin or rule:member", + "get_subports": "rule:admin or rule:member or rule:reader", + "add_subports": "rule:admin or rule:member", + "remove_subports": "rule:admin or rule:member", + "get_security_groups": "rule:admin or rule:member or rule:reader", + "get_security_group": "rule:admin or rule:member or rule:reader", + "create_security_group": "rule:admin or rule:member", + "update_security_group": "rule:admin or rule:member", + "delete_security_group": "rule:admin or rule:member", + "get_security_group_rules": "rule:admin or rule:member or rule:reader", + "get_security_group_rule": "rule:admin or rule:member or rule:reader", + "create_security_group_rule": "rule:admin or rule:member", + "delete_security_group_rule": "rule:admin or rule:member", + "get_loggable_resources": "rule:admin or rule:reader", + "create_log": "rule:admin", + "update_log": "rule:admin", + "delete_log": "rule:admin", + "get_logs": "rule:admin or rule:reader", + "get_log": "rule:admin or rule:reader" +} diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml new file mode 100644 index 0000000..604ab95 --- /dev/null +++ b/services/neutron/policy.yaml @@ -0,0 +1,258 @@ +# FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON + +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +"context_is_advsvc": "role:advsvc" +"network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)" +"admin_or_data_plane_int": "rule:admin or role:data_plane_integrator" +"shared": "field:networks:shared=True" +"shared_subnetpools": "field:subnetpools:shared=True" +"shared_address_scopes": "field:address_scopes:shared=True" +"external": "field:networks:router:external=True" + +# "context_is_admin": "role:admin" +# "owner": "tenant_id:%(tenant_id)s" +# "admin_or_owner": "rule:context_is_admin or rule:owner" +# "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s" +# "admin_owner_or_network_owner": "rule:owner or rule:admin or rule:network_owner" +# "admin_only": "rule:context_is_admin" +# "regular_user": "rule:admin or rule:member" +"default": "rule:admin or rule:member" + +"create_subnet": "rule:admin or rule:network_owner" +"create_subnet:segment_id": "rule:admin" +"create_subnet:service_types": "rule:admin" +"get_subnet": "rule:admin or rule:member or rule:shared or rule:reader" +"get_subnet:segment_id": "rule:admin or rule:reader" +"update_subnet": "rule:admin or rule:network_owner" +"update_subnet:service_types": "rule:admin" +"delete_subnet": "rule:admin or rule:network_owner" + +"create_subnetpool": "rule:admin or rule:member" +"create_subnetpool:shared": "rule:admin" +"create_subnetpool:is_default": "rule:admin" +"get_subnetpool": "rule:admin or rule:member or rule:shared_subnetpools or rule:reader" +"update_subnetpool": "rule:admin or rule:member" +"update_subnetpool:is_default": "rule:admin" +"delete_subnetpool": "rule:admin or rule:member" + +"create_address_scope": "rule:admin or rule:member" +"create_address_scope:shared": "rule:admin" +"get_address_scope": "rule:admin or rule:member or rule:shared_address_scopes or rule:reader" +"update_address_scope": "rule:admin or rule:member" +"update_address_scope:shared": "rule:admin" +"delete_address_scope": "rule:admin or rule:member" + +"create_network": "rule:admin or rule:member" +"get_network": "rule:admin or rule:member or rule:shared or rule:external or rule:context_is_advsvc or rule:reader" +"get_network:router:external": "rule:admin or rule:member or rule:reader" +"get_network:segments": "rule:admin or rule:reader" +"get_network:provider:network_type": "rule:admin or rule:reader" +"get_network:provider:physical_network": "rule:admin or rule:reader" +"get_network:provider:segmentation_id": "rule:admin or rule:reader" +"get_network:queue_id": "rule:admin or rule:reader" +"get_network_ip_availabilities": "rule:admin or rule:reader" +"get_network_ip_availability": "rule:admin or rule:reader" +"create_network:shared": "rule:admin" +"create_network:router:external": "rule:admin" +"create_network:is_default": "rule:admin" +"create_network:segments": "rule:admin" +"create_network:provider:network_type": "rule:admin" +"create_network:provider:physical_network": "rule:admin" +"create_network:provider:segmentation_id": "rule:admin" +"update_network": "rule:admin or rule:member" +"update_network:segments": "rule:admin" +"update_network:shared": "rule:admin" +"update_network:provider:network_type": "rule:admin" +"update_network:provider:physical_network": "rule:admin" +"update_network:provider:segmentation_id": "rule:admin" +"update_network:router:external": "rule:admin" +"delete_network": "rule:admin or rule:member" + +"create_segment": "rule:admin" +"get_segment": "rule:admin or rule:reader" +"update_segment": "rule:admin" +"delete_segment": "rule:admin" + +"network_device": "field:port:device_owner=~^network:" +"create_port": "rule:admin or rule:member" +"create_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:mac_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" +"create_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:binding:host_id": "rule:admin" +"create_port:binding:profile": "rule:admin" +"create_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"create_port:allowed_address_pairs": "rule:admin or rule:network_owner" +"get_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner or rule:reader" +"get_port:queue_id": "rule:admin or rule:reader" +"get_port:binding:vif_type": "rule:admin or rule:reader" +"get_port:binding:vif_details": "rule:admin or rule:reader" +"get_port:binding:host_id": "rule:admin or rule:reader" +"get_port:binding:profile": "rule:admin or rule:reader" +"update_port": "rule:admin or rule:member or rule:context_is_advsvc" +"update_port:device_owner": "not rule:network_device or rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:mac_address": "rule:admin or rule:context_is_advsvc" +"update_port:fixed_ips:ip_address": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:fixed_ips:subnet_id": "rule:context_is_advsvc or rule:admin or rule:network_owner or rule:shared" +"update_port:port_security_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:binding:host_id": "rule:admin" +"update_port:binding:profile": "rule:admin" +"update_port:mac_learning_enabled": "rule:context_is_advsvc or rule:admin or rule:network_owner" +"update_port:allowed_address_pairs": "rule:admin or rule:network_owner" +"update_port:data_plane_status": "rule:admin_or_data_plane_int" +"delete_port": "rule:context_is_advsvc or rule:admin or rule:member or rule:network_owner" + +"get_router:ha": "rule:admin or rule:reader" +"create_router": "rule:admin or rule:member" +"create_router:external_gateway_info:enable_snat": "rule:admin" +"create_router:distributed": "rule:admin" +"create_router:ha": "rule:admin" +"get_router": "rule:admin or rule:member or rule:reader" +"get_router:distributed": "rule:admin or rule:reader" +"update_router": "rule:admin or rule:member" +"update_router:external_gateway_info": "rule:admin or rule:member" +"update_router:external_gateway_info:network_id": "rule:admin or rule:member" +"update_router:external_gateway_info:enable_snat": "rule:admin" +"update_router:distributed": "rule:admin" +"update_router:ha": "rule:admin" +"delete_router": "rule:admin or rule:member" + +"add_router_interface": "rule:admin or rule:member" +"remove_router_interface": "rule:admin or rule:member" + +"create_router:external_gateway_info:external_fixed_ips": "rule:admin" +"update_router:external_gateway_info:external_fixed_ips": "rule:admin" + +"create_qos_queue": "rule:admin" +"get_qos_queue": "rule:admin or rule:reader" + +"update_agent": "rule:admin" +"delete_agent": "rule:admin" +"get_agent": "rule:admin or rule:reader" + +"create_dhcp-network": "rule:admin" +"delete_dhcp-network": "rule:admin" +"get_dhcp-networks": "rule:admin or rule:reader" +"create_l3-router": "rule:admin" +"delete_l3-router": "rule:admin" +"get_l3-routers": "rule:admin or rule:reader" +"get_dhcp-agents": "rule:admin or rule:reader" +"get_l3-agents": "rule:admin or rule:reader" +"get_loadbalancer-agent": "rule:admin or rule:reader" +"get_loadbalancer-pools": "rule:admin or rule:reader" +"get_agent-loadbalancers": "rule:admin or rule:reader" +"get_loadbalancer-hosting-agent": "rule:admin or rule:reader" + +"create_floatingip": "rule:admin or rule:member" +"create_floatingip:floating_ip_address": "rule:admin" +"update_floatingip": "rule:admin or rule:member" +"delete_floatingip": "rule:admin or rule:member" +"get_floatingip": "rule:admin or rule:member or rule:reader" + +"create_network_profile": "rule:admin" +"update_network_profile": "rule:admin" +"delete_network_profile": "rule:admin" +"get_network_profiles": "rule:admin or rule:member or rule:reader" +"get_network_profile": "rule:admin or rule:member or rule:reader" +"update_policy_profiles": "rule:admin" +"get_policy_profiles": "rule:admin or rule:member or rule:reader" +"get_policy_profile": "rule:admin or rule:member or rule:reader" + +"create_metering_label": "rule:admin" +"delete_metering_label": "rule:admin" +"get_metering_label": "rule:admin or rule:reader" + +"create_metering_label_rule": "rule:admin" +"delete_metering_label_rule": "rule:admin" +"get_metering_label_rule": "rule:admin or rule:reader" + +"get_service_provider": "rule:admin or rule:member or rule:reader" +"get_lsn": "rule:admin or rule:reader" +"create_lsn": "rule:admin" + +"create_flavor": "rule:admin" +"update_flavor": "rule:admin" +"delete_flavor": "rule:admin" +"get_flavors": "rule:admin or rule:member or rule:reader" +"get_flavor": "rule:admin or rule:member or rule:reader" +"create_service_profile": "rule:admin" +"update_service_profile": "rule:admin" +"delete_service_profile": "rule:admin" +"get_service_profiles": "rule:admin or rule:reader" +"get_service_profile": "rule:admin or rule:reader" + +"get_policy": "rule:admin or rule:member or rule:reader" +"create_policy": "rule:admin" +"update_policy": "rule:admin" +"delete_policy": "rule:admin" +"get_policy_bandwidth_limit_rule": "rule:admin or rule:member or rule:reader" +"create_policy_bandwidth_limit_rule": "rule:admin" +"delete_policy_bandwidth_limit_rule": "rule:admin" +"update_policy_bandwidth_limit_rule": "rule:admin" +"get_policy_dscp_marking_rule": "rule:admin or rule:member or rule:reader" +"create_policy_dscp_marking_rule": "rule:admin" +"delete_policy_dscp_marking_rule": "rule:admin" +"update_policy_dscp_marking_rule": "rule:admin" +"get_rule_type": "rule:admin or rule:member or rule:reader" +"get_policy_minimum_bandwidth_rule": "rule:admin or rule:member or rule:reader" +"create_policy_minimum_bandwidth_rule": "rule:admin" +"delete_policy_minimum_bandwidth_rule": "rule:admin" +"update_policy_minimum_bandwidth_rule": "rule:admin" + +"restrict_wildcard": "(not field:rbac_policy:target_tenant=*) or rule:admin" +"create_rbac_policy": "rule:admin or rule:member" +"create_rbac_policy:target_tenant": "rule:restrict_wildcard" +"update_rbac_policy": "rule:admin or rule:member" +"update_rbac_policy:target_tenant": "rule:restrict_wildcard and rule:admin or rule:member" +"get_rbac_policy": "rule:admin or rule:member or rule:reader" +"delete_rbac_policy": "rule:admin or rule:member" + +"create_flavor_service_profile": "rule:admin" +"delete_flavor_service_profile": "rule:admin" +"get_flavor_service_profile": "rule:admin or rule:member or rule:reader" +"get_auto_allocated_topology": "rule:admin or rule:member or rule:reader" + +"create_trunk": "rule:admin or rule:member" +"get_trunk": "rule:admin or rule:member or rule:reader" +"delete_trunk": "rule:admin or rule:member" +"get_subports": "rule:admin or rule:member or rule:reader" +"add_subports": "rule:admin or rule:member" +"remove_subports": "rule:admin or rule:member" + +"get_security_groups": "rule:admin or rule:member or rule:reader" +"get_security_group": "rule:admin or rule:member or rule:reader" +"create_security_group": "rule:admin or rule:member" +"update_security_group": "rule:admin or rule:member" +"delete_security_group": "rule:admin or rule:member" +"get_security_group_rules": "rule:admin or rule:member or rule:reader" +"get_security_group_rule": "rule:admin or rule:member or rule:reader" +"create_security_group_rule": "rule:admin or rule:member" +"delete_security_group_rule": "rule:admin or rule:member" + +"get_loggable_resources": "rule:admin or rule:reader" +"create_log": "rule:admin" +"update_log": "rule:admin" +"delete_log": "rule:admin" +"get_logs": "rule:admin or rule:reader" +"get_log": "rule:admin or rule:reader" diff --git a/services/nova/policy.yaml b/services/nova/policy.yaml new file mode 100644 index 0000000..d83de2f --- /dev/null +++ b/services/nova/policy.yaml @@ -0,0 +1,989 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# RULES: + +# Reset the state of a given server +# POST /servers/{server_id}/action (os-resetState) +"os_compute_api:os-admin-actions:reset_state": "rule:admin" + +# Inject network information into the server +# POST /servers/{server_id}/action (injectNetworkInfo) +"os_compute_api:os-admin-actions:inject_network_info": "rule:admin" + +# Reset networking on a server +# POST /servers/{server_id}/action (resetNetwork) +"os_compute_api:os-admin-actions:reset_network": "rule:admin" + +# Change the administrative password for a server +# POST /servers/{server_id}/action (changePassword) +"os_compute_api:os-admin-password": "rule:admin or rule:member" + +# Create, list, update, and delete guest agent builds +# +# This is XenAPI driver specific. +# It is used to force the upgrade of the XenAPI guest agent on +# instance boot. +# GET /os-agents +# POST /os-agents +# PUT /os-agents/{agent_build_id} +# DELETE /os-agents/{agent_build_id} +"os_compute_api:os-agents": "rule:admin" + +# Create or replace metadata for an aggregate +# POST /os-aggregates/{aggregate_id}/action (set_metadata) +"os_compute_api:os-aggregates:set_metadata": "rule:admin" + +# Add a host to an aggregate +# POST /os-aggregates/{aggregate_id}/action (add_host) +"os_compute_api:os-aggregates:add_host": "rule:admin" + +# Create an aggregate +# POST /os-aggregates +"os_compute_api:os-aggregates:create": "rule:admin" + +# Remove a host from an aggregate +# POST /os-aggregates/{aggregate_id}/action (remove_host) +"os_compute_api:os-aggregates:remove_host": "rule:admin" + +# Update name and/or availability zone for an aggregate +# PUT /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:update": "rule:admin" + +# List all aggregates +# GET /os-aggregates +"os_compute_api:os-aggregates:index": "rule:admin or rule:reader" + +# Delete an aggregate +# DELETE /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:delete": "rule:admin" + +# Show details for an aggregate +# GET /os-aggregates/{aggregate_id} +"os_compute_api:os-aggregates:show": "rule:admin or rule:reader" + +# Create an assisted volume snapshot +# POST /os-assisted-volume-snapshots +"os_compute_api:os-assisted-volume-snapshots:create": "rule:admin" + +# Delete an assisted volume snapshot +# DELETE /os-assisted-volume-snapshots/{snapshot_id} +"os_compute_api:os-assisted-volume-snapshots:delete": "rule:admin" + +# List port interfaces or show details of a port interface attached to +# a server +# GET /servers/{server_id}/os-interface +# GET /servers/{server_id}/os-interface/{port_id} +"os_compute_api:os-attach-interfaces": "rule:admin or rule:member or rule:reader" + +# Attach an interface to a server +# POST /servers/{server_id}/os-interface +"os_compute_api:os-attach-interfaces:create": "rule:admin or rule:member" + +# Detach an interface from a server +# DELETE /servers/{server_id}/os-interface/{port_id} +"os_compute_api:os-attach-interfaces:delete": "rule:admin or rule:member" + +# List availability zone information without host information +# GET /os-availability-zone +"os_compute_api:os-availability-zone:list": "rule:admin or rule:member or rule:reader" + +# List detailed availability zone information with host information +# GET /os-availability-zone/detail +"os_compute_api:os-availability-zone:detail": "rule:admin or rule:reader" + +# List and show details of bare metal nodes. +# +# These APIs are proxy calls to the Ironic service and are deprecated. +# GET /os-baremetal-nodes +# GET /os-baremetal-nodes/{node_id} +"os_compute_api:os-baremetal-nodes": "rule:admin or rule:reader" + +# Update an existing cell +# PUT /os-cells/{cell_id} +"os_compute_api:os-cells:update": "rule:admin" + +# Create a new cell +# POST /os-cells +"os_compute_api:os-cells:create": "rule:admin" + +# List and show detailed info for a given cell or all cells +# GET /os-cells +# GET /os-cells/detail +# GET /os-cells/info +# GET /os-cells/capacities +# GET /os-cells/{cell_id} +"os_compute_api:os-cells": "rule:admin or rule:reader" + +# Sync instances info in all cells +# POST /os-cells/sync_instances +"os_compute_api:os-cells:sync_instances": "rule:admin" + +# Remove a cell +# DELETE /os-cells/{cell_id} +"os_compute_api:os-cells:delete": "rule:admin" + +# Different cell filter to route a build away from a particular cell +# +# This policy is read by nova-scheduler process. +"cells_scheduler_filter:DifferentCellFilter": "rule:admin" + +# Target cell filter to route a build to a particular cell +# +# This policy is read by nova-scheduler process. +"cells_scheduler_filter:TargetCellFilter": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-config-drive" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-config-drive" policy which was +# added for extensions is not needed any more +# Add 'config_drive' attribute in the server response +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-config-drive": "rule:admin or rule:member" + +# Show console connection information for a given console +# authentication token +# GET /os-console-auth-tokens/{console_token} +"os_compute_api:os-console-auth-tokens": "rule:admin or rule:reader" + +# Show console output for a server +# POST /servers/{server_id}/action (os-getConsoleOutput) +"os_compute_api:os-console-output": "rule:admin or rule:member or rule:reader" + +# Create a console for a server instance +# POST /servers/{server_id}/consoles +"os_compute_api:os-consoles:create": "rule:admin or rule:member" + +# Show console details for a server instance +# GET /servers/{server_id}/consoles/{console_id} +"os_compute_api:os-consoles:show": "rule:admin or rule:member or rule:reader" + +# Delete a console for a server instance +# DELETE /servers/{server_id}/consoles/{console_id} +"os_compute_api:os-consoles:delete": "rule:admin or rule:member" + +# List all consoles for a server instance +# GET /servers/{server_id}/consoles +"os_compute_api:os-consoles:index": "rule:admin or rule:member or rule:reader" + +# Create a back up of a server +# POST /servers/{server_id}/action (createBackup) +"os_compute_api:os-create-backup": "rule:admin or rule:member" + +# Restore a soft deleted server or force delete a server before +# deferred cleanup +# POST /servers/{server_id}/action (restore) +# POST /servers/{server_id}/action (forceDelete) +"os_compute_api:os-deferred-delete": "rule:admin or rule:member" + +# Evacuate a server from a failed host to a new host +# POST /servers/{server_id}/action (evacuate) +"os_compute_api:os-evacuate": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-extended-availability-zone" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-availability-zone" +# policy which was added for extensions is not needed any more +# Add `OS-EXT-AZ:availability_zone` into the server response +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-availability-zone": "rule:admin or rule:member" + +# Return extended attributes for server. +# +# This rule will control the visibility for a set of servers +# attributes: +# +# - ``OS-EXT-SRV-ATTR:host`` +# - ``OS-EXT-SRV-ATTR:instance_name`` +# - ``OS-EXT-SRV-ATTR:reservation_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:launch_index`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:hostname`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:kernel_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:ramdisk_id`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:root_device_name`` (since microversion 2.3) +# - ``OS-EXT-SRV-ATTR:user_data`` (since microversion 2.3) +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-server-attributes": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-extended-status" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-status" policy which was +# added for extensions is not needed any more +# Return extended status in the response of server. +# +# This policy will control the visibility for a set of attributes: +# +# - ``OS-EXT-STS:task_state`` +# - ``OS-EXT-STS:vm_state`` +# - ``OS-EXT-STS:power_state`` +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-status": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-extended-volumes" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-extended-volumes" policy which +# was added for extensions is not needed any more +# Return 'os-extended-volumes:volumes_attached' in the response of +# server +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-extended-volumes": "rule:admin or rule:member or rule:reader" + +# List available extensions and show information for an extension by +# alias +# GET /extensions +# GET /extensions/{alias} +"os_compute_api:extensions": "rule:admin or rule:member or rule:reader" + +# Add flavor access to a tenant +# POST /flavors/{flavor_id}/action (addTenantAccess) +"os_compute_api:os-flavor-access:add_tenant_access": "rule:admin" + +# Remove flavor access from a tenant +# POST /flavors/{flavor_id}/action (removeTenantAccess) +"os_compute_api:os-flavor-access:remove_tenant_access": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-flavor-access" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-flavor-access" policy for POST, +# PUT, GET /flavors which was added for extensions is not needed any +# more. NOTE: This policy is deprecated only for POST /flavors, PUT +# /flavors, GET /flavors/{flavor_id} & GET /flavors/detail. This +# policy for other API operations is still valid and not deprecated +# List flavor access information +# +# Adds the os-flavor-access:is_public key into several flavor APIs. +# +# It also allows access to the full list of tenants that have access +# to a flavor via an os-flavor-access API. +# GET /flavors/{flavor_id}/os-flavor-access +# GET /flavors/detail +# GET /flavors/{flavor_id} +# POST /flavors +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-access": "rule:admin or rule:member" + +# Show an extra spec for a flavor +# GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:show": "rule:admin or rule:member or rule:reader" + +# Create extra specs for a flavor +# POST /flavors/{flavor_id}/os-extra_specs/ +"os_compute_api:os-flavor-extra-specs:create": "rule:admin" + +# Update an extra spec for a flavor +# PUT /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:update": "rule:admin" + +# Delete an extra spec for a flavor +# DELETE /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key} +"os_compute_api:os-flavor-extra-specs:delete": "rule:admin" + +# List extra specs for a flavor. Starting with microversion 2.47, the +# flavor used for a server is also returned in the response when +# showing server details, updating a server or rebuilding a server. +# Starting with microversion 2.61, extra specs may be returned in +# responses for the flavor resource. +# GET /flavors/{flavor_id}/os-extra_specs/ +# GET /servers/detail +# GET /servers/{server_id} +# PUT /servers/{server_id} +# POST /servers/{server_id}/action (rebuild) +# POST /flavors +# GET /flavors/detail +# GET /flavors/{flavor_id} +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-extra-specs:index": "rule:admin or rule:member" + +# Create and delete Flavors. Deprecated in Pike and will be removed in +# future release +# POST /flavors +# DELETE /flavors/{flavor_id} +"os_compute_api:os-flavor-manage": "rule:admin" + +# Create a flavor +# POST /flavors +"os_compute_api:os-flavor-manage:create": "rule:os_compute_api:os-flavor-manage" + +# Update a flavor +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-manage:update": "rule:admin" + +# Delete a flavor +# DELETE /flavors/{flavor_id} +"os_compute_api:os-flavor-manage:delete": "rule:os_compute_api:os-flavor-manage" + +# DEPRECATED +# "os_compute_api:os-flavor-rxtx" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-flavor-rxtx" policy which was +# added for extensions is not needed any more +# Add the rxtx_factor key into some Flavor APIs +# GET /flavors/detail +# GET /flavors/{flavor_id} +# POST /flavors +# PUT /flavors/{flavor_id} +"os_compute_api:os-flavor-rxtx": "rule:admin or rule:member" + +# Deprecated in Pike and will be removed in next release +"os_compute_api:flavors": "rule:admin or rule:member" + +# List floating IP pools. This API is deprecated. +# GET /os-floating-ip-pools +"os_compute_api:os-floating-ip-pools": "rule:admin or rule:member or rule:reader" + +# Manage a project's floating IPs. These APIs are all deprecated. +# POST /servers/{server_id}/action (addFloatingIp) +# POST /servers/{server_id}/action (removeFloatingIp) +# GET /os-floating-ips +# POST /os-floating-ips +# GET /os-floating-ips/{floating_ip_id} +# DELETE /os-floating-ips/{floating_ip_id} +"os_compute_api:os-floating-ips": "rule:admin or rule:member" + +# DEPRECATED +# "os_compute_api:os-hide-server-addresses" has been deprecated since 17.0.0. +# Capability of configuring the server states to hide the address has +# been deprecated for removal. Now this policy is not needed to +# control the server address +# Hide server's 'addresses' key in the server response. +# +# This set the 'addresses' key in the server response to an empty +# dictionary when the server is in a specific set of states as +# defined in CONF.api.hide_server_address_states. +# By default 'addresses' is hidden only when the server is in +# 'BUILDING' state. +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-hide-server-addresses": "rule:admin or rule:member" + +# List, show and manage physical hosts. +# +# These APIs are all deprecated in favor of os-hypervisors and os- +# services. +# GET /os-hosts +# GET /os-hosts/{host_name} +# PUT /os-hosts/{host_name} +# GET /os-hosts/{host_name}/reboot +# GET /os-hosts/{host_name}/shutdown +# GET /os-hosts/{host_name}/startup +"os_compute_api:os-hosts": "rule:admin" + +# Policy rule for hypervisor related APIs. +# +# This rule will be checked for the following APIs: +# +# List all hypervisors, list all hypervisors with details, show +# summary statistics for all hypervisors over all compute nodes, +# show details for a hypervisor, show the uptime of a hypervisor, +# search hypervisor by hypervisor_hostname pattern and list all +# servers on hypervisors that can match the provided +# hypervisor_hostname pattern. +# GET /os-hypervisors +# GET /os-hypervisors/details +# GET /os-hypervisors/statistics +# GET /os-hypervisors/{hypervisor_id} +# GET /os-hypervisors/{hypervisor_id}/uptime +# GET /os-hypervisors/{hypervisor_hostname_pattern}/search +# GET /os-hypervisors/{hypervisor_hostname_pattern}/servers +"os_compute_api:os-hypervisors": "rule:admin or rule:reader" + +# DEPRECATED +# "os_compute_api:image-size" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:image-size" policy which was added +# for extensions is not needed any more +# Add 'OS-EXT-IMG-SIZE:size' attribute in the image response. +# GET /images/{id} +# GET /images/detail +"os_compute_api:image-size": "rule:admin or rule:member or rule:reader" + +# Add events details in action details for a server. +# +# This check is performed only after the check +# os_compute_api:os-instance-actions passes. Beginning with +# Microversion 2.51, events details are always included; traceback +# information is provided per event if policy enforcement passes. +# Beginning with Microversion 2.62, each event includes a hashed +# host identifier and, if policy enforcement passes, the name of +# the host. +# GET /servers/{server_id}/os-instance-actions/{request_id} +"os_compute_api:os-instance-actions:events": "rule:admin or rule:reader" + +# List actions and show action details for a server. +# GET /servers/{server_id}/os-instance-actions +# GET /servers/{server_id}/os-instance-actions/{request_id} +"os_compute_api:os-instance-actions": "rule:admin or rule:member or rule:reader" + +# List all usage audits and that occurred before a specified time for +# all servers on all compute hosts where usage auditing is configured +# GET /os-instance_usage_audit_log +# GET /os-instance_usage_audit_log/{before_timestamp} +"os_compute_api:os-instance-usage-audit-log": "rule:admin or rule:reader" + +# Show IP addresses details for a network label of a server +# GET /servers/{server_id}/ips/{network_label} +"os_compute_api:ips:show": "rule:admin or rule:member or rule:reader" + +# List IP addresses that are assigned to a server +# GET /servers/{server_id}/ips +"os_compute_api:ips:index": "rule:admin or rule:member or rule:reader" + +# List all keypairs +# GET /os-keypairs +"os_compute_api:os-keypairs:index": "rule:admin or rule:owner" + +# Create a keypair +# POST /os-keypairs +"os_compute_api:os-keypairs:create": "rule:admin or rule:owner" + +# Delete a keypair +# DELETE /os-keypairs/{keypair_name} +"os_compute_api:os-keypairs:delete": "rule:admin or rule:owner" + +# Show details of a keypair +# GET /os-keypairs/{keypair_name} +"os_compute_api:os-keypairs:show": "rule:admin or rule:owner" + +# DEPRECATED +# "os_compute_api:os-keypairs" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-keypairs" policy which was added +# for extensions is not needed any more +# Return 'key_name' in the response of server. +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-keypairs": "rule:admin or rule:member" + +# Show rate and absolute limits for the project +# GET /limits +"os_compute_api:limits": "rule:admin or rule:member or rule:reader" + +# Lock a server +# POST /servers/{server_id}/action (lock) +"os_compute_api:os-lock-server:lock": "rule:admin or rule:member" + +# Unlock a server +# POST /servers/{server_id}/action (unlock) +"os_compute_api:os-lock-server:unlock": "rule:admin or rule:member" + +# Unlock a server, regardless who locked the server. +# +# This check is performed only after the check +# os_compute_api:os-lock-server:unlock passes +# POST /servers/{server_id}/action (unlock) +"os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin" + +# Cold migrate a server to a host +# POST /servers/{server_id}/action (migrate) +"os_compute_api:os-migrate-server:migrate": "rule:admin" + +# Live migrate a server to a new host without a reboot +# POST /servers/{server_id}/action (os-migrateLive) +"os_compute_api:os-migrate-server:migrate_live": "rule:admin" + +# List migrations +# GET /os-migrations +"os_compute_api:os-migrations:index": "rule:admin or rule:reader" + +# Add or remove a fixed IP address from a server. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# POST /servers/{server_id}/action (addFixedIp) +# POST /servers/{server_id}/action (removeFixedIp) +"os_compute_api:os-multinic": "rule:admin or rule:member" + +# Create and delete a network, add and disassociate a network +# from a project. +# +# These APIs are only available with nova-network which is deprecated. +# POST /os-networks +# POST /os-networks/add +# DELETE /os-networks/{network_id} +# POST /os-networks/{network_id}/action (disassociate) +"os_compute_api:os-networks": "rule:admin" + +# List networks for the project and show details for a network. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# GET /os-networks +# GET /os-networks/{network_id} +"os_compute_api:os-networks:view": "rule:admin or rule:member or rule:reader" + +# Associate or disassociate a network from a host or project. +# +# These APIs are only available with nova-network which is deprecated. +# POST /os-networks/{network_id}/action (disassociate_host) +# POST /os-networks/{network_id}/action (disassociate_project) +# POST /os-networks/{network_id}/action (associate_host) +"os_compute_api:os-networks-associate": "rule:admin" + +# Pause a server +# POST /servers/{server_id}/action (pause) +"os_compute_api:os-pause-server:pause": "rule:admin or rule:member" + +# Unpause a paused server +# POST /servers/{server_id}/action (unpause) +"os_compute_api:os-pause-server:unpause": "rule:admin or rule:member" + +# List quotas for specific quota classs +# GET /os-quota-class-sets/{quota_class} +"os_compute_api:os-quota-class-sets:show": "rule:admin or quota_class:%(quota_class)s or rule:reader" + +# Update quotas for specific quota class +# PUT /os-quota-class-sets/{quota_class} +"os_compute_api:os-quota-class-sets:update": "rule:admin" + +# Update the quotas +# PUT /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:update": "rule:admin" + +# List default quotas +# GET /os-quota-sets/{tenant_id}/defaults +"os_compute_api:os-quota-sets:defaults": "@" + +# Show a quota +# GET /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:show": "rule:admin or rule:member or rule:reader" + +# Revert quotas to defaults +# DELETE /os-quota-sets/{tenant_id} +"os_compute_api:os-quota-sets:delete": "rule:admin" + +# Show the detail of quota +# GET /os-quota-sets/{tenant_id}/detail +"os_compute_api:os-quota-sets:detail": "rule:admin or rule:member or rule:reader" + +# Generate a URL to access remove server console +# POST /servers/{server_id}/action (os-getRDPConsole) +# POST /servers/{server_id}/action (os-getSerialConsole) +# POST /servers/{server_id}/action (os-getSPICEConsole) +# POST /servers/{server_id}/action (os-getVNCConsole) +# POST /servers/{server_id}/remote-consoles +"os_compute_api:os-remote-consoles": "rule:admin or rule:member" + +# Rescue/unrescue a server +# POST /servers/{server_id}/action (rescue) +# POST /servers/{server_id}/action (unrescue) +"os_compute_api:os-rescue": "rule:admin or rule:member" + +# List, show information for, create, or delete default security +# group rules. +# +# These APIs are only available with nova-network which is now +# deprecated. +# GET /os-security-group-default-rules +# GET /os-security-group-default-rules/{security_group_default_rule_id} +# POST /os-security-group-default-rules +# DELETE /os-security-group-default-rules/{security_group_default_rule_id} +"os_compute_api:os-security-group-default-rules": "rule:admin" + +# DEPRECATED +# "os_compute_api:os-security-groups" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-security-groups" policy for POST, +# GET /servers which was added for extensions is not needed any more. +# NOTE: This policy is deprecated only for POST /servers, GET +# /servers/{server_id} & GET /servers/detail. This policy for other +# API operations is still valid and not deprecated +# List, show, add, or remove security groups. +# +# APIs which are directly related to security groups resource are +# deprecated: +# Lists, shows information for, creates, updates and deletes +# security groups. Creates and deletes security group rules. All these +# APIs are deprecated. +# +# APIs which are related to server resource are not deprecated: +# Lists Security Groups for a server. Add Security Group to a server +# and remove security group from a server. Expand security_groups in +# server representation +# GET /os-security-groups +# GET /os-security-groups/{security_group_id} +# POST /os-security-groups +# PUT /os-security-groups/{security_group_id} +# DELETE /os-security-groups/{security_group_id} +# GET /servers/{server_id}/os-security-groups +# POST /servers/{server_id}/action (addSecurityGroup) +# POST /servers/{server_id}/action (removeSecurityGroup) +# POST /servers +# GET /servers/{server_id} +# GET /servers/detail +"os_compute_api:os-security-groups": "rule:admin or rule:member" + +# Show the usage data for a server +# GET /servers/{server_id}/diagnostics +"os_compute_api:os-server-diagnostics": "rule:admin or rule:member or rule:reader" + +# Create one or more external events +# POST /os-server-external-events +"os_compute_api:os-server-external-events:create": "rule:admin" + +# Deprecated in Pike and will be removed in next release +"os_compute_api:os-server-groups": "rule:admin or rule:member" + +# Create a new server group +# POST /os-server-groups +"os_compute_api:os-server-groups:create": "rule:admin or rule:member" + +# Delete a server group +# DELETE /os-server-groups/{server_group_id} +"os_compute_api:os-server-groups:delete": "rule:admin or rule:member" + +# List all server groups +# GET /os-server-groups +"os_compute_api:os-server-groups:index": "rule:admin or rule:member or rule:reader" + +# Show details of a server group +# GET /os-server-groups/{server_group_id} +"os_compute_api:os-server-groups:show": "rule:admin or rule:member or rule:reader" + +# List all metadata of a server +# GET /servers/{server_id}/metadata +"os_compute_api:server-metadata:index": "rule:admin or rule:member or rule:reader" + +# Show metadata for a server +# GET /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:show": "rule:admin or rule:member or rule:reader" + +# Create metadata for a server +# POST /servers/{server_id}/metadata +"os_compute_api:server-metadata:create": "rule:admin or rule:member" + +# Replace metadata for a server +# PUT /servers/{server_id}/metadata +"os_compute_api:server-metadata:update_all": "rule:admin or rule:member" + +# Update metadata from a server +# PUT /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:update": "rule:admin or rule:member" + +# Delete metadata from a server +# DELETE /servers/{server_id}/metadata/{key} +"os_compute_api:server-metadata:delete": "rule:admin or rule:member" + +# Show and clear the encrypted administrative password of a server +# GET /servers/{server_id}/os-server-password +# DELETE /servers/{server_id}/os-server-password +"os_compute_api:os-server-password": "rule:admin or rule:member" + +# Delete all the server tags +# DELETE /servers/{server_id}/tags +"os_compute_api:os-server-tags:delete_all": "rule:admin or rule:member" + +# List all tags for given server +# GET /servers/{server_id}/tags +"os_compute_api:os-server-tags:index": "rule:admin or rule:member or rule:reader" + +# Replace all tags on specified server with the new set of tags. +# PUT /servers/{server_id}/tags +"os_compute_api:os-server-tags:update_all": "rule:admin or rule:member" + +# Delete a single tag from the specified server +# DELETE /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:delete": "rule:admin or rule:member" + +# Add a single tag to the server if server has no specified tag +# PUT /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:update": "rule:admin or rule:member" + +# Check tag existence on the server. +# GET /servers/{server_id}/tags/{tag} +"os_compute_api:os-server-tags:show": "rule:admin or rule:member or rule:reader" + +# DEPRECATED +# "os_compute_api:os-server-usage" has been deprecated since 17.0.0. +# Nova API extension concept has been removed in Pike. Those +# extensions have their own policies enforcement. As there is no +# extensions now, "os_compute_api:os-server-usage" policy which was +# added for extensions is not needed any more +# Add 'OS-SRV-USG:launched_at' & 'OS-SRV-USG:terminated_at' attribute +# in the server response. +# +# This check is performed only after the check +# 'os_compute_api:servers:show' for GET /servers/{id} and +# 'os_compute_api:servers:detail' for GET /servers/detail passes +# GET /servers/{id} +# GET /servers/detail +"os_compute_api:os-server-usage": "rule:admin or rule:member or rule:reader" + +# List all servers +# GET /servers +"os_compute_api:servers:index": "rule:admin or rule:member or rule:reader" + +# List all servers with detailed information +# GET /servers/detail +"os_compute_api:servers:detail": "rule:admin or rule:member or rule:reader" + +# List all servers for all projects +# GET /servers +"os_compute_api:servers:index:get_all_tenants": "rule:admin or rule:global_reader" + +# List all servers with detailed information for all projects +# GET /servers/detail +"os_compute_api:servers:detail:get_all_tenants": "rule:admin or rule:reader" + +# Show a server +# GET /servers/{server_id} +"os_compute_api:servers:show": "rule:admin or rule:member or rule:reader" + +# Show a server with additional host status information +# GET /servers/{server_id} +# GET /servers/detail +"os_compute_api:servers:show:host_status": "rule:admin or rule:reader" + +# Create a server +# POST /servers +"os_compute_api:servers:create": "rule:admin or rule:member" + +# Create a server on the specified host +# POST /servers +"os_compute_api:servers:create:forced_host": "rule:admin" + +# Create a server with the requested volume attached to it +# POST /servers +"os_compute_api:servers:create:attach_volume": "rule:admin or rule:member" + +# Create a server with the requested network attached to it +# POST /servers +"os_compute_api:servers:create:attach_network": "rule:admin or rule:member" + +# Create a server with trusted image certificate IDs +# POST /servers +"os_compute_api:servers:create:trusted_certs": "rule:admin or rule:member" + +# +# This rule controls the compute API validation behavior of creating a +# server +# with a flavor that has 0 disk, indicating the server should be +# volume-backed. +# +# For a flavor with disk=0, the root disk will be set to exactly the +# size of the +# image used to deploy the instance. However, in this case the +# filter_scheduler +# cannot select the compute host based on the virtual image size. +# Therefore, 0 +# should only be used for volume booted instances or for testing +# purposes. +# +# WARNING: It is a potential security exposure to enable this policy +# rule +# if users can upload their own images since repeated attempts to +# create a disk=0 flavor instance with a large image can exhaust +# the local disk of the compute (or shared storage cluster). See bug +# https://bugs.launchpad.net/nova/+bug/1739646 for details. +# +# This rule defaults to ``rule:admin or rule:member`` for backward +# compatibility but +# will be changed to default to ``rule:admin`` in a subsequent +# release. +# POST /servers +"os_compute_api:servers:create:zero_disk_flavor": "rule:admin or rule:member" + +# Attach an unshared external network to a server +# POST /servers +# POST /servers/{server_id}/os-interface +"network:attach_external_network": "rule:admin" + +# Delete a server +# DELETE /servers/{server_id} +"os_compute_api:servers:delete": "rule:admin or rule:member" + +# Update a server +# PUT /servers/{server_id} +"os_compute_api:servers:update": "rule:admin or rule:member" + +# Confirm a server resize +# POST /servers/{server_id}/action (confirmResize) +"os_compute_api:servers:confirm_resize": "rule:admin or rule:member" + +# Revert a server resize +# POST /servers/{server_id}/action (revertResize) +"os_compute_api:servers:revert_resize": "rule:admin or rule:member" + +# Reboot a server +# POST /servers/{server_id}/action (reboot) +"os_compute_api:servers:reboot": "rule:admin or rule:member" + +# Resize a server +# POST /servers/{server_id}/action (resize) +"os_compute_api:servers:resize": "rule:admin or rule:member" + +# Rebuild a server +# POST /servers/{server_id}/action (rebuild) +"os_compute_api:servers:rebuild": "rule:admin or rule:member" + +# Rebuild a server with trusted image certificate IDs +# POST /servers/{server_id}/action (rebuild) +"os_compute_api:servers:rebuild:trusted_certs": "rule:admin or rule:member" + +# Create an image from a server +# POST /servers/{server_id}/action (createImage) +"os_compute_api:servers:create_image": "rule:admin or rule:member" + +# Create an image from a volume backed server +# POST /servers/{server_id}/action (createImage) +"os_compute_api:servers:create_image:allow_volume_backed": "rule:admin or rule:member" + +# Start a server +# POST /servers/{server_id}/action (os-start) +"os_compute_api:servers:start": "rule:admin or rule:member" + +# Stop a server +# POST /servers/{server_id}/action (os-stop) +"os_compute_api:servers:stop": "rule:admin or rule:member" + +# Trigger crash dump in a server +# POST /servers/{server_id}/action (trigger_crash_dump) +"os_compute_api:servers:trigger_crash_dump": "rule:admin or rule:member" + +# Show details for an in-progress live migration for a given server +# GET /servers/{server_id}/migrations/{migration_id} +"os_compute_api:servers:migrations:show": "rule:admin or rule:reader" + +# Force an in-progress live migration for a given server to complete +# POST /servers/{server_id}/migrations/{migration_id}/action (force_complete) +"os_compute_api:servers:migrations:force_complete": "rule:admin" + +# Delete(Abort) an in-progress live migration +# DELETE /servers/{server_id}/migrations/{migration_id} +"os_compute_api:servers:migrations:delete": "rule:admin" + +# Lists in-progress live migrations for a given server +# GET /servers/{server_id}/migrations +"os_compute_api:servers:migrations:index": "rule:admin or rule:reader" + +# List all running Compute services in a region, enables or disable +# scheduling for a Compute service, logs disabled Compute service +# information, set or unset forced_down flag for the compute service +# and delete a Compute service +# GET /os-services +# PUT /os-services/enable +# PUT /os-services/disable +# PUT /os-services/disable-log-reason +# PUT /os-services/force-down +# PUT /os-services/{service_id} +# DELETE /os-services/{service_id} +"os_compute_api:os-services": "rule:admin" + +# Shelve server +# POST /servers/{server_id}/action (shelve) +"os_compute_api:os-shelve:shelve": "rule:admin or rule:member" + +# Unshelve (restore) shelved server +# POST /servers/{server_id}/action (unshelve) +"os_compute_api:os-shelve:unshelve": "rule:admin or rule:member" + +# Shelf-offload (remove) server +# POST /servers/{server_id}/action (shelveOffload) +"os_compute_api:os-shelve:shelve_offload": "rule:admin" + +# Show usage statistics for a specific tenant +# GET /os-simple-tenant-usage/{tenant_id} +"os_compute_api:os-simple-tenant-usage:show": "rule:admin or rule:member or rule:reader" + +# List per tenant usage statistics for all tenants +# GET /os-simple-tenant-usage +"os_compute_api:os-simple-tenant-usage:list": "rule:admin or rule:reader" + +# Resume suspended server +# POST /servers/{server_id}/action (resume) +"os_compute_api:os-suspend-server:resume": "rule:admin or rule:member" + +# Suspend server +# POST /servers/{server_id}/action (suspend) +"os_compute_api:os-suspend-server:suspend": "rule:admin or rule:member" + +# Create, list, show information for, and delete project networks. +# +# These APIs are proxy calls to the Network service. These are all +# deprecated. +# GET /os-tenant-networks +# POST /os-tenant-networks +# GET /os-tenant-networks/{network_id} +# DELETE /os-tenant-networks/{network_id} +"os_compute_api:os-tenant-networks": "rule:admin or rule:member" + +# Show rate and absolute limits for the project. +# +# This policy only checks if the user has access to the requested +# project limits. And this check is performed only after the check +# os_compute_api:limits passes +# GET /limits +"os_compute_api:os-used-limits": "rule:admin or rule:reader" + +# Manage volumes for use with the Compute API. +# +# Lists, shows details, creates, and deletes volumes and +# snapshots. These APIs are proxy calls to the Volume service. +# These are all deprecated. +# GET /os-volumes +# POST /os-volumes +# GET /os-volumes/detail +# GET /os-volumes/{volume_id} +# DELETE /os-volumes/{volume_id} +# GET /os-snapshots +# POST /os-snapshots +# GET /os-snapshots/detail +# GET /os-snapshots/{snapshot_id} +# DELETE /os-snapshots/{snapshot_id} +"os_compute_api:os-volumes": "rule:admin or rule:member" + +# List volume attachments for an instance +# GET /servers/{server_id}/os-volume_attachments +"os_compute_api:os-volumes-attachments:index": "rule:admin or rule:member or rule:reader" + +# Attach a volume to an instance +# POST /servers/{server_id}/os-volume_attachments +"os_compute_api:os-volumes-attachments:create": "rule:admin or rule:member" + +# Show details of a volume attachment +# GET /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:show": "rule:admin or rule:member or rule:reader" + +# Update a volume attachment +# PUT /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:update": "rule:admin" + +# Detach a volume from an instance +# DELETE /servers/{server_id}/os-volume_attachments/{attachment_id} +"os_compute_api:os-volumes-attachments:delete": "rule:admin or rule:member" diff --git a/services/panko/policy.yaml b/services/panko/policy.yaml new file mode 100644 index 0000000..73c4a89 --- /dev/null +++ b/services/panko/policy.yaml @@ -0,0 +1,41 @@ +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or rule:admin)" + +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + + +### Policy Rules defined in panko.policies.segregation + +# Return the user and project the requestshould be limited to +# GET /v2/events +# GET /v2/events/{message_id} +# +"segregation": "rule:admin or rule:member or rule:reader" + +### Policy Rules defined in panko.policies.telemetry + +# Return all events matching the query filters. +# GET /v2/events +# +"telemetry:events:index": "rule:admin or rule:member or rule:reader" + +# Return a single event with the given message id. +# GET /v2/events/{message_id} +# +"telemetry:events:show": "rule:admin or rule:member or rule:reader" From 1345f24dd24d41c7923da96f85b06b4aa825acfe Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 14/26] Testing functions and auth data --- diff --git a/tests/README b/tests/README new file mode 100644 index 0000000..a19bf2c --- /dev/null +++ b/tests/README @@ -0,0 +1,27 @@ +Simple Test Framework for policy. + +each of the auth_token\* subdirectories have an access.json file which +contain the auth_data comparable to a token validation. The +oslopolicy-checker program can verify a given policy file against the +auth-data. For example: + +$ oslopolicy-checker --policy ../build/etc/keystone/policy.yaml --access auth_token_admin/access.json --rule identity:list_roles +passed: identity:list_roles + +Running the tool without the --rules option checks the auth_data +against the entire set of rules. + +Each auth_token_* subdir has a set of origin files which are the +captured output of a previous, known good, run. + +Testing is performed by running the oslopolicy-checker and comparing +the output agains the origin files. The general development process +should look like this: + +.Edit the policy files in ../common or ../services +.run the build.sh script to regenerate the policy files in build/etc +.source the functions file in this directory. +.run the function run_policy_current to generate the output from the +checker. This will produce a set of *.current files in the +auth_token_* subdirs. +.run show_diff to compare the original files to the current. \ No newline at end of file diff --git a/tests/auth_token_admin/access.json b/tests/auth_token_admin/access.json new file mode 100644 index 0000000..fbd88c9 --- /dev/null +++ b/tests/auth_token_admin/access.json @@ -0,0 +1,136 @@ +{ + "token": { + "methods": [ + "password" + ], + "roles": [ + { + "id": "f03fda8f8a3249b2a70fb1f176a7b631", + "name": "admin" + } + ], + "issued_at": "2002-01-18T21:14:07Z", + "expires_at": "2038-01-18T21:14:07Z", + "audit_ids": ["VcxU2JYqT8OzfUVvrjEITQ", "qNUTIJntTzO1-XUk5STybw"], + "project": { + "id": "tenant_id1", + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "enabled": true, + "description": null, + "name": "tenant_name1" + }, + "catalog": [ + { + "endpoints": [ + { + "id": "3b5e554bcf114f2483e8a1be7a0506d1", + "interface": "admin", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "54abd2dc463c4ba4a72915498f8ecad1", + "interface": "internal", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "70a7efa4b1b941968357cc43ae1419ee", + "interface": "public", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "5707c3fc0a294703a3c638e9cf6a6c3a", + "type": "volume", + "name": "volume" + }, + { + "endpoints": [ + { + "id": "92217a3b95394492859bc49fd474382f", + "interface": "admin", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "f20563bdf66f4efa8a1f11d99b672be1", + "interface": "internal", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "375f9ba459a447738fb60fe5fc26e9aa", + "interface": "public", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + } + ], + "id": "15c21aae6b274a8da52e0a068e908aac", + "type": "image", + "name": "glance" + }, + { + "endpoints": [ + { + "id": "edbd9f50f66746ae9ed11dc3b1ae35da", + "interface": "admin", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "9e03c46c80a34a159cb39f5cb0498b92", + "interface": "internal", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "1df0b44d92634d59bd0e0d60cf7ce432", + "interface": "public", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "2f404fdb89154c589efbc10726b029ec", + "type": "compute", + "name": "nova" + }, + { + "endpoints": [ + { + "id": "a4501e141a4b4e14bf282e7bffd81dc5", + "interface": "admin", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "3d17e3227bfc4483b58de5eaa584e360", + "interface": "internal", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "8cd4b957090f4ca5842a22e9a74099cd", + "interface": "public", + "url": "http://127.0.0.1:5000/v3", + "region": "RegionOne" + } + ], + "id": "c5d926d566424e4fba4f80c37916cde5", + "type": "identity", + "name": "keystone" + } + ], + "user": { + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "name": "user_name1", + "id": "user_id1" + } + } +} diff --git a/tests/auth_token_member/access.json b/tests/auth_token_member/access.json new file mode 100644 index 0000000..e002fae --- /dev/null +++ b/tests/auth_token_member/access.json @@ -0,0 +1,136 @@ +{ + "token": { + "methods": [ + "password" + ], + "roles": [ + { + "id": "f03fda8f8a3249b2a70fb1f176a7b631", + "name": "Member" + } + ], + "issued_at": "2002-01-18T21:14:07Z", + "expires_at": "2038-01-18T21:14:07Z", + "audit_ids": ["VcxU2JYqT8OzfUVvrjEITQ", "qNUTIJntTzO1-XUk5STybw"], + "project": { + "id": "tenant_id1", + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "enabled": true, + "description": null, + "name": "tenant_name1" + }, + "catalog": [ + { + "endpoints": [ + { + "id": "3b5e554bcf114f2483e8a1be7a0506d1", + "interface": "admin", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "54abd2dc463c4ba4a72915498f8ecad1", + "interface": "internal", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "70a7efa4b1b941968357cc43ae1419ee", + "interface": "public", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "5707c3fc0a294703a3c638e9cf6a6c3a", + "type": "volume", + "name": "volume" + }, + { + "endpoints": [ + { + "id": "92217a3b95394492859bc49fd474382f", + "interface": "admin", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "f20563bdf66f4efa8a1f11d99b672be1", + "interface": "internal", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "375f9ba459a447738fb60fe5fc26e9aa", + "interface": "public", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + } + ], + "id": "15c21aae6b274a8da52e0a068e908aac", + "type": "image", + "name": "glance" + }, + { + "endpoints": [ + { + "id": "edbd9f50f66746ae9ed11dc3b1ae35da", + "interface": "admin", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "9e03c46c80a34a159cb39f5cb0498b92", + "interface": "internal", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "1df0b44d92634d59bd0e0d60cf7ce432", + "interface": "public", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "2f404fdb89154c589efbc10726b029ec", + "type": "compute", + "name": "nova" + }, + { + "endpoints": [ + { + "id": "a4501e141a4b4e14bf282e7bffd81dc5", + "interface": "admin", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "3d17e3227bfc4483b58de5eaa584e360", + "interface": "internal", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "8cd4b957090f4ca5842a22e9a74099cd", + "interface": "public", + "url": "http://127.0.0.1:5000/v3", + "region": "RegionOne" + } + ], + "id": "c5d926d566424e4fba4f80c37916cde5", + "type": "identity", + "name": "keystone" + } + ], + "user": { + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "name": "user_name1", + "id": "user_id1" + } + } +} diff --git a/tests/auth_token_reader/access.json b/tests/auth_token_reader/access.json new file mode 100644 index 0000000..920780b --- /dev/null +++ b/tests/auth_token_reader/access.json @@ -0,0 +1,136 @@ +{ + "token": { + "methods": [ + "password" + ], + "roles": [ + { + "id": "f03fda8f8a3249b2a70fb1f176a7b631", + "name": "Reader" + } + ], + "issued_at": "2002-01-18T21:14:07Z", + "expires_at": "2038-01-18T21:14:07Z", + "audit_ids": ["VcxU2JYqT8OzfUVvrjEITQ", "qNUTIJntTzO1-XUk5STybw"], + "project": { + "id": "tenant_id1", + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "enabled": true, + "description": null, + "name": "tenant_name1" + }, + "catalog": [ + { + "endpoints": [ + { + "id": "3b5e554bcf114f2483e8a1be7a0506d1", + "interface": "admin", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "54abd2dc463c4ba4a72915498f8ecad1", + "interface": "internal", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "70a7efa4b1b941968357cc43ae1419ee", + "interface": "public", + "url": "http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "5707c3fc0a294703a3c638e9cf6a6c3a", + "type": "volume", + "name": "volume" + }, + { + "endpoints": [ + { + "id": "92217a3b95394492859bc49fd474382f", + "interface": "admin", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "f20563bdf66f4efa8a1f11d99b672be1", + "interface": "internal", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + }, + { + "id": "375f9ba459a447738fb60fe5fc26e9aa", + "interface": "public", + "url": "http://127.0.0.1:9292/v1", + "region": "regionOne" + } + ], + "id": "15c21aae6b274a8da52e0a068e908aac", + "type": "image", + "name": "glance" + }, + { + "endpoints": [ + { + "id": "edbd9f50f66746ae9ed11dc3b1ae35da", + "interface": "admin", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "9e03c46c80a34a159cb39f5cb0498b92", + "interface": "internal", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + }, + { + "id": "1df0b44d92634d59bd0e0d60cf7ce432", + "interface": "public", + "url": "http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a", + "region": "regionOne" + } + ], + "id": "2f404fdb89154c589efbc10726b029ec", + "type": "compute", + "name": "nova" + }, + { + "endpoints": [ + { + "id": "a4501e141a4b4e14bf282e7bffd81dc5", + "interface": "admin", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "3d17e3227bfc4483b58de5eaa584e360", + "interface": "internal", + "url": "http://127.0.0.1:35357/v3", + "region": "RegionOne" + }, + { + "id": "8cd4b957090f4ca5842a22e9a74099cd", + "interface": "public", + "url": "http://127.0.0.1:5000/v3", + "region": "RegionOne" + } + ], + "id": "c5d926d566424e4fba4f80c37916cde5", + "type": "identity", + "name": "keystone" + } + ], + "user": { + "domain": { + "id": "domain_id1", + "name": "domain_name1" + }, + "name": "user_name1", + "id": "user_id1" + } + } +} diff --git a/tests/functions b/tests/functions new file mode 100755 index 0000000..1c6d589 --- /dev/null +++ b/tests/functions @@ -0,0 +1,39 @@ + + + + +update_policy_origin(){ + for ACCESS in $( list_tokens ) + do + for SERVICE in $( ls ../build/etc/ ) + do oslopolicy-checker --policy ../build/etc/$SERVICE/policy.yaml \ + --access $ACCESS/access.json | sort -k 2 \ + > $ACCESS/$SERVICE.origin ; + done + done +} + +run_policy_current(){ + for ACCESS in $( list_tokens ) + do + for SERVICE in $( ls ../build/etc/ ) + do oslopolicy-checker --policy ../build/etc/$SERVICE/policy.yaml \ + --access $ACCESS/access.json | sort -k 2\ + > $ACCESS/$SERVICE.current; + done + done +} + +show_diff(){ + for ACCESS in $( list_tokens ) + do + for SERVICE in $( ls ../build/etc/ ) + do + diff -ud $ACCESS/$SERVICE.origin $ACCESS/$SERVICE.current; + done + done +} + +list_tokens(){ +echo auth_token_admin auth_token_member auth_token_reader +} From f3b97b134a360e7e492ee685856ee9ec1bd301df Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 15/26] Origin files for testing --- diff --git a/tests/auth_token_admin/aodh.origin b/tests/auth_token_admin/aodh.origin new file mode 100644 index 0000000..b19791c --- /dev/null +++ b/tests/auth_token_admin/aodh.origin @@ -0,0 +1,10 @@ +passed: telemetry:alarm_history +passed: telemetry:change_alarm +passed: telemetry:change_alarm_state +passed: telemetry:create_alarm +passed: telemetry:delete_alarm +passed: telemetry:get_alarm +passed: telemetry:get_alarms +passed: telemetry:get_alarm_state +passed: telemetry:query_alarm +passed: telemetry:query_alarm_history diff --git a/tests/auth_token_admin/cinder.origin b/tests/auth_token_admin/cinder.origin new file mode 100644 index 0000000..f5d8fe2 --- /dev/null +++ b/tests/auth_token_admin/cinder.origin @@ -0,0 +1,134 @@ +passed: backup:backup-import +passed: backup:backup_project_attribute +passed: backup:create +passed: backup:delete +passed: backup:export-import +passed: backup:get +passed: backup:get_all +passed: backup:restore +passed: backup:update +passed: clusters:get +passed: clusters:get_all +passed: clusters:update +passed: group:access_group_types_specs +passed: group:create +passed: group:create_group_snapshot +passed: group:delete +passed: group:delete_group_snapshot +passed: group:disable_replication +passed: group:enable_replication +passed: group:failover_replication +passed: group:get +passed: group:get_all +passed: group:get_all_group_snapshots +passed: group:get_group_snapshot +passed: group:group_types_manage +passed: group:group_types_specs +passed: group:list_replication_targets +passed: group:reset_group_snapshot_status +passed: group:reset_status +passed: group:update +passed: group:update_group_snapshot +passed: limits_extension:used_limits +passed: message:delete +passed: message:get +passed: message:get_all +passed: scheduler_extension:scheduler_stats:get_pools +passed: snapshot_extension:list_manageable +passed: snapshot_extension:snapshot_actions:update_snapshot_status +passed: snapshot_extension:snapshot_manage +passed: snapshot_extension:snapshot_unmanage +passed: volume:accept_transfer +passed: volume:attachment_complete +passed: volume:attachment_create +passed: volume:attachment_delete +passed: volume:attachment_update +passed: volume:create +passed: volume:create_from_image +passed: volume:create_snapshot +passed: volume:create_transfer +passed: volume:create_volume_metadata +passed: volume:delete +passed: volume:delete_snapshot +passed: volume:delete_snapshot_metadata +passed: volume:delete_transfer +passed: volume:delete_volume_metadata +passed: volume:extend +passed: volume:extend_attached_volume +passed: volume_extension:access_types_extra_specs +passed: volume_extension:access_types_qos_specs_id +passed: volume_extension:backup_admin_actions:force_delete +passed: volume_extension:backup_admin_actions:reset_status +passed: volume_extension:capabilities +passed: volume_extension:extended_snapshot_attributes +passed: volume_extension:hosts +passed: volume_extension:list_manageable +passed: volume_extension:qos_specs_manage:create +passed: volume_extension:qos_specs_manage:delete +passed: volume_extension:qos_specs_manage:get +passed: volume_extension:qos_specs_manage:get_all +passed: volume_extension:qos_specs_manage:update +passed: volume_extension:quota_classes +passed: volume_extension:quota_classes:validate_setup_for_nested_quota_use +passed: volume_extension:quotas:delete +passed: volume_extension:quotas:show +passed: volume_extension:quotas:update +passed: volume_extension:services:index +passed: volume_extension:services:update +passed: volume_extension:snapshot_admin_actions:force_delete +passed: volume_extension:snapshot_admin_actions:reset_status +passed: volume_extension:types_extra_specs:create +passed: volume_extension:types_extra_specs:delete +passed: volume_extension:types_extra_specs:index +passed: volume_extension:types_extra_specs:show +passed: volume_extension:types_extra_specs:update +passed: volume_extension:types_manage +passed: volume_extension:volume_actions:attach +passed: volume_extension:volume_actions:begin_detaching +passed: volume_extension:volume_actions:detach +passed: volume_extension:volume_actions:initialize_connection +passed: volume_extension:volume_actions:reserve +passed: volume_extension:volume_actions:roll_detaching +passed: volume_extension:volume_actions:terminate_connection +passed: volume_extension:volume_actions:unreserve +passed: volume_extension:volume_actions:upload_image +passed: volume_extension:volume_actions:upload_public +passed: volume_extension:volume_admin_actions:force_delete +passed: volume_extension:volume_admin_actions:force_detach +passed: volume_extension:volume_admin_actions:migrate_volume +passed: volume_extension:volume_admin_actions:migrate_volume_completion +passed: volume_extension:volume_admin_actions:reset_status +passed: volume_extension:volume_encryption_metadata +passed: volume_extension:volume_host_attribute +passed: volume_extension:volume_image_metadata +passed: volume_extension:volume_manage +passed: volume_extension:volume_mig_status_attribute +passed: volume_extension:volume_tenant_attribute +passed: volume_extension:volume_type_access +passed: volume_extension:volume_type_access:addProjectAccess +passed: volume_extension:volume_type_access:removeProjectAccess +passed: volume_extension:volume_type_encryption +passed: volume_extension:volume_unmanage +passed: volume:failover_host +passed: volume:force_delete +passed: volume:freeze_host +passed: volume:get +passed: volume:get_all +passed: volume:get_all_snapshots +passed: volume:get_all_transfers +passed: volume:get_snapshot +passed: volume:get_snapshot_metadata +passed: volume:get_transfer +passed: volume:get_volume_metadata +passed: volume:multiattach +passed: volume:multiattach_bootable_volume +passed: volume:retype +passed: volume:revert_to_snapshot +passed: volume:thaw_host +passed: volume:update +passed: volume:update_readonly_flag +passed: volume:update_snapshot +passed: volume:update_snapshot_metadata +passed: volume:update_volume_admin_metadata +passed: volume:update_volume_metadata +passed: workers:cleanup diff --git a/tests/auth_token_admin/glance.origin b/tests/auth_token_admin/glance.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_admin/glance.origin diff --git a/tests/auth_token_admin/gnocchi.origin b/tests/auth_token_admin/gnocchi.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_admin/gnocchi.origin diff --git a/tests/auth_token_admin/heat.origin b/tests/auth_token_admin/heat.origin new file mode 100644 index 0000000..6df6366 --- /dev/null +++ b/tests/auth_token_admin/heat.origin @@ -0,0 +1,79 @@ +passed: actions:action +passed: build_info:build_info +passed: cloudformation:CancelUpdateStack +passed: cloudformation:CreateStack +passed: cloudformation:DeleteStack +passed: cloudformation:DescribeStackEvents +passed: cloudformation:DescribeStackResource +passed: cloudformation:DescribeStackResources +passed: cloudformation:DescribeStacks +passed: cloudformation:EstimateTemplateCost +passed: cloudformation:GetTemplate +passed: cloudformation:ListStackResources +passed: cloudformation:ListStacks +passed: cloudformation:UpdateStack +passed: cloudformation:ValidateTemplate +passed: events:index +passed: events:show +passed: resource:index +passed: resource:mark_unhealthy +passed: resource:metadata +passed: resource:show +passed: resource:signal +passed: resource_types:OS::Cinder::EncryptedVolumeType +passed: resource_types:OS::Cinder::QoSAssociation +passed: resource_types:OS::Cinder::QoSSpecs +passed: resource_types:OS::Cinder::Quota +passed: resource_types:OS::Cinder::VolumeType +passed: resource_types:OS::Keystone::* +passed: resource_types:OS::Manila::ShareType +passed: resource_types:OS::Neutron::ProviderNet +passed: resource_types:OS::Neutron::QoSBandwidthLimitRule +passed: resource_types:OS::Neutron::QoSPolicy +passed: resource_types:OS::Neutron::Quota +passed: resource_types:OS::Neutron::Segment +passed: resource_types:OS::Nova::Flavor +passed: resource_types:OS::Nova::HostAggregate +passed: resource_types:OS::Nova::Quota +passed: service:index +passed: software_configs:create +passed: software_configs:delete +failed: software_configs:global_index +passed: software_configs:index +passed: software_configs:show +passed: software_deployments:create +passed: software_deployments:delete +passed: software_deployments:index +passed: software_deployments:metadata +passed: software_deployments:show +passed: software_deployments:update +passed: stacks:abandon +passed: stacks:create +passed: stacks:delete +passed: stacks:delete_snapshot +passed: stacks:detail +passed: stacks:environment +passed: stacks:export +passed: stacks:files +passed: stacks:generate_template +failed: stacks:global_index +passed: stacks:index +passed: stacks:list_outputs +passed: stacks:list_resource_types +passed: stacks:list_snapshots +passed: stacks:list_template_functions +passed: stacks:list_template_versions +passed: stacks:lookup +passed: stacks:preview +passed: stacks:preview_update +passed: stacks:preview_update_patch +passed: stacks:resource_schema +passed: stacks:restore_snapshot +passed: stacks:show +passed: stacks:show_output +passed: stacks:show_snapshot +passed: stacks:snapshot +passed: stacks:template +passed: stacks:update +passed: stacks:update_patch +passed: stacks:validate_template diff --git a/tests/auth_token_admin/keystone.origin b/tests/auth_token_admin/keystone.origin new file mode 100644 index 0000000..7657e5e --- /dev/null +++ b/tests/auth_token_admin/keystone.origin @@ -0,0 +1,187 @@ +passed: identity:add_endpoint_group_to_project +passed: identity:add_endpoint_to_project +passed: identity:add_user_to_group +passed: identity:authorize_request_token +passed: identity:check_endpoint_in_project +passed: identity:check_grant +passed: identity:check_implied_role +passed: identity:check_policy_association_for_endpoint +passed: identity:check_policy_association_for_region_and_service +passed: identity:check_policy_association_for_service +passed: identity:check_system_grant_for_group +passed: identity:check_system_grant_for_user +passed: identity:check_token +passed: identity:check_user_in_group +passed: identity:create_application_credential +passed: identity:create_consumer +passed: identity:create_credential +passed: identity:create_domain +passed: identity:create_domain_config +passed: identity:create_domain_role +passed: identity:create_endpoint +passed: identity:create_endpoint_group +passed: identity:create_grant +passed: identity:create_group +passed: identity:create_identity_provider +passed: identity:create_implied_role +passed: identity:create_limits +passed: identity:create_mapping +passed: identity:create_policy +passed: identity:create_policy_association_for_endpoint +passed: identity:create_policy_association_for_region_and_service +passed: identity:create_policy_association_for_service +passed: identity:create_project +passed: identity:create_project_tag +passed: identity:create_protocol +passed: identity:create_region +passed: identity:create_registered_limits +passed: identity:create_role +passed: identity:create_service +passed: identity:create_service_provider +passed: identity:create_system_grant_for_group +passed: identity:create_system_grant_for_user +failed: identity:create_trust +passed: identity:create_user +passed: identity:delete_access_token +passed: identity:delete_application_credential +passed: identity:delete_consumer +passed: identity:delete_credential +passed: identity:delete_domain +passed: identity:delete_domain_config +passed: identity:delete_domain_role +passed: identity:delete_endpoint +passed: identity:delete_endpoint_group +passed: identity:delete_group +passed: identity:delete_identity_provider +passed: identity:delete_implied_role +passed: identity:delete_limit +passed: identity:delete_mapping +passed: identity:delete_policy +passed: identity:delete_policy_association_for_endpoint +passed: identity:delete_policy_association_for_region_and_service +passed: identity:delete_policy_association_for_service +passed: identity:delete_project +passed: identity:delete_project_tag +passed: identity:delete_project_tags +passed: identity:delete_protocol +passed: identity:delete_region +passed: identity:delete_registered_limit +passed: identity:delete_role +passed: identity:delete_service +passed: identity:delete_service_provider +passed: identity:delete_trust +passed: identity:delete_user +passed: identity:ec2_create_credential +passed: identity:ec2_delete_credential +passed: identity:ec2_get_credential +passed: identity:ec2_list_credentials +passed: identity:get_access_token +passed: identity:get_access_token_role +passed: identity:get_application_credential +passed: identity:get_auth_catalog +passed: identity:get_auth_domains +passed: identity:get_auth_projects +passed: identity:get_auth_system +passed: identity:get_consumer +passed: identity:get_credential +passed: identity:get_domain +passed: identity:get_domain_config +passed: identity:get_domain_config_default +passed: identity:get_domain_role +passed: identity:get_endpoint +passed: identity:get_endpoint_group +passed: identity:get_endpoint_group_in_project +passed: identity:get_group +passed: identity:get_identity_provider +passed: identity:get_implied_role +passed: identity:get_limit +passed: identity:get_limit_model +passed: identity:get_mapping +passed: identity:get_policy +passed: identity:get_policy_for_endpoint +passed: identity:get_project +passed: identity:get_project_tag +passed: identity:get_protocol +passed: identity:get_region +passed: identity:get_registered_limit +passed: identity:get_role +passed: identity:get_role_for_trust +passed: identity:get_security_compliance_domain_config +passed: identity:get_service +passed: identity:get_service_provider +passed: identity:get_trust +passed: identity:get_user +passed: identity:list_access_token_roles +passed: identity:list_access_tokens +passed: identity:list_application_credentials +passed: identity:list_consumers +passed: identity:list_credentials +passed: identity:list_domain_roles +passed: identity:list_domains +passed: identity:list_domains_for_user +passed: identity:list_endpoint_groups +passed: identity:list_endpoint_groups_for_project +passed: identity:list_endpoints +passed: identity:list_endpoints_associated_with_endpoint_group +passed: identity:list_endpoints_for_policy +passed: identity:list_endpoints_for_project +passed: identity:list_grants +passed: identity:list_groups +passed: identity:list_groups_for_user +passed: identity:list_identity_providers +passed: identity:list_implied_roles +passed: identity:list_limits +passed: identity:list_mappings +passed: identity:list_policies +passed: identity:list_projects +passed: identity:list_projects_associated_with_endpoint_group +passed: identity:list_projects_for_endpoint +passed: identity:list_projects_for_user +passed: identity:list_project_tags +passed: identity:list_protocols +passed: identity:list_regions +passed: identity:list_registered_limits +passed: identity:list_revoke_events +passed: identity:list_role_assignments +passed: identity:list_role_assignments_for_tree +passed: identity:list_role_inference_rules +passed: identity:list_roles +passed: identity:list_roles_for_trust +passed: identity:list_service_providers +passed: identity:list_services +passed: identity:list_system_grants_for_group +passed: identity:list_system_grants_for_user +passed: identity:list_trusts +passed: identity:list_user_projects +passed: identity:list_users +passed: identity:list_users_in_group +passed: identity:remove_endpoint_from_project +passed: identity:remove_endpoint_group_from_project +passed: identity:remove_user_from_group +passed: identity:revocation_list +passed: identity:revoke_grant +passed: identity:revoke_system_grant_for_group +passed: identity:revoke_system_grant_for_user +passed: identity:revoke_token +passed: identity:update_consumer +passed: identity:update_credential +passed: identity:update_domain +passed: identity:update_domain_config +passed: identity:update_domain_role +passed: identity:update_endpoint +passed: identity:update_endpoint_group +passed: identity:update_group +passed: identity:update_identity_provider +passed: identity:update_limit +passed: identity:update_mapping +passed: identity:update_policy +passed: identity:update_project +passed: identity:update_project_tags +passed: identity:update_protocol +passed: identity:update_region +passed: identity:update_registered_limit +passed: identity:update_role +passed: identity:update_service +passed: identity:update_service_provider +passed: identity:update_user +passed: identity:validate_token diff --git a/tests/auth_token_admin/manila.origin b/tests/auth_token_admin/manila.origin new file mode 100644 index 0000000..bab0000 --- /dev/null +++ b/tests/auth_token_admin/manila.origin @@ -0,0 +1,130 @@ +passed: availability_zone:index +passed: message:delete +passed: message:get +passed: message:get_all +passed: quota_class_set:show +passed: quota_class_set:update +passed: quota_set:delete +passed: quota_set:show +passed: quota_set:update +passed: scheduler_stats:pools:detail +passed: scheduler_stats:pools:index +passed: security_service:create +passed: security_service:delete +passed: security_service:detail +passed: security_service:get_all_security_services +passed: security_service:index +passed: security_service:show +passed: security_service:update +passed: service:index +passed: service:update +passed: share:access_get +passed: share:access_get_all +passed: share:allow_access +passed: share:create +passed: share:create_snapshot +passed: share:delete +passed: share:delete_share_metadata +passed: share:delete_snapshot +passed: share:deny_access +passed: share_export_location:index +passed: share_export_location:show +passed: share:extend +passed: share:force_delete +passed: share:get +passed: share:get_all +passed: share:get_share_metadata +passed: share_group:create +passed: share_group:delete +passed: share_group:force_delete +passed: share_group:get +passed: share_group:get_all +passed: share_group:reset_status +passed: share_group_snapshot:create +passed: share_group_snapshot:delete +passed: share_group_snapshot:force_delete +passed: share_group_snapshot:get +passed: share_group_snapshot:get_all +passed: share_group_snapshot:reset_status +passed: share_group_snapshot:update +passed: share_group_type:add_project_access +passed: share_group_type:create +passed: share_group_type:default +passed: share_group_type:delete +passed: share_group_type:index +passed: share_group_type:list_project_access +passed: share_group_type:remove_project_access +passed: share_group_type:show +passed: share_group_types_spec:create +passed: share_group_types_spec:delete +passed: share_group_types_spec:index +passed: share_group_types_spec:show +passed: share_group_types_spec:update +passed: share_group:update +passed: share:list_by_host +passed: share:list_by_share_server_id +passed: share:manage +passed: share:migration_cancel +passed: share:migration_complete +passed: share:migration_get_progress +passed: share:migration_start +passed: share_network:add_security_service +passed: share_network:create +passed: share_network:delete +passed: share_network:detail +passed: share_network:get_all_share_networks +passed: share_network:index +passed: share_network:remove_security_service +passed: share_network:show +passed: share_network:update +passed: share_replica:create +passed: share_replica:delete +passed: share_replica:force_delete +passed: share_replica:get_all +passed: share_replica:promote +passed: share_replica:reset_replica_state +passed: share_replica:reset_status +passed: share_replica:resync +passed: share_replica:show +passed: share:reset_status +passed: share:reset_task_state +passed: share:revert_to_snapshot +passed: share_server:delete +passed: share_server:details +passed: share_server:index +passed: share_server:show +passed: share:shrink +passed: share_snapshot:access_list +passed: share_snapshot:allow_access +passed: share_snapshot:deny_access +passed: share_snapshot_export_location:index +passed: share_snapshot_export_location:show +passed: share_snapshot:force_delete +passed: share_snapshot:get_all_snapshots +passed: share_snapshot:get_snapshot +passed: share_snapshot_instance:detail +passed: share_snapshot_instance_export_location:index +passed: share_snapshot_instance_export_location:show +passed: share_snapshot_instance:index +passed: share_snapshot_instance:reset_status +passed: share_snapshot_instance:show +passed: share_snapshot:manage_snapshot +passed: share_snapshot:reset_status +passed: share_snapshot:unmanage_snapshot +passed: share:snapshot_update +passed: share_type:add_project_access +passed: share_type:create +passed: share_type:default +passed: share_type:delete +passed: share_type:index +passed: share_type:list_project_access +passed: share_type:remove_project_access +passed: share_types_extra_spec:create +passed: share_types_extra_spec:delete +passed: share_types_extra_spec:index +passed: share_types_extra_spec:show +passed: share_types_extra_spec:update +passed: share_type:show +passed: share:unmanage +passed: share:update +passed: share:update_share_metadata diff --git a/tests/auth_token_admin/neutron.origin b/tests/auth_token_admin/neutron.origin new file mode 100644 index 0000000..f564f11 --- /dev/null +++ b/tests/auth_token_admin/neutron.origin @@ -0,0 +1,67 @@ +passed: create_address_scope:shared +passed: create_floatingip:floating_ip_address +passed: create_network:is_default +passed: create_network:provider:network_type +passed: create_network:provider:physical_network +passed: create_network:provider:segmentation_id +passed: create_network:router:external +passed: create_network:segments +passed: create_network:shared +passed: create_port:allowed_address_pairs +passed: create_port:binding:host_id +passed: create_port:binding:profile +passed: create_port:device_owner +passed: create_port:fixed_ips:ip_address +passed: create_port:fixed_ips:subnet_id +passed: create_port:mac_address +passed: create_port:mac_learning_enabled +passed: create_port:port_security_enabled +passed: create_rbac_policy:target_tenant +passed: create_router:distributed +passed: create_router:external_gateway_info:enable_snat +passed: create_router:external_gateway_info:external_fixed_ips +passed: create_router:ha +passed: create_subnetpool:is_default +passed: create_subnetpool:shared +passed: create_subnet:segment_id +passed: create_subnet:service_types +passed: get_network:provider:network_type +passed: get_network:provider:physical_network +passed: get_network:provider:segmentation_id +passed: get_network:queue_id +passed: get_network:router:external +passed: get_network:segments +passed: get_port:binding:host_id +passed: get_port:binding:profile +passed: get_port:binding:vif_details +passed: get_port:binding:vif_type +passed: get_port:queue_id +passed: get_router:distributed +passed: get_router:ha +passed: get_subnet:segment_id +passed: update_address_scope:shared +passed: update_network:provider:network_type +passed: update_network:provider:physical_network +passed: update_network:provider:segmentation_id +passed: update_network:router:external +passed: update_network:segments +passed: update_network:shared +passed: update_port:allowed_address_pairs +passed: update_port:binding:host_id +passed: update_port:binding:profile +passed: update_port:data_plane_status +passed: update_port:device_owner +passed: update_port:fixed_ips:ip_address +passed: update_port:fixed_ips:subnet_id +passed: update_port:mac_address +passed: update_port:mac_learning_enabled +passed: update_port:port_security_enabled +passed: update_rbac_policy:target_tenant +passed: update_router:distributed +passed: update_router:external_gateway_info +passed: update_router:external_gateway_info:enable_snat +passed: update_router:external_gateway_info:external_fixed_ips +passed: update_router:external_gateway_info:network_id +passed: update_router:ha +passed: update_subnetpool:is_default +passed: update_subnet:service_types diff --git a/tests/auth_token_admin/nova.origin b/tests/auth_token_admin/nova.origin new file mode 100644 index 0000000..e1b0da4 --- /dev/null +++ b/tests/auth_token_admin/nova.origin @@ -0,0 +1,164 @@ +passed: cells_scheduler_filter:DifferentCellFilter +passed: cells_scheduler_filter:TargetCellFilter +passed: network:attach_external_network +passed: os_compute_api:extensions +passed: os_compute_api:flavors +passed: os_compute_api:image-size +passed: os_compute_api:ips:index +passed: os_compute_api:ips:show +passed: os_compute_api:limits +passed: os_compute_api:os-admin-actions:inject_network_info +passed: os_compute_api:os-admin-actions:reset_network +passed: os_compute_api:os-admin-actions:reset_state +passed: os_compute_api:os-admin-password +passed: os_compute_api:os-agents +passed: os_compute_api:os-aggregates:add_host +passed: os_compute_api:os-aggregates:create +passed: os_compute_api:os-aggregates:delete +passed: os_compute_api:os-aggregates:index +passed: os_compute_api:os-aggregates:remove_host +passed: os_compute_api:os-aggregates:set_metadata +passed: os_compute_api:os-aggregates:show +passed: os_compute_api:os-aggregates:update +passed: os_compute_api:os-assisted-volume-snapshots:create +passed: os_compute_api:os-assisted-volume-snapshots:delete +passed: os_compute_api:os-attach-interfaces +passed: os_compute_api:os-attach-interfaces:create +passed: os_compute_api:os-attach-interfaces:delete +passed: os_compute_api:os-availability-zone:detail +passed: os_compute_api:os-availability-zone:list +passed: os_compute_api:os-baremetal-nodes +passed: os_compute_api:os-cells +passed: os_compute_api:os-cells:create +passed: os_compute_api:os-cells:delete +passed: os_compute_api:os-cells:sync_instances +passed: os_compute_api:os-cells:update +passed: os_compute_api:os-config-drive +passed: os_compute_api:os-console-auth-tokens +passed: os_compute_api:os-console-output +passed: os_compute_api:os-consoles:create +passed: os_compute_api:os-consoles:delete +passed: os_compute_api:os-consoles:index +passed: os_compute_api:os-consoles:show +passed: os_compute_api:os-create-backup +passed: os_compute_api:os-deferred-delete +passed: os_compute_api:os-evacuate +passed: os_compute_api:os-extended-availability-zone +passed: os_compute_api:os-extended-server-attributes +passed: os_compute_api:os-extended-status +passed: os_compute_api:os-extended-volumes +passed: os_compute_api:os-flavor-access +passed: os_compute_api:os-flavor-access:add_tenant_access +passed: os_compute_api:os-flavor-access:remove_tenant_access +passed: os_compute_api:os-flavor-extra-specs:create +passed: os_compute_api:os-flavor-extra-specs:delete +passed: os_compute_api:os-flavor-extra-specs:index +passed: os_compute_api:os-flavor-extra-specs:show +passed: os_compute_api:os-flavor-extra-specs:update +passed: os_compute_api:os-flavor-manage +passed: os_compute_api:os-flavor-manage:create +passed: os_compute_api:os-flavor-manage:delete +passed: os_compute_api:os-flavor-manage:update +passed: os_compute_api:os-flavor-rxtx +passed: os_compute_api:os-floating-ip-pools +passed: os_compute_api:os-floating-ips +passed: os_compute_api:os-hide-server-addresses +passed: os_compute_api:os-hosts +passed: os_compute_api:os-hypervisors +passed: os_compute_api:os-instance-actions +passed: os_compute_api:os-instance-actions:events +passed: os_compute_api:os-instance-usage-audit-log +passed: os_compute_api:os-keypairs +passed: os_compute_api:os-keypairs:create +passed: os_compute_api:os-keypairs:delete +passed: os_compute_api:os-keypairs:index +passed: os_compute_api:os-keypairs:show +passed: os_compute_api:os-lock-server:lock +passed: os_compute_api:os-lock-server:unlock +passed: os_compute_api:os-lock-server:unlock:unlock_override +passed: os_compute_api:os-migrate-server:migrate +passed: os_compute_api:os-migrate-server:migrate_live +passed: os_compute_api:os-migrations:index +passed: os_compute_api:os-multinic +passed: os_compute_api:os-networks +passed: os_compute_api:os-networks-associate +passed: os_compute_api:os-networks:view +passed: os_compute_api:os-pause-server:pause +passed: os_compute_api:os-pause-server:unpause +passed: os_compute_api:os-quota-class-sets:show +passed: os_compute_api:os-quota-class-sets:update +passed: os_compute_api:os-quota-sets:defaults +passed: os_compute_api:os-quota-sets:delete +passed: os_compute_api:os-quota-sets:detail +passed: os_compute_api:os-quota-sets:show +passed: os_compute_api:os-quota-sets:update +passed: os_compute_api:os-remote-consoles +passed: os_compute_api:os-rescue +passed: os_compute_api:os-security-group-default-rules +passed: os_compute_api:os-security-groups +passed: os_compute_api:os-server-diagnostics +passed: os_compute_api:os-server-external-events:create +passed: os_compute_api:os-server-groups +passed: os_compute_api:os-server-groups:create +passed: os_compute_api:os-server-groups:delete +passed: os_compute_api:os-server-groups:index +passed: os_compute_api:os-server-groups:show +passed: os_compute_api:os-server-password +passed: os_compute_api:os-server-tags:delete +passed: os_compute_api:os-server-tags:delete_all +passed: os_compute_api:os-server-tags:index +passed: os_compute_api:os-server-tags:show +passed: os_compute_api:os-server-tags:update +passed: os_compute_api:os-server-tags:update_all +passed: os_compute_api:os-server-usage +passed: os_compute_api:os-services +passed: os_compute_api:os-shelve:shelve +passed: os_compute_api:os-shelve:shelve_offload +passed: os_compute_api:os-shelve:unshelve +passed: os_compute_api:os-simple-tenant-usage:list +passed: os_compute_api:os-simple-tenant-usage:show +passed: os_compute_api:os-suspend-server:resume +passed: os_compute_api:os-suspend-server:suspend +passed: os_compute_api:os-tenant-networks +passed: os_compute_api:os-used-limits +passed: os_compute_api:os-volumes +passed: os_compute_api:os-volumes-attachments:create +passed: os_compute_api:os-volumes-attachments:delete +passed: os_compute_api:os-volumes-attachments:index +passed: os_compute_api:os-volumes-attachments:show +passed: os_compute_api:os-volumes-attachments:update +passed: os_compute_api:server-metadata:create +passed: os_compute_api:server-metadata:delete +passed: os_compute_api:server-metadata:index +passed: os_compute_api:server-metadata:show +passed: os_compute_api:server-metadata:update +passed: os_compute_api:server-metadata:update_all +passed: os_compute_api:servers:confirm_resize +passed: os_compute_api:servers:create +passed: os_compute_api:servers:create:attach_network +passed: os_compute_api:servers:create:attach_volume +passed: os_compute_api:servers:create:forced_host +passed: os_compute_api:servers:create_image +passed: os_compute_api:servers:create_image:allow_volume_backed +passed: os_compute_api:servers:create:trusted_certs +passed: os_compute_api:servers:create:zero_disk_flavor +passed: os_compute_api:servers:delete +passed: os_compute_api:servers:detail +passed: os_compute_api:servers:detail:get_all_tenants +passed: os_compute_api:servers:index +passed: os_compute_api:servers:index:get_all_tenants +passed: os_compute_api:servers:migrations:delete +passed: os_compute_api:servers:migrations:force_complete +passed: os_compute_api:servers:migrations:index +passed: os_compute_api:servers:migrations:show +passed: os_compute_api:servers:reboot +passed: os_compute_api:servers:rebuild +passed: os_compute_api:servers:rebuild:trusted_certs +passed: os_compute_api:servers:resize +passed: os_compute_api:servers:revert_resize +passed: os_compute_api:servers:show +passed: os_compute_api:servers:show:host_status +passed: os_compute_api:servers:start +passed: os_compute_api:servers:stop +passed: os_compute_api:servers:trigger_crash_dump +passed: os_compute_api:servers:update diff --git a/tests/auth_token_admin/panko.origin b/tests/auth_token_admin/panko.origin new file mode 100644 index 0000000..377b7c9 --- /dev/null +++ b/tests/auth_token_admin/panko.origin @@ -0,0 +1,2 @@ +passed: telemetry:events:index +passed: telemetry:events:show diff --git a/tests/auth_token_member/aodh.origin b/tests/auth_token_member/aodh.origin new file mode 100644 index 0000000..b19791c --- /dev/null +++ b/tests/auth_token_member/aodh.origin @@ -0,0 +1,10 @@ +passed: telemetry:alarm_history +passed: telemetry:change_alarm +passed: telemetry:change_alarm_state +passed: telemetry:create_alarm +passed: telemetry:delete_alarm +passed: telemetry:get_alarm +passed: telemetry:get_alarms +passed: telemetry:get_alarm_state +passed: telemetry:query_alarm +passed: telemetry:query_alarm_history diff --git a/tests/auth_token_member/cinder.origin b/tests/auth_token_member/cinder.origin new file mode 100644 index 0000000..70d187f --- /dev/null +++ b/tests/auth_token_member/cinder.origin @@ -0,0 +1,134 @@ +failed: backup:backup-import +failed: backup:backup_project_attribute +passed: backup:create +passed: backup:delete +failed: backup:export-import +passed: backup:get +passed: backup:get_all +passed: backup:restore +passed: backup:update +failed: clusters:get +failed: clusters:get_all +failed: clusters:update +failed: group:access_group_types_specs +passed: group:create +passed: group:create_group_snapshot +passed: group:delete +passed: group:delete_group_snapshot +passed: group:disable_replication +passed: group:enable_replication +passed: group:failover_replication +passed: group:get +passed: group:get_all +passed: group:get_all_group_snapshots +passed: group:get_group_snapshot +failed: group:group_types_manage +failed: group:group_types_specs +passed: group:list_replication_targets +passed: group:reset_group_snapshot_status +failed: group:reset_status +passed: group:update +passed: group:update_group_snapshot +passed: limits_extension:used_limits +passed: message:delete +passed: message:get +passed: message:get_all +failed: scheduler_extension:scheduler_stats:get_pools +failed: snapshot_extension:list_manageable +passed: snapshot_extension:snapshot_actions:update_snapshot_status +failed: snapshot_extension:snapshot_manage +failed: snapshot_extension:snapshot_unmanage +passed: volume:accept_transfer +passed: volume:attachment_complete +passed: volume:attachment_create +passed: volume:attachment_delete +passed: volume:attachment_update +passed: volume:create +passed: volume:create_from_image +passed: volume:create_snapshot +passed: volume:create_transfer +passed: volume:create_volume_metadata +passed: volume:delete +passed: volume:delete_snapshot +passed: volume:delete_snapshot_metadata +passed: volume:delete_transfer +passed: volume:delete_volume_metadata +passed: volume:extend +passed: volume:extend_attached_volume +failed: volume_extension:access_types_extra_specs +failed: volume_extension:access_types_qos_specs_id +failed: volume_extension:backup_admin_actions:force_delete +failed: volume_extension:backup_admin_actions:reset_status +failed: volume_extension:capabilities +passed: volume_extension:extended_snapshot_attributes +failed: volume_extension:hosts +failed: volume_extension:list_manageable +failed: volume_extension:qos_specs_manage:create +failed: volume_extension:qos_specs_manage:delete +failed: volume_extension:qos_specs_manage:get +failed: volume_extension:qos_specs_manage:get_all +failed: volume_extension:qos_specs_manage:update +failed: volume_extension:quota_classes +failed: volume_extension:quota_classes:validate_setup_for_nested_quota_use +failed: volume_extension:quotas:delete +passed: volume_extension:quotas:show +failed: volume_extension:quotas:update +failed: volume_extension:services:index +failed: volume_extension:services:update +failed: volume_extension:snapshot_admin_actions:force_delete +failed: volume_extension:snapshot_admin_actions:reset_status +failed: volume_extension:types_extra_specs:create +failed: volume_extension:types_extra_specs:delete +failed: volume_extension:types_extra_specs:index +failed: volume_extension:types_extra_specs:show +failed: volume_extension:types_extra_specs:update +failed: volume_extension:types_manage +passed: volume_extension:volume_actions:attach +passed: volume_extension:volume_actions:begin_detaching +passed: volume_extension:volume_actions:detach +passed: volume_extension:volume_actions:initialize_connection +passed: volume_extension:volume_actions:reserve +passed: volume_extension:volume_actions:roll_detaching +passed: volume_extension:volume_actions:terminate_connection +passed: volume_extension:volume_actions:unreserve +passed: volume_extension:volume_actions:upload_image +failed: volume_extension:volume_actions:upload_public +failed: volume_extension:volume_admin_actions:force_delete +failed: volume_extension:volume_admin_actions:force_detach +failed: volume_extension:volume_admin_actions:migrate_volume +failed: volume_extension:volume_admin_actions:migrate_volume_completion +failed: volume_extension:volume_admin_actions:reset_status +passed: volume_extension:volume_encryption_metadata +failed: volume_extension:volume_host_attribute +passed: volume_extension:volume_image_metadata +failed: volume_extension:volume_manage +failed: volume_extension:volume_mig_status_attribute +passed: volume_extension:volume_tenant_attribute +passed: volume_extension:volume_type_access +failed: volume_extension:volume_type_access:addProjectAccess +failed: volume_extension:volume_type_access:removeProjectAccess +failed: volume_extension:volume_type_encryption +failed: volume_extension:volume_unmanage +failed: volume:failover_host +failed: volume:force_delete +failed: volume:freeze_host +passed: volume:get +passed: volume:get_all +passed: volume:get_all_snapshots +passed: volume:get_all_transfers +passed: volume:get_snapshot +passed: volume:get_snapshot_metadata +passed: volume:get_transfer +passed: volume:get_volume_metadata +passed: volume:multiattach +passed: volume:multiattach_bootable_volume +passed: volume:retype +passed: volume:revert_to_snapshot +failed: volume:thaw_host +passed: volume:update +passed: volume:update_readonly_flag +passed: volume:update_snapshot +passed: volume:update_snapshot_metadata +failed: volume:update_volume_admin_metadata +passed: volume:update_volume_metadata +failed: workers:cleanup diff --git a/tests/auth_token_member/glance.origin b/tests/auth_token_member/glance.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_member/glance.origin diff --git a/tests/auth_token_member/gnocchi.origin b/tests/auth_token_member/gnocchi.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_member/gnocchi.origin diff --git a/tests/auth_token_member/heat.origin b/tests/auth_token_member/heat.origin new file mode 100644 index 0000000..586d310 --- /dev/null +++ b/tests/auth_token_member/heat.origin @@ -0,0 +1,79 @@ +passed: actions:action +passed: build_info:build_info +passed: cloudformation:CancelUpdateStack +passed: cloudformation:CreateStack +passed: cloudformation:DeleteStack +passed: cloudformation:DescribeStackEvents +passed: cloudformation:DescribeStackResource +passed: cloudformation:DescribeStackResources +passed: cloudformation:DescribeStacks +passed: cloudformation:EstimateTemplateCost +passed: cloudformation:GetTemplate +passed: cloudformation:ListStackResources +passed: cloudformation:ListStacks +passed: cloudformation:UpdateStack +passed: cloudformation:ValidateTemplate +passed: events:index +passed: events:show +passed: resource:index +passed: resource:mark_unhealthy +passed: resource:metadata +passed: resource:show +passed: resource:signal +failed: resource_types:OS::Cinder::EncryptedVolumeType +failed: resource_types:OS::Cinder::QoSAssociation +failed: resource_types:OS::Cinder::QoSSpecs +failed: resource_types:OS::Cinder::Quota +failed: resource_types:OS::Cinder::VolumeType +failed: resource_types:OS::Keystone::* +failed: resource_types:OS::Manila::ShareType +failed: resource_types:OS::Neutron::ProviderNet +failed: resource_types:OS::Neutron::QoSBandwidthLimitRule +failed: resource_types:OS::Neutron::QoSPolicy +failed: resource_types:OS::Neutron::Quota +failed: resource_types:OS::Neutron::Segment +failed: resource_types:OS::Nova::Flavor +failed: resource_types:OS::Nova::HostAggregate +failed: resource_types:OS::Nova::Quota +failed: service:index +passed: software_configs:create +passed: software_configs:delete +failed: software_configs:global_index +passed: software_configs:index +passed: software_configs:show +passed: software_deployments:create +passed: software_deployments:delete +passed: software_deployments:index +passed: software_deployments:metadata +passed: software_deployments:show +passed: software_deployments:update +passed: stacks:abandon +passed: stacks:create +passed: stacks:delete +passed: stacks:delete_snapshot +passed: stacks:detail +passed: stacks:environment +passed: stacks:export +passed: stacks:files +passed: stacks:generate_template +failed: stacks:global_index +passed: stacks:index +passed: stacks:list_outputs +passed: stacks:list_resource_types +passed: stacks:list_snapshots +passed: stacks:list_template_functions +passed: stacks:list_template_versions +passed: stacks:lookup +passed: stacks:preview +passed: stacks:preview_update +passed: stacks:preview_update_patch +passed: stacks:resource_schema +passed: stacks:restore_snapshot +passed: stacks:show +passed: stacks:show_output +passed: stacks:show_snapshot +passed: stacks:snapshot +passed: stacks:template +passed: stacks:update +passed: stacks:update_patch +passed: stacks:validate_template diff --git a/tests/auth_token_member/keystone.origin b/tests/auth_token_member/keystone.origin new file mode 100644 index 0000000..9e68398 --- /dev/null +++ b/tests/auth_token_member/keystone.origin @@ -0,0 +1,187 @@ +failed: identity:add_endpoint_group_to_project +failed: identity:add_endpoint_to_project +failed: identity:add_user_to_group +failed: identity:authorize_request_token +failed: identity:check_endpoint_in_project +failed: identity:check_grant +failed: identity:check_implied_role +failed: identity:check_policy_association_for_endpoint +failed: identity:check_policy_association_for_region_and_service +failed: identity:check_policy_association_for_service +failed: identity:check_system_grant_for_group +failed: identity:check_system_grant_for_user +failed: identity:check_token +failed: identity:check_user_in_group +failed: identity:create_application_credential +failed: identity:create_consumer +failed: identity:create_credential +failed: identity:create_domain +failed: identity:create_domain_config +failed: identity:create_domain_role +failed: identity:create_endpoint +failed: identity:create_endpoint_group +failed: identity:create_grant +failed: identity:create_group +failed: identity:create_identity_provider +failed: identity:create_implied_role +failed: identity:create_limits +failed: identity:create_mapping +failed: identity:create_policy +failed: identity:create_policy_association_for_endpoint +failed: identity:create_policy_association_for_region_and_service +failed: identity:create_policy_association_for_service +failed: identity:create_project +failed: identity:create_project_tag +failed: identity:create_protocol +failed: identity:create_region +failed: identity:create_registered_limits +failed: identity:create_role +failed: identity:create_service +failed: identity:create_service_provider +failed: identity:create_system_grant_for_group +failed: identity:create_system_grant_for_user +failed: identity:create_trust +failed: identity:create_user +failed: identity:delete_access_token +failed: identity:delete_application_credential +failed: identity:delete_consumer +failed: identity:delete_credential +failed: identity:delete_domain +failed: identity:delete_domain_config +failed: identity:delete_domain_role +failed: identity:delete_endpoint +failed: identity:delete_endpoint_group +failed: identity:delete_group +failed: identity:delete_identity_provider +failed: identity:delete_implied_role +failed: identity:delete_limit +failed: identity:delete_mapping +failed: identity:delete_policy +failed: identity:delete_policy_association_for_endpoint +failed: identity:delete_policy_association_for_region_and_service +failed: identity:delete_policy_association_for_service +failed: identity:delete_project +failed: identity:delete_project_tag +failed: identity:delete_project_tags +failed: identity:delete_protocol +failed: identity:delete_region +failed: identity:delete_registered_limit +failed: identity:delete_role +failed: identity:delete_service +failed: identity:delete_service_provider +passed: identity:delete_trust +failed: identity:delete_user +failed: identity:ec2_create_credential +failed: identity:ec2_delete_credential +failed: identity:ec2_get_credential +failed: identity:ec2_list_credentials +failed: identity:get_access_token +failed: identity:get_access_token_role +failed: identity:get_application_credential +passed: identity:get_auth_catalog +passed: identity:get_auth_domains +passed: identity:get_auth_projects +passed: identity:get_auth_system +failed: identity:get_consumer +failed: identity:get_credential +failed: identity:get_domain +failed: identity:get_domain_config +failed: identity:get_domain_config_default +failed: identity:get_domain_role +failed: identity:get_endpoint +failed: identity:get_endpoint_group +failed: identity:get_endpoint_group_in_project +failed: identity:get_group +failed: identity:get_identity_provider +failed: identity:get_implied_role +passed: identity:get_limit +passed: identity:get_limit_model +failed: identity:get_mapping +failed: identity:get_policy +failed: identity:get_policy_for_endpoint +failed: identity:get_project +failed: identity:get_project_tag +failed: identity:get_protocol +passed: identity:get_region +passed: identity:get_registered_limit +failed: identity:get_role +passed: identity:get_role_for_trust +passed: identity:get_security_compliance_domain_config +failed: identity:get_service +failed: identity:get_service_provider +passed: identity:get_trust +failed: identity:get_user +failed: identity:list_access_token_roles +failed: identity:list_access_tokens +failed: identity:list_application_credentials +failed: identity:list_consumers +failed: identity:list_credentials +failed: identity:list_domain_roles +failed: identity:list_domains +passed: identity:list_domains_for_user +failed: identity:list_endpoint_groups +failed: identity:list_endpoint_groups_for_project +failed: identity:list_endpoints +failed: identity:list_endpoints_associated_with_endpoint_group +failed: identity:list_endpoints_for_policy +failed: identity:list_endpoints_for_project +failed: identity:list_grants +failed: identity:list_groups +failed: identity:list_groups_for_user +failed: identity:list_identity_providers +failed: identity:list_implied_roles +passed: identity:list_limits +failed: identity:list_mappings +failed: identity:list_policies +failed: identity:list_projects +failed: identity:list_projects_associated_with_endpoint_group +failed: identity:list_projects_for_endpoint +passed: identity:list_projects_for_user +failed: identity:list_project_tags +failed: identity:list_protocols +passed: identity:list_regions +passed: identity:list_registered_limits +failed: identity:list_revoke_events +failed: identity:list_role_assignments +failed: identity:list_role_assignments_for_tree +failed: identity:list_role_inference_rules +failed: identity:list_roles +passed: identity:list_roles_for_trust +failed: identity:list_service_providers +failed: identity:list_services +failed: identity:list_system_grants_for_group +failed: identity:list_system_grants_for_user +passed: identity:list_trusts +failed: identity:list_user_projects +failed: identity:list_users +failed: identity:list_users_in_group +failed: identity:remove_endpoint_from_project +failed: identity:remove_endpoint_group_from_project +failed: identity:remove_user_from_group +failed: identity:revocation_list +failed: identity:revoke_grant +failed: identity:revoke_system_grant_for_group +failed: identity:revoke_system_grant_for_user +failed: identity:revoke_token +failed: identity:update_consumer +failed: identity:update_credential +failed: identity:update_domain +failed: identity:update_domain_config +failed: identity:update_domain_role +failed: identity:update_endpoint +failed: identity:update_endpoint_group +failed: identity:update_group +failed: identity:update_identity_provider +failed: identity:update_limit +failed: identity:update_mapping +failed: identity:update_policy +failed: identity:update_project +failed: identity:update_project_tags +failed: identity:update_protocol +failed: identity:update_region +failed: identity:update_registered_limit +failed: identity:update_role +failed: identity:update_service +failed: identity:update_service_provider +failed: identity:update_user +failed: identity:validate_token diff --git a/tests/auth_token_member/manila.origin b/tests/auth_token_member/manila.origin new file mode 100644 index 0000000..aef4bcf --- /dev/null +++ b/tests/auth_token_member/manila.origin @@ -0,0 +1,130 @@ +passed: availability_zone:index +passed: message:delete +passed: message:get +passed: message:get_all +passed: quota_class_set:show +failed: quota_class_set:update +failed: quota_set:delete +passed: quota_set:show +failed: quota_set:update +failed: scheduler_stats:pools:detail +failed: scheduler_stats:pools:index +passed: security_service:create +passed: security_service:delete +passed: security_service:detail +failed: security_service:get_all_security_services +passed: security_service:index +passed: security_service:show +passed: security_service:update +failed: service:index +failed: service:update +passed: share:access_get +passed: share:access_get_all +passed: share:allow_access +passed: share:create +passed: share:create_snapshot +passed: share:delete +passed: share:delete_share_metadata +passed: share:delete_snapshot +passed: share:deny_access +passed: share_export_location:index +passed: share_export_location:show +passed: share:extend +failed: share:force_delete +passed: share:get +passed: share:get_all +passed: share:get_share_metadata +passed: share_group:create +passed: share_group:delete +failed: share_group:force_delete +passed: share_group:get +passed: share_group:get_all +failed: share_group:reset_status +passed: share_group_snapshot:create +passed: share_group_snapshot:delete +failed: share_group_snapshot:force_delete +passed: share_group_snapshot:get +passed: share_group_snapshot:get_all +failed: share_group_snapshot:reset_status +passed: share_group_snapshot:update +failed: share_group_type:add_project_access +failed: share_group_type:create +passed: share_group_type:default +failed: share_group_type:delete +passed: share_group_type:index +failed: share_group_type:list_project_access +failed: share_group_type:remove_project_access +passed: share_group_type:show +failed: share_group_types_spec:create +failed: share_group_types_spec:delete +failed: share_group_types_spec:index +failed: share_group_types_spec:show +failed: share_group_types_spec:update +passed: share_group:update +failed: share:list_by_host +failed: share:list_by_share_server_id +failed: share:manage +failed: share:migration_cancel +failed: share:migration_complete +failed: share:migration_get_progress +failed: share:migration_start +passed: share_network:add_security_service +passed: share_network:create +passed: share_network:delete +passed: share_network:detail +failed: share_network:get_all_share_networks +passed: share_network:index +passed: share_network:remove_security_service +passed: share_network:show +passed: share_network:update +passed: share_replica:create +passed: share_replica:delete +failed: share_replica:force_delete +passed: share_replica:get_all +passed: share_replica:promote +failed: share_replica:reset_replica_state +failed: share_replica:reset_status +failed: share_replica:resync +passed: share_replica:show +failed: share:reset_status +failed: share:reset_task_state +passed: share:revert_to_snapshot +failed: share_server:delete +failed: share_server:details +failed: share_server:index +failed: share_server:show +passed: share:shrink +passed: share_snapshot:access_list +passed: share_snapshot:allow_access +passed: share_snapshot:deny_access +passed: share_snapshot_export_location:index +passed: share_snapshot_export_location:show +failed: share_snapshot:force_delete +passed: share_snapshot:get_all_snapshots +passed: share_snapshot:get_snapshot +failed: share_snapshot_instance:detail +failed: share_snapshot_instance_export_location:index +failed: share_snapshot_instance_export_location:show +failed: share_snapshot_instance:index +failed: share_snapshot_instance:reset_status +failed: share_snapshot_instance:show +failed: share_snapshot:manage_snapshot +failed: share_snapshot:reset_status +failed: share_snapshot:unmanage_snapshot +passed: share:snapshot_update +failed: share_type:add_project_access +failed: share_type:create +passed: share_type:default +failed: share_type:delete +passed: share_type:index +failed: share_type:list_project_access +failed: share_type:remove_project_access +failed: share_types_extra_spec:create +failed: share_types_extra_spec:delete +failed: share_types_extra_spec:index +failed: share_types_extra_spec:show +failed: share_types_extra_spec:update +passed: share_type:show +failed: share:unmanage +passed: share:update +passed: share:update_share_metadata diff --git a/tests/auth_token_member/neutron.origin b/tests/auth_token_member/neutron.origin new file mode 100644 index 0000000..370a8e1 --- /dev/null +++ b/tests/auth_token_member/neutron.origin @@ -0,0 +1,67 @@ +failed: create_address_scope:shared +failed: create_floatingip:floating_ip_address +failed: create_network:is_default +failed: create_network:provider:network_type +failed: create_network:provider:physical_network +failed: create_network:provider:segmentation_id +failed: create_network:router:external +failed: create_network:segments +failed: create_network:shared +failed: create_port:allowed_address_pairs +failed: create_port:binding:host_id +failed: create_port:binding:profile +passed: create_port:device_owner +failed: create_port:fixed_ips:ip_address +failed: create_port:fixed_ips:subnet_id +failed: create_port:mac_address +failed: create_port:mac_learning_enabled +failed: create_port:port_security_enabled +passed: create_rbac_policy:target_tenant +failed: create_router:distributed +failed: create_router:external_gateway_info:enable_snat +failed: create_router:external_gateway_info:external_fixed_ips +failed: create_router:ha +failed: create_subnetpool:is_default +failed: create_subnetpool:shared +failed: create_subnet:segment_id +failed: create_subnet:service_types +failed: get_network:provider:network_type +failed: get_network:provider:physical_network +failed: get_network:provider:segmentation_id +failed: get_network:queue_id +passed: get_network:router:external +failed: get_network:segments +failed: get_port:binding:host_id +failed: get_port:binding:profile +failed: get_port:binding:vif_details +failed: get_port:binding:vif_type +failed: get_port:queue_id +failed: get_router:distributed +failed: get_router:ha +failed: get_subnet:segment_id +failed: update_address_scope:shared +failed: update_network:provider:network_type +failed: update_network:provider:physical_network +failed: update_network:provider:segmentation_id +failed: update_network:router:external +failed: update_network:segments +failed: update_network:shared +failed: update_port:allowed_address_pairs +failed: update_port:binding:host_id +failed: update_port:binding:profile +failed: update_port:data_plane_status +passed: update_port:device_owner +failed: update_port:fixed_ips:ip_address +failed: update_port:fixed_ips:subnet_id +failed: update_port:mac_address +failed: update_port:mac_learning_enabled +failed: update_port:port_security_enabled +passed: update_rbac_policy:target_tenant +failed: update_router:distributed +passed: update_router:external_gateway_info +failed: update_router:external_gateway_info:enable_snat +failed: update_router:external_gateway_info:external_fixed_ips +passed: update_router:external_gateway_info:network_id +failed: update_router:ha +failed: update_subnetpool:is_default +failed: update_subnet:service_types diff --git a/tests/auth_token_member/nova.origin b/tests/auth_token_member/nova.origin new file mode 100644 index 0000000..57f22e8 --- /dev/null +++ b/tests/auth_token_member/nova.origin @@ -0,0 +1,164 @@ +failed: cells_scheduler_filter:DifferentCellFilter +failed: cells_scheduler_filter:TargetCellFilter +failed: network:attach_external_network +passed: os_compute_api:extensions +passed: os_compute_api:flavors +passed: os_compute_api:image-size +passed: os_compute_api:ips:index +passed: os_compute_api:ips:show +passed: os_compute_api:limits +failed: os_compute_api:os-admin-actions:inject_network_info +failed: os_compute_api:os-admin-actions:reset_network +failed: os_compute_api:os-admin-actions:reset_state +passed: os_compute_api:os-admin-password +failed: os_compute_api:os-agents +failed: os_compute_api:os-aggregates:add_host +failed: os_compute_api:os-aggregates:create +failed: os_compute_api:os-aggregates:delete +failed: os_compute_api:os-aggregates:index +failed: os_compute_api:os-aggregates:remove_host +failed: os_compute_api:os-aggregates:set_metadata +failed: os_compute_api:os-aggregates:show +failed: os_compute_api:os-aggregates:update +failed: os_compute_api:os-assisted-volume-snapshots:create +failed: os_compute_api:os-assisted-volume-snapshots:delete +passed: os_compute_api:os-attach-interfaces +passed: os_compute_api:os-attach-interfaces:create +passed: os_compute_api:os-attach-interfaces:delete +failed: os_compute_api:os-availability-zone:detail +passed: os_compute_api:os-availability-zone:list +failed: os_compute_api:os-baremetal-nodes +failed: os_compute_api:os-cells +failed: os_compute_api:os-cells:create +failed: os_compute_api:os-cells:delete +failed: os_compute_api:os-cells:sync_instances +failed: os_compute_api:os-cells:update +passed: os_compute_api:os-config-drive +failed: os_compute_api:os-console-auth-tokens +passed: os_compute_api:os-console-output +passed: os_compute_api:os-consoles:create +passed: os_compute_api:os-consoles:delete +passed: os_compute_api:os-consoles:index +passed: os_compute_api:os-consoles:show +passed: os_compute_api:os-create-backup +passed: os_compute_api:os-deferred-delete +failed: os_compute_api:os-evacuate +passed: os_compute_api:os-extended-availability-zone +passed: os_compute_api:os-extended-server-attributes +passed: os_compute_api:os-extended-status +passed: os_compute_api:os-extended-volumes +passed: os_compute_api:os-flavor-access +failed: os_compute_api:os-flavor-access:add_tenant_access +failed: os_compute_api:os-flavor-access:remove_tenant_access +failed: os_compute_api:os-flavor-extra-specs:create +failed: os_compute_api:os-flavor-extra-specs:delete +passed: os_compute_api:os-flavor-extra-specs:index +passed: os_compute_api:os-flavor-extra-specs:show +failed: os_compute_api:os-flavor-extra-specs:update +failed: os_compute_api:os-flavor-manage +failed: os_compute_api:os-flavor-manage:create +failed: os_compute_api:os-flavor-manage:delete +failed: os_compute_api:os-flavor-manage:update +passed: os_compute_api:os-flavor-rxtx +passed: os_compute_api:os-floating-ip-pools +passed: os_compute_api:os-floating-ips +passed: os_compute_api:os-hide-server-addresses +failed: os_compute_api:os-hosts +failed: os_compute_api:os-hypervisors +passed: os_compute_api:os-instance-actions +failed: os_compute_api:os-instance-actions:events +failed: os_compute_api:os-instance-usage-audit-log +passed: os_compute_api:os-keypairs +failed: os_compute_api:os-keypairs:create +failed: os_compute_api:os-keypairs:delete +failed: os_compute_api:os-keypairs:index +failed: os_compute_api:os-keypairs:show +passed: os_compute_api:os-lock-server:lock +passed: os_compute_api:os-lock-server:unlock +failed: os_compute_api:os-lock-server:unlock:unlock_override +failed: os_compute_api:os-migrate-server:migrate +failed: os_compute_api:os-migrate-server:migrate_live +failed: os_compute_api:os-migrations:index +passed: os_compute_api:os-multinic +failed: os_compute_api:os-networks +failed: os_compute_api:os-networks-associate +passed: os_compute_api:os-networks:view +passed: os_compute_api:os-pause-server:pause +passed: os_compute_api:os-pause-server:unpause +failed: os_compute_api:os-quota-class-sets:show +failed: os_compute_api:os-quota-class-sets:update +passed: os_compute_api:os-quota-sets:defaults +failed: os_compute_api:os-quota-sets:delete +passed: os_compute_api:os-quota-sets:detail +passed: os_compute_api:os-quota-sets:show +failed: os_compute_api:os-quota-sets:update +passed: os_compute_api:os-remote-consoles +passed: os_compute_api:os-rescue +failed: os_compute_api:os-security-group-default-rules +passed: os_compute_api:os-security-groups +passed: os_compute_api:os-server-diagnostics +failed: os_compute_api:os-server-external-events:create +passed: os_compute_api:os-server-groups +passed: os_compute_api:os-server-groups:create +passed: os_compute_api:os-server-groups:delete +passed: os_compute_api:os-server-groups:index +passed: os_compute_api:os-server-groups:show +passed: os_compute_api:os-server-password +passed: os_compute_api:os-server-tags:delete +passed: os_compute_api:os-server-tags:delete_all +passed: os_compute_api:os-server-tags:index +passed: os_compute_api:os-server-tags:show +passed: os_compute_api:os-server-tags:update +passed: os_compute_api:os-server-tags:update_all +passed: os_compute_api:os-server-usage +failed: os_compute_api:os-services +passed: os_compute_api:os-shelve:shelve +failed: os_compute_api:os-shelve:shelve_offload +passed: os_compute_api:os-shelve:unshelve +failed: os_compute_api:os-simple-tenant-usage:list +passed: os_compute_api:os-simple-tenant-usage:show +passed: os_compute_api:os-suspend-server:resume +passed: os_compute_api:os-suspend-server:suspend +passed: os_compute_api:os-tenant-networks +failed: os_compute_api:os-used-limits +passed: os_compute_api:os-volumes +passed: os_compute_api:os-volumes-attachments:create +passed: os_compute_api:os-volumes-attachments:delete +passed: os_compute_api:os-volumes-attachments:index +passed: os_compute_api:os-volumes-attachments:show +failed: os_compute_api:os-volumes-attachments:update +passed: os_compute_api:server-metadata:create +passed: os_compute_api:server-metadata:delete +passed: os_compute_api:server-metadata:index +passed: os_compute_api:server-metadata:show +passed: os_compute_api:server-metadata:update +passed: os_compute_api:server-metadata:update_all +passed: os_compute_api:servers:confirm_resize +passed: os_compute_api:servers:create +passed: os_compute_api:servers:create:attach_network +passed: os_compute_api:servers:create:attach_volume +failed: os_compute_api:servers:create:forced_host +passed: os_compute_api:servers:create_image +passed: os_compute_api:servers:create_image:allow_volume_backed +passed: os_compute_api:servers:create:trusted_certs +passed: os_compute_api:servers:create:zero_disk_flavor +passed: os_compute_api:servers:delete +passed: os_compute_api:servers:detail +failed: os_compute_api:servers:detail:get_all_tenants +passed: os_compute_api:servers:index +failed: os_compute_api:servers:index:get_all_tenants +failed: os_compute_api:servers:migrations:delete +failed: os_compute_api:servers:migrations:force_complete +failed: os_compute_api:servers:migrations:index +failed: os_compute_api:servers:migrations:show +passed: os_compute_api:servers:reboot +passed: os_compute_api:servers:rebuild +passed: os_compute_api:servers:rebuild:trusted_certs +passed: os_compute_api:servers:resize +passed: os_compute_api:servers:revert_resize +passed: os_compute_api:servers:show +failed: os_compute_api:servers:show:host_status +passed: os_compute_api:servers:start +passed: os_compute_api:servers:stop +passed: os_compute_api:servers:trigger_crash_dump +passed: os_compute_api:servers:update diff --git a/tests/auth_token_member/panko.origin b/tests/auth_token_member/panko.origin new file mode 100644 index 0000000..377b7c9 --- /dev/null +++ b/tests/auth_token_member/panko.origin @@ -0,0 +1,2 @@ +passed: telemetry:events:index +passed: telemetry:events:show diff --git a/tests/auth_token_reader/aodh.origin b/tests/auth_token_reader/aodh.origin new file mode 100644 index 0000000..6c2161c --- /dev/null +++ b/tests/auth_token_reader/aodh.origin @@ -0,0 +1,10 @@ +passed: telemetry:alarm_history +failed: telemetry:change_alarm +failed: telemetry:change_alarm_state +failed: telemetry:create_alarm +failed: telemetry:delete_alarm +passed: telemetry:get_alarm +passed: telemetry:get_alarms +passed: telemetry:get_alarm_state +failed: telemetry:query_alarm +failed: telemetry:query_alarm_history diff --git a/tests/auth_token_reader/cinder.origin b/tests/auth_token_reader/cinder.origin new file mode 100644 index 0000000..895b4f2 --- /dev/null +++ b/tests/auth_token_reader/cinder.origin @@ -0,0 +1,134 @@ +failed: backup:backup-import +passed: backup:backup_project_attribute +failed: backup:create +failed: backup:delete +failed: backup:export-import +passed: backup:get +passed: backup:get_all +failed: backup:restore +failed: backup:update +passed: clusters:get +passed: clusters:get_all +failed: clusters:update +passed: group:access_group_types_specs +failed: group:create +failed: group:create_group_snapshot +failed: group:delete +failed: group:delete_group_snapshot +failed: group:disable_replication +failed: group:enable_replication +failed: group:failover_replication +passed: group:get +passed: group:get_all +passed: group:get_all_group_snapshots +passed: group:get_group_snapshot +failed: group:group_types_manage +failed: group:group_types_specs +failed: group:list_replication_targets +failed: group:reset_group_snapshot_status +failed: group:reset_status +failed: group:update +passed: group:update_group_snapshot +passed: limits_extension:used_limits +failed: message:delete +passed: message:get +passed: message:get_all +passed: scheduler_extension:scheduler_stats:get_pools +passed: snapshot_extension:list_manageable +failed: snapshot_extension:snapshot_actions:update_snapshot_status +failed: snapshot_extension:snapshot_manage +failed: snapshot_extension:snapshot_unmanage +failed: volume:accept_transfer +failed: volume:attachment_complete +failed: volume:attachment_create +failed: volume:attachment_delete +failed: volume:attachment_update +failed: volume:create +failed: volume:create_from_image +failed: volume:create_snapshot +failed: volume:create_transfer +failed: volume:create_volume_metadata +failed: volume:delete +failed: volume:delete_snapshot +failed: volume:delete_snapshot_metadata +failed: volume:delete_transfer +failed: volume:delete_volume_metadata +failed: volume:extend +failed: volume:extend_attached_volume +passed: volume_extension:access_types_extra_specs +passed: volume_extension:access_types_qos_specs_id +failed: volume_extension:backup_admin_actions:force_delete +failed: volume_extension:backup_admin_actions:reset_status +passed: volume_extension:capabilities +passed: volume_extension:extended_snapshot_attributes +failed: volume_extension:hosts +passed: volume_extension:list_manageable +failed: volume_extension:qos_specs_manage:create +failed: volume_extension:qos_specs_manage:delete +passed: volume_extension:qos_specs_manage:get +passed: volume_extension:qos_specs_manage:get_all +passed: volume_extension:qos_specs_manage:update +failed: volume_extension:quota_classes +passed: volume_extension:quota_classes:validate_setup_for_nested_quota_use +failed: volume_extension:quotas:delete +passed: volume_extension:quotas:show +failed: volume_extension:quotas:update +passed: volume_extension:services:index +failed: volume_extension:services:update +failed: volume_extension:snapshot_admin_actions:force_delete +failed: volume_extension:snapshot_admin_actions:reset_status +failed: volume_extension:types_extra_specs:create +failed: volume_extension:types_extra_specs:delete +passed: volume_extension:types_extra_specs:index +passed: volume_extension:types_extra_specs:show +failed: volume_extension:types_extra_specs:update +failed: volume_extension:types_manage +failed: volume_extension:volume_actions:attach +failed: volume_extension:volume_actions:begin_detaching +failed: volume_extension:volume_actions:detach +failed: volume_extension:volume_actions:initialize_connection +failed: volume_extension:volume_actions:reserve +failed: volume_extension:volume_actions:roll_detaching +failed: volume_extension:volume_actions:terminate_connection +failed: volume_extension:volume_actions:unreserve +failed: volume_extension:volume_actions:upload_image +failed: volume_extension:volume_actions:upload_public +failed: volume_extension:volume_admin_actions:force_delete +failed: volume_extension:volume_admin_actions:force_detach +failed: volume_extension:volume_admin_actions:migrate_volume +failed: volume_extension:volume_admin_actions:migrate_volume_completion +failed: volume_extension:volume_admin_actions:reset_status +passed: volume_extension:volume_encryption_metadata +passed: volume_extension:volume_host_attribute +failed: volume_extension:volume_image_metadata +failed: volume_extension:volume_manage +passed: volume_extension:volume_mig_status_attribute +passed: volume_extension:volume_tenant_attribute +failed: volume_extension:volume_type_access +failed: volume_extension:volume_type_access:addProjectAccess +failed: volume_extension:volume_type_access:removeProjectAccess +failed: volume_extension:volume_type_encryption +failed: volume_extension:volume_unmanage +failed: volume:failover_host +failed: volume:force_delete +failed: volume:freeze_host +passed: volume:get +passed: volume:get_all +passed: volume:get_all_snapshots +passed: volume:get_all_transfers +passed: volume:get_snapshot +passed: volume:get_snapshot_metadata +passed: volume:get_transfer +passed: volume:get_volume_metadata +failed: volume:multiattach +failed: volume:multiattach_bootable_volume +failed: volume:retype +failed: volume:revert_to_snapshot +failed: volume:thaw_host +failed: volume:update +failed: volume:update_readonly_flag +failed: volume:update_snapshot +failed: volume:update_snapshot_metadata +failed: volume:update_volume_admin_metadata +failed: volume:update_volume_metadata +failed: workers:cleanup diff --git a/tests/auth_token_reader/glance.origin b/tests/auth_token_reader/glance.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_reader/glance.origin diff --git a/tests/auth_token_reader/gnocchi.origin b/tests/auth_token_reader/gnocchi.origin new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/tests/auth_token_reader/gnocchi.origin diff --git a/tests/auth_token_reader/heat.origin b/tests/auth_token_reader/heat.origin new file mode 100644 index 0000000..32a2b08 --- /dev/null +++ b/tests/auth_token_reader/heat.origin @@ -0,0 +1,79 @@ +failed: actions:action +passed: build_info:build_info +failed: cloudformation:CancelUpdateStack +failed: cloudformation:CreateStack +failed: cloudformation:DeleteStack +passed: cloudformation:DescribeStackEvents +passed: cloudformation:DescribeStackResource +passed: cloudformation:DescribeStackResources +passed: cloudformation:DescribeStacks +passed: cloudformation:EstimateTemplateCost +failed: cloudformation:GetTemplate +passed: cloudformation:ListStackResources +passed: cloudformation:ListStacks +failed: cloudformation:UpdateStack +failed: cloudformation:ValidateTemplate +passed: events:index +passed: events:show +passed: resource:index +failed: resource:mark_unhealthy +passed: resource:metadata +passed: resource:show +passed: resource:signal +failed: resource_types:OS::Cinder::EncryptedVolumeType +failed: resource_types:OS::Cinder::QoSAssociation +failed: resource_types:OS::Cinder::QoSSpecs +failed: resource_types:OS::Cinder::Quota +failed: resource_types:OS::Cinder::VolumeType +failed: resource_types:OS::Keystone::* +failed: resource_types:OS::Manila::ShareType +failed: resource_types:OS::Neutron::ProviderNet +failed: resource_types:OS::Neutron::QoSBandwidthLimitRule +failed: resource_types:OS::Neutron::QoSPolicy +failed: resource_types:OS::Neutron::Quota +failed: resource_types:OS::Neutron::Segment +failed: resource_types:OS::Nova::Flavor +failed: resource_types:OS::Nova::HostAggregate +failed: resource_types:OS::Nova::Quota +passed: service:index +failed: software_configs:create +failed: software_configs:delete +failed: software_configs:global_index +passed: software_configs:index +passed: software_configs:show +failed: software_deployments:create +failed: software_deployments:delete +passed: software_deployments:index +passed: software_deployments:metadata +passed: software_deployments:show +failed: software_deployments:update +failed: stacks:abandon +failed: stacks:create +failed: stacks:delete +failed: stacks:delete_snapshot +passed: stacks:detail +failed: stacks:environment +passed: stacks:export +failed: stacks:files +passed: stacks:generate_template +failed: stacks:global_index +passed: stacks:index +failed: stacks:list_outputs +passed: stacks:list_resource_types +passed: stacks:list_snapshots +passed: stacks:list_template_functions +passed: stacks:list_template_versions +passed: stacks:lookup +failed: stacks:preview +failed: stacks:preview_update +failed: stacks:preview_update_patch +passed: stacks:resource_schema +failed: stacks:restore_snapshot +passed: stacks:show +failed: stacks:show_output +passed: stacks:show_snapshot +failed: stacks:snapshot +failed: stacks:template +failed: stacks:update +failed: stacks:update_patch +failed: stacks:validate_template diff --git a/tests/auth_token_reader/keystone.origin b/tests/auth_token_reader/keystone.origin new file mode 100644 index 0000000..f86dcc7 --- /dev/null +++ b/tests/auth_token_reader/keystone.origin @@ -0,0 +1,187 @@ +failed: identity:add_endpoint_group_to_project +failed: identity:add_endpoint_to_project +failed: identity:add_user_to_group +failed: identity:authorize_request_token +passed: identity:check_endpoint_in_project +passed: identity:check_grant +passed: identity:check_implied_role +passed: identity:check_policy_association_for_endpoint +passed: identity:check_policy_association_for_region_and_service +passed: identity:check_policy_association_for_service +passed: identity:check_system_grant_for_group +passed: identity:check_system_grant_for_user +failed: identity:check_token +passed: identity:check_user_in_group +failed: identity:create_application_credential +failed: identity:create_consumer +failed: identity:create_credential +failed: identity:create_domain +failed: identity:create_domain_config +failed: identity:create_domain_role +failed: identity:create_endpoint +failed: identity:create_endpoint_group +failed: identity:create_grant +failed: identity:create_group +failed: identity:create_identity_provider +failed: identity:create_implied_role +failed: identity:create_limits +failed: identity:create_mapping +failed: identity:create_policy +failed: identity:create_policy_association_for_endpoint +failed: identity:create_policy_association_for_region_and_service +failed: identity:create_policy_association_for_service +failed: identity:create_project +failed: identity:create_project_tag +failed: identity:create_protocol +failed: identity:create_region +failed: identity:create_registered_limits +failed: identity:create_role +failed: identity:create_service +failed: identity:create_service_provider +failed: identity:create_system_grant_for_group +failed: identity:create_system_grant_for_user +failed: identity:create_trust +failed: identity:create_user +failed: identity:delete_access_token +failed: identity:delete_application_credential +failed: identity:delete_consumer +failed: identity:delete_credential +failed: identity:delete_domain +failed: identity:delete_domain_config +failed: identity:delete_domain_role +failed: identity:delete_endpoint +failed: identity:delete_endpoint_group +failed: identity:delete_group +failed: identity:delete_identity_provider +failed: identity:delete_implied_role +failed: identity:delete_limit +failed: identity:delete_mapping +failed: identity:delete_policy +failed: identity:delete_policy_association_for_endpoint +failed: identity:delete_policy_association_for_region_and_service +failed: identity:delete_policy_association_for_service +failed: identity:delete_project +failed: identity:delete_project_tag +failed: identity:delete_project_tags +failed: identity:delete_protocol +failed: identity:delete_region +failed: identity:delete_registered_limit +failed: identity:delete_role +failed: identity:delete_service +failed: identity:delete_service_provider +failed: identity:delete_trust +failed: identity:delete_user +failed: identity:ec2_create_credential +failed: identity:ec2_delete_credential +passed: identity:ec2_get_credential +failed: identity:ec2_list_credentials +failed: identity:get_access_token +failed: identity:get_access_token_role +passed: identity:get_application_credential +failed: identity:get_auth_catalog +failed: identity:get_auth_domains +failed: identity:get_auth_projects +failed: identity:get_auth_system +failed: identity:get_consumer +failed: identity:get_credential +passed: identity:get_domain +passed: identity:get_domain_config +passed: identity:get_domain_config_default +passed: identity:get_domain_role +passed: identity:get_endpoint +passed: identity:get_endpoint_group +passed: identity:get_endpoint_group_in_project +passed: identity:get_group +passed: identity:get_identity_provider +passed: identity:get_implied_role +failed: identity:get_limit +failed: identity:get_limit_model +passed: identity:get_mapping +passed: identity:get_policy +passed: identity:get_policy_for_endpoint +passed: identity:get_project +passed: identity:get_project_tag +passed: identity:get_protocol +failed: identity:get_region +failed: identity:get_registered_limit +passed: identity:get_role +failed: identity:get_role_for_trust +failed: identity:get_security_compliance_domain_config +passed: identity:get_service +passed: identity:get_service_provider +failed: identity:get_trust +passed: identity:get_user +failed: identity:list_access_token_roles +failed: identity:list_access_tokens +passed: identity:list_application_credentials +failed: identity:list_consumers +failed: identity:list_credentials +passed: identity:list_domain_roles +passed: identity:list_domains +failed: identity:list_domains_for_user +passed: identity:list_endpoint_groups +passed: identity:list_endpoint_groups_for_project +passed: identity:list_endpoints +passed: identity:list_endpoints_associated_with_endpoint_group +passed: identity:list_endpoints_for_policy +passed: identity:list_endpoints_for_project +passed: identity:list_grants +passed: identity:list_groups +passed: identity:list_groups_for_user +passed: identity:list_identity_providers +passed: identity:list_implied_roles +failed: identity:list_limits +passed: identity:list_mappings +passed: identity:list_policies +passed: identity:list_projects +passed: identity:list_projects_associated_with_endpoint_group +passed: identity:list_projects_for_endpoint +failed: identity:list_projects_for_user +passed: identity:list_project_tags +passed: identity:list_protocols +failed: identity:list_regions +failed: identity:list_registered_limits +passed: identity:list_revoke_events +passed: identity:list_role_assignments +passed: identity:list_role_assignments_for_tree +passed: identity:list_role_inference_rules +passed: identity:list_roles +failed: identity:list_roles_for_trust +passed: identity:list_service_providers +passed: identity:list_services +passed: identity:list_system_grants_for_group +passed: identity:list_system_grants_for_user +failed: identity:list_trusts +passed: identity:list_user_projects +passed: identity:list_users +passed: identity:list_users_in_group +failed: identity:remove_endpoint_from_project +failed: identity:remove_endpoint_group_from_project +failed: identity:remove_user_from_group +passed: identity:revocation_list +failed: identity:revoke_grant +failed: identity:revoke_system_grant_for_group +failed: identity:revoke_system_grant_for_user +failed: identity:revoke_token +failed: identity:update_consumer +failed: identity:update_credential +failed: identity:update_domain +failed: identity:update_domain_config +failed: identity:update_domain_role +failed: identity:update_endpoint +failed: identity:update_endpoint_group +failed: identity:update_group +failed: identity:update_identity_provider +failed: identity:update_limit +failed: identity:update_mapping +failed: identity:update_policy +failed: identity:update_project +failed: identity:update_project_tags +failed: identity:update_protocol +failed: identity:update_region +failed: identity:update_registered_limit +failed: identity:update_role +failed: identity:update_service +failed: identity:update_service_provider +failed: identity:update_user +passed: identity:validate_token diff --git a/tests/auth_token_reader/manila.origin b/tests/auth_token_reader/manila.origin new file mode 100644 index 0000000..9e745f9 --- /dev/null +++ b/tests/auth_token_reader/manila.origin @@ -0,0 +1,130 @@ +passed: availability_zone:index +failed: message:delete +passed: message:get +passed: message:get_all +failed: quota_class_set:show +failed: quota_class_set:update +failed: quota_set:delete +passed: quota_set:show +failed: quota_set:update +passed: scheduler_stats:pools:detail +passed: scheduler_stats:pools:index +failed: security_service:create +failed: security_service:delete +passed: security_service:detail +passed: security_service:get_all_security_services +passed: security_service:index +passed: security_service:show +failed: security_service:update +passed: service:index +failed: service:update +passed: share:access_get +passed: share:access_get_all +failed: share:allow_access +failed: share:create +failed: share:create_snapshot +failed: share:delete +failed: share:delete_share_metadata +failed: share:delete_snapshot +failed: share:deny_access +passed: share_export_location:index +passed: share_export_location:show +failed: share:extend +failed: share:force_delete +passed: share:get +passed: share:get_all +passed: share:get_share_metadata +failed: share_group:create +failed: share_group:delete +failed: share_group:force_delete +passed: share_group:get +passed: share_group:get_all +failed: share_group:reset_status +failed: share_group_snapshot:create +failed: share_group_snapshot:delete +failed: share_group_snapshot:force_delete +passed: share_group_snapshot:get +passed: share_group_snapshot:get_all +failed: share_group_snapshot:reset_status +failed: share_group_snapshot:update +failed: share_group_type:add_project_access +failed: share_group_type:create +passed: share_group_type:default +failed: share_group_type:delete +passed: share_group_type:index +passed: share_group_type:list_project_access +failed: share_group_type:remove_project_access +passed: share_group_type:show +failed: share_group_types_spec:create +failed: share_group_types_spec:delete +passed: share_group_types_spec:index +passed: share_group_types_spec:show +failed: share_group_types_spec:update +failed: share_group:update +passed: share:list_by_host +passed: share:list_by_share_server_id +failed: share:manage +failed: share:migration_cancel +failed: share:migration_complete +passed: share:migration_get_progress +failed: share:migration_start +failed: share_network:add_security_service +failed: share_network:create +failed: share_network:delete +passed: share_network:detail +passed: share_network:get_all_share_networks +passed: share_network:index +failed: share_network:remove_security_service +passed: share_network:show +failed: share_network:update +failed: share_replica:create +failed: share_replica:delete +failed: share_replica:force_delete +passed: share_replica:get_all +failed: share_replica:promote +failed: share_replica:reset_replica_state +failed: share_replica:reset_status +failed: share_replica:resync +passed: share_replica:show +failed: share:reset_status +failed: share:reset_task_state +failed: share:revert_to_snapshot +failed: share_server:delete +passed: share_server:details +passed: share_server:index +passed: share_server:show +failed: share:shrink +passed: share_snapshot:access_list +failed: share_snapshot:allow_access +failed: share_snapshot:deny_access +passed: share_snapshot_export_location:index +passed: share_snapshot_export_location:show +failed: share_snapshot:force_delete +passed: share_snapshot:get_all_snapshots +passed: share_snapshot:get_snapshot +passed: share_snapshot_instance:detail +passed: share_snapshot_instance_export_location:index +passed: share_snapshot_instance_export_location:show +passed: share_snapshot_instance:index +failed: share_snapshot_instance:reset_status +passed: share_snapshot_instance:show +failed: share_snapshot:manage_snapshot +failed: share_snapshot:reset_status +failed: share_snapshot:unmanage_snapshot +failed: share:snapshot_update +failed: share_type:add_project_access +failed: share_type:create +passed: share_type:default +failed: share_type:delete +passed: share_type:index +passed: share_type:list_project_access +failed: share_type:remove_project_access +failed: share_types_extra_spec:create +failed: share_types_extra_spec:delete +passed: share_types_extra_spec:index +passed: share_types_extra_spec:show +failed: share_types_extra_spec:update +passed: share_type:show +failed: share:unmanage +failed: share:update +failed: share:update_share_metadata diff --git a/tests/auth_token_reader/neutron.origin b/tests/auth_token_reader/neutron.origin new file mode 100644 index 0000000..32c0c19 --- /dev/null +++ b/tests/auth_token_reader/neutron.origin @@ -0,0 +1,67 @@ +failed: create_address_scope:shared +failed: create_floatingip:floating_ip_address +failed: create_network:is_default +failed: create_network:provider:network_type +failed: create_network:provider:physical_network +failed: create_network:provider:segmentation_id +failed: create_network:router:external +failed: create_network:segments +failed: create_network:shared +failed: create_port:allowed_address_pairs +failed: create_port:binding:host_id +failed: create_port:binding:profile +passed: create_port:device_owner +failed: create_port:fixed_ips:ip_address +failed: create_port:fixed_ips:subnet_id +failed: create_port:mac_address +failed: create_port:mac_learning_enabled +failed: create_port:port_security_enabled +passed: create_rbac_policy:target_tenant +failed: create_router:distributed +failed: create_router:external_gateway_info:enable_snat +failed: create_router:external_gateway_info:external_fixed_ips +failed: create_router:ha +failed: create_subnetpool:is_default +failed: create_subnetpool:shared +failed: create_subnet:segment_id +failed: create_subnet:service_types +passed: get_network:provider:network_type +passed: get_network:provider:physical_network +passed: get_network:provider:segmentation_id +passed: get_network:queue_id +passed: get_network:router:external +passed: get_network:segments +passed: get_port:binding:host_id +passed: get_port:binding:profile +passed: get_port:binding:vif_details +passed: get_port:binding:vif_type +passed: get_port:queue_id +passed: get_router:distributed +passed: get_router:ha +passed: get_subnet:segment_id +failed: update_address_scope:shared +failed: update_network:provider:network_type +failed: update_network:provider:physical_network +failed: update_network:provider:segmentation_id +failed: update_network:router:external +failed: update_network:segments +failed: update_network:shared +failed: update_port:allowed_address_pairs +failed: update_port:binding:host_id +failed: update_port:binding:profile +failed: update_port:data_plane_status +passed: update_port:device_owner +failed: update_port:fixed_ips:ip_address +failed: update_port:fixed_ips:subnet_id +failed: update_port:mac_address +failed: update_port:mac_learning_enabled +failed: update_port:port_security_enabled +failed: update_rbac_policy:target_tenant +failed: update_router:distributed +failed: update_router:external_gateway_info +failed: update_router:external_gateway_info:enable_snat +failed: update_router:external_gateway_info:external_fixed_ips +failed: update_router:external_gateway_info:network_id +failed: update_router:ha +failed: update_subnetpool:is_default +failed: update_subnet:service_types diff --git a/tests/auth_token_reader/nova.origin b/tests/auth_token_reader/nova.origin new file mode 100644 index 0000000..a82dead --- /dev/null +++ b/tests/auth_token_reader/nova.origin @@ -0,0 +1,164 @@ +failed: cells_scheduler_filter:DifferentCellFilter +failed: cells_scheduler_filter:TargetCellFilter +failed: network:attach_external_network +passed: os_compute_api:extensions +failed: os_compute_api:flavors +passed: os_compute_api:image-size +passed: os_compute_api:ips:index +passed: os_compute_api:ips:show +passed: os_compute_api:limits +failed: os_compute_api:os-admin-actions:inject_network_info +failed: os_compute_api:os-admin-actions:reset_network +failed: os_compute_api:os-admin-actions:reset_state +failed: os_compute_api:os-admin-password +failed: os_compute_api:os-agents +failed: os_compute_api:os-aggregates:add_host +failed: os_compute_api:os-aggregates:create +failed: os_compute_api:os-aggregates:delete +passed: os_compute_api:os-aggregates:index +failed: os_compute_api:os-aggregates:remove_host +failed: os_compute_api:os-aggregates:set_metadata +passed: os_compute_api:os-aggregates:show +failed: os_compute_api:os-aggregates:update +failed: os_compute_api:os-assisted-volume-snapshots:create +failed: os_compute_api:os-assisted-volume-snapshots:delete +passed: os_compute_api:os-attach-interfaces +failed: os_compute_api:os-attach-interfaces:create +failed: os_compute_api:os-attach-interfaces:delete +passed: os_compute_api:os-availability-zone:detail +passed: os_compute_api:os-availability-zone:list +passed: os_compute_api:os-baremetal-nodes +passed: os_compute_api:os-cells +failed: os_compute_api:os-cells:create +failed: os_compute_api:os-cells:delete +failed: os_compute_api:os-cells:sync_instances +failed: os_compute_api:os-cells:update +failed: os_compute_api:os-config-drive +passed: os_compute_api:os-console-auth-tokens +passed: os_compute_api:os-console-output +failed: os_compute_api:os-consoles:create +failed: os_compute_api:os-consoles:delete +passed: os_compute_api:os-consoles:index +passed: os_compute_api:os-consoles:show +failed: os_compute_api:os-create-backup +failed: os_compute_api:os-deferred-delete +failed: os_compute_api:os-evacuate +failed: os_compute_api:os-extended-availability-zone +passed: os_compute_api:os-extended-server-attributes +passed: os_compute_api:os-extended-status +passed: os_compute_api:os-extended-volumes +failed: os_compute_api:os-flavor-access +failed: os_compute_api:os-flavor-access:add_tenant_access +failed: os_compute_api:os-flavor-access:remove_tenant_access +failed: os_compute_api:os-flavor-extra-specs:create +failed: os_compute_api:os-flavor-extra-specs:delete +failed: os_compute_api:os-flavor-extra-specs:index +passed: os_compute_api:os-flavor-extra-specs:show +failed: os_compute_api:os-flavor-extra-specs:update +failed: os_compute_api:os-flavor-manage +failed: os_compute_api:os-flavor-manage:create +failed: os_compute_api:os-flavor-manage:delete +failed: os_compute_api:os-flavor-manage:update +failed: os_compute_api:os-flavor-rxtx +passed: os_compute_api:os-floating-ip-pools +failed: os_compute_api:os-floating-ips +failed: os_compute_api:os-hide-server-addresses +failed: os_compute_api:os-hosts +passed: os_compute_api:os-hypervisors +passed: os_compute_api:os-instance-actions +passed: os_compute_api:os-instance-actions:events +passed: os_compute_api:os-instance-usage-audit-log +failed: os_compute_api:os-keypairs +failed: os_compute_api:os-keypairs:create +failed: os_compute_api:os-keypairs:delete +failed: os_compute_api:os-keypairs:index +failed: os_compute_api:os-keypairs:show +failed: os_compute_api:os-lock-server:lock +failed: os_compute_api:os-lock-server:unlock +failed: os_compute_api:os-lock-server:unlock:unlock_override +failed: os_compute_api:os-migrate-server:migrate +failed: os_compute_api:os-migrate-server:migrate_live +passed: os_compute_api:os-migrations:index +failed: os_compute_api:os-multinic +failed: os_compute_api:os-networks +failed: os_compute_api:os-networks-associate +passed: os_compute_api:os-networks:view +failed: os_compute_api:os-pause-server:pause +failed: os_compute_api:os-pause-server:unpause +passed: os_compute_api:os-quota-class-sets:show +failed: os_compute_api:os-quota-class-sets:update +passed: os_compute_api:os-quota-sets:defaults +failed: os_compute_api:os-quota-sets:delete +passed: os_compute_api:os-quota-sets:detail +passed: os_compute_api:os-quota-sets:show +failed: os_compute_api:os-quota-sets:update +failed: os_compute_api:os-remote-consoles +failed: os_compute_api:os-rescue +failed: os_compute_api:os-security-group-default-rules +failed: os_compute_api:os-security-groups +passed: os_compute_api:os-server-diagnostics +failed: os_compute_api:os-server-external-events:create +failed: os_compute_api:os-server-groups +failed: os_compute_api:os-server-groups:create +failed: os_compute_api:os-server-groups:delete +passed: os_compute_api:os-server-groups:index +passed: os_compute_api:os-server-groups:show +failed: os_compute_api:os-server-password +failed: os_compute_api:os-server-tags:delete +failed: os_compute_api:os-server-tags:delete_all +passed: os_compute_api:os-server-tags:index +passed: os_compute_api:os-server-tags:show +failed: os_compute_api:os-server-tags:update +failed: os_compute_api:os-server-tags:update_all +passed: os_compute_api:os-server-usage +failed: os_compute_api:os-services +failed: os_compute_api:os-shelve:shelve +failed: os_compute_api:os-shelve:shelve_offload +failed: os_compute_api:os-shelve:unshelve +passed: os_compute_api:os-simple-tenant-usage:list +passed: os_compute_api:os-simple-tenant-usage:show +failed: os_compute_api:os-suspend-server:resume +failed: os_compute_api:os-suspend-server:suspend +failed: os_compute_api:os-tenant-networks +passed: os_compute_api:os-used-limits +failed: os_compute_api:os-volumes +failed: os_compute_api:os-volumes-attachments:create +failed: os_compute_api:os-volumes-attachments:delete +passed: os_compute_api:os-volumes-attachments:index +passed: os_compute_api:os-volumes-attachments:show +failed: os_compute_api:os-volumes-attachments:update +failed: os_compute_api:server-metadata:create +failed: os_compute_api:server-metadata:delete +passed: os_compute_api:server-metadata:index +passed: os_compute_api:server-metadata:show +failed: os_compute_api:server-metadata:update +failed: os_compute_api:server-metadata:update_all +failed: os_compute_api:servers:confirm_resize +failed: os_compute_api:servers:create +failed: os_compute_api:servers:create:attach_network +failed: os_compute_api:servers:create:attach_volume +failed: os_compute_api:servers:create:forced_host +failed: os_compute_api:servers:create_image +failed: os_compute_api:servers:create_image:allow_volume_backed +failed: os_compute_api:servers:create:trusted_certs +failed: os_compute_api:servers:create:zero_disk_flavor +failed: os_compute_api:servers:delete +passed: os_compute_api:servers:detail +passed: os_compute_api:servers:detail:get_all_tenants +passed: os_compute_api:servers:index +failed: os_compute_api:servers:index:get_all_tenants +failed: os_compute_api:servers:migrations:delete +failed: os_compute_api:servers:migrations:force_complete +passed: os_compute_api:servers:migrations:index +passed: os_compute_api:servers:migrations:show +failed: os_compute_api:servers:reboot +failed: os_compute_api:servers:rebuild +failed: os_compute_api:servers:rebuild:trusted_certs +failed: os_compute_api:servers:resize +failed: os_compute_api:servers:revert_resize +passed: os_compute_api:servers:show +passed: os_compute_api:servers:show:host_status +failed: os_compute_api:servers:start +failed: os_compute_api:servers:stop +failed: os_compute_api:servers:trigger_crash_dump +failed: os_compute_api:servers:update diff --git a/tests/auth_token_reader/panko.origin b/tests/auth_token_reader/panko.origin new file mode 100644 index 0000000..377b7c9 --- /dev/null +++ b/tests/auth_token_reader/panko.origin @@ -0,0 +1,2 @@ +passed: telemetry:events:index +passed: telemetry:events:show From 051d9556b006cdcb0edd094c07ba39c799173c04 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 16/26] Remove negative check for role The Deny_stack_yuser rule extends an antipattern. Since users can rop rules by creating a trust, it is trivially circumvented. Thus, it is not a rule that should be continued, and will make it difficult to merge the common portion of the policy files. --- diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index 4c20394..433cb5f 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -1,12 +1,10 @@ -# An additional rule that prevents users created via stack from creating additional stacks -"deny_stack_user": "(not role:heat_stack_user)" # A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader and rule:deny_stack_user)" +global_reader: "(role:global_reader)" # The specification for readers, who should only be able to read, never modify, data. # This rule incorporates other less strict reader specifications, so any reader -reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) and rule:deny_stack_user)" +reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) )" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" @@ -14,13 +12,13 @@ _member_role: "(role:Member or role:member or role:_member_)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud # as a whole -member: "((rule:_member_role and project_id:%(project_id)s) and rule:deny_stack_user)" +member: "((rule:_member_role and project_id:%(project_id)s) )" # This is the default admin specification, able to control every part of the cloud without issue -admin: "((is_admin:True or role:admin) and rule:deny_stack_user)" +admin: "((is_admin:True or role:admin) )" # This rule is specific for a user's own objects -owner: "((rule:_member_role and user_id:%(user_id)s) and rule:deny_stack_user)" +owner: "((rule:_member_role and user_id:%(user_id)s) )" # Decides what is required for the 'is_admin:True' check to succeed. "context_is_admin": "role:admin" From fe0dccafab99d61857bf0a4f13b6fc29f9334d99 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 17/26] merge reader roles into common header --- diff --git a/common/common.yaml b/common/common.yaml index 88f8ac6..26b5578 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -1 +1,8 @@ # COMMON + +# A global reader role, that is able to read things that don't have a project_id associated +global_reader: "(role:global_reader)" + +# The specification for readers, who should only be able to read, never modify, data. +# This rule incorporates other less strict reader specifications, so any reader +reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" diff --git a/services/aodh/policy.yaml b/services/aodh/policy.yaml index eeb4d55..a3109ac 100644 --- a/services/aodh/policy.yaml +++ b/services/aodh/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml index b7812e8..97c3559 100644 --- a/services/cinder/policy.yaml +++ b/services/cinder/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/glance/policy.yaml b/services/glance/policy.yaml index c9167c8..26d82eb 100644 --- a/services/glance/policy.yaml +++ b/services/glance/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/gnocchi/policy.yaml b/services/gnocchi/policy.yaml index 22a0fc3..62deb83 100644 --- a/services/gnocchi/policy.yaml +++ b/services/gnocchi/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" # For gnocchi, this also adds a check to who created the resource diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index 433cb5f..ca9e2b5 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -1,10 +1,4 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "(((role:reader and project_id:%(project_id)s) or rule:global_reader) )" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/keystone/policy.yaml b/services/keystone/policy.yaml index 5aba840..f93c141 100644 --- a/services/keystone/policy.yaml +++ b/services/keystone/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/manila/policy.yaml b/services/manila/policy.yaml index fa5bee5..f862e8c 100644 --- a/services/manila/policy.yaml +++ b/services/manila/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml index 604ab95..28d7093 100644 --- a/services/neutron/policy.yaml +++ b/services/neutron/policy.yaml @@ -1,11 +1,5 @@ # FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/nova/policy.yaml b/services/nova/policy.yaml index d83de2f..0353a8d 100644 --- a/services/nova/policy.yaml +++ b/services/nova/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" diff --git a/services/panko/policy.yaml b/services/panko/policy.yaml index 73c4a89..f77947c 100644 --- a/services/panko/policy.yaml +++ b/services/panko/policy.yaml @@ -1,9 +1,3 @@ -# A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" - -# The specification for readers, who should only be able to read, never modify, data. -# This rule incorporates other less strict reader specifications, so any reader -reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" From 6630d9e208ab319f3ac5fb28d3fe5d40c44b4f89 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 18/26] Merge admin into common header --- diff --git a/common/common.yaml b/common/common.yaml index 26b5578..9c20c40 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -6,3 +6,8 @@ global_reader: "(role:global_reader)" # The specification for readers, who should only be able to read, never modify, data. # This rule incorporates other less strict reader specifications, so any reader reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" + +# This is the default admin specification, able to control every part of the cloud without issue +admin: "(is_admin:True or role:admin)" + +# END COMMON diff --git a/services/aodh/policy.yaml b/services/aodh/policy.yaml index a3109ac..f8d608a 100644 --- a/services/aodh/policy.yaml +++ b/services/aodh/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml index 97c3559..b0315eb 100644 --- a/services/cinder/policy.yaml +++ b/services/cinder/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/glance/policy.yaml b/services/glance/policy.yaml index 26d82eb..4e84881 100644 --- a/services/glance/policy.yaml +++ b/services/glance/policy.yaml @@ -8,8 +8,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # We add here a check for if the image is public, allowing a member to use public images on the cloud member: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/gnocchi/policy.yaml b/services/gnocchi/policy.yaml index 62deb83..ca29133 100644 --- a/services/gnocchi/policy.yaml +++ b/services/gnocchi/policy.yaml @@ -9,8 +9,6 @@ _member_role: "(role:Member or role:member or role:_member_ or user:%(creator)s) # For gnocchi, this also adds a check for the resource to be part of the user's project member: "(rule:_member_role and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index ca9e2b5..bc317c1 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -8,8 +8,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "((rule:_member_role and project_id:%(project_id)s) )" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "((is_admin:True or role:admin) )" # This rule is specific for a user's own objects owner: "((rule:_member_role and user_id:%(user_id)s) )" diff --git a/services/keystone/policy.yaml b/services/keystone/policy.yaml index f93c141..b92e2d3 100644 --- a/services/keystone/policy.yaml +++ b/services/keystone/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/manila/policy.yaml b/services/manila/policy.yaml index f862e8c..99fdff5 100644 --- a/services/manila/policy.yaml +++ b/services/manila/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml index 28d7093..92f10c8 100644 --- a/services/neutron/policy.yaml +++ b/services/neutron/policy.yaml @@ -9,8 +9,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/nova/policy.yaml b/services/nova/policy.yaml index 0353a8d..91e3634 100644 --- a/services/nova/policy.yaml +++ b/services/nova/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/panko/policy.yaml b/services/panko/policy.yaml index f77947c..457cbee 100644 --- a/services/panko/policy.yaml +++ b/services/panko/policy.yaml @@ -7,8 +7,6 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" -# This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or rule:admin)" # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" From d265fd2f7ba4e0743ca76f08bc4265f1b90192af Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 19/26] Deconflict gnocci names with common Gnocci has rules that extend membership to also meaning the creator Since these rules previously conflicted with what the rest of the services defined as meaning membership, they have been changed to better reflect the addition of creator to access the resource. --- diff --git a/services/gnocchi/policy.yaml b/services/gnocchi/policy.yaml index ca29133..6e07b4c 100644 --- a/services/gnocchi/policy.yaml +++ b/services/gnocchi/policy.yaml @@ -1,53 +1,53 @@ # This is a helper role specification for members, since some deployers use "member", and some use "_member_" # For gnocchi, this also adds a check to who created the resource -_member_role: "(role:Member or role:member or role:_member_ or user:%(creator)s)" +_member_or_creator: "(role:Member or role:member or role:_member_ or user:%(creator)s)" # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud # as a whole # For gnocchi, this also adds a check for the resource to be part of the user's project -member: "(rule:_member_role and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" +member_or_creator: "(rule:_member_or_creator and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" # This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" +owner: "(rule:_member_or_creator and user_id:%(user_id)s)" # RULES: "get status": "rule:admin or rule:reader" -"create resource": "rule:admin or rule:member" -"get resource": "rule:admin or rule:member or rule:reader" -"update resource": "rule:admin or rule:member" -"delete resource": "rule:admin or rule:member" -"delete resources": "rule:admin or rule:member" -"list resource": "rule:admin or rule:member or rule:reader" -"search resource": "rule:admin or rule:member or rule:reader" +"create resource": "rule:admin or rule:member_or_creator" +"get resource": "rule:admin or rule:member_or_creator or rule:reader" +"update resource": "rule:admin or rule:member_or_creator" +"delete resource": "rule:admin or rule:member_or_creator" +"delete resources": "rule:admin or rule:member_or_creator" +"list resource": "rule:admin or rule:member_or_creator or rule:reader" +"search resource": "rule:admin or rule:member_or_creator or rule:reader" "create resource type": "rule:admin" "delete resource type": "rule:admin" "update resource type": "rule:admin" -"list resource type": "rule:admin or rule:member or rule:reader" -"get resource type": "rule:admin or rule:member or rule:reader" +"list resource type": "rule:admin or rule:member_or_creator or rule:reader" +"get resource type": "rule:admin or rule:member_or_creator or rule:reader" -"get archive policy": "rule:admin or rule:member or rule:reader" -"list archive policy": "rule:admin or rule:member or rule:reader" +"get archive policy": "rule:admin or rule:member_or_creator or rule:reader" +"list archive policy": "rule:admin or rule:member_or_creator or rule:reader" "create archive policy": "rule:admin" "update archive policy": "rule:admin" "delete archive policy": "rule:admin" "create archive policy rule": "rule:admin" -"get archive policy rule": "rule:admin or rule:member or rule:reader" -"list archive policy rule": "rule:admin or rule:member or rule:reader" +"get archive policy rule": "rule:admin or rule:member_or_creator or rule:reader" +"list archive policy rule": "rule:admin or rule:member_or_creator or rule:reader" "update archive policy rule": "rule:admin" "delete archive policy rule": "rule:admin" -"create metric": "rule:admin or rule:member" -"delete metric": "rule:admin or rule:member" -"get metric": "rule:admin or rule:member or rule:reader" -"search metric": "rule:admin or rule:member or rule:reader" -"list metric": "rule:admin or rule:member or rule:reader" +"create metric": "rule:admin or rule:member_or_creator" +"delete metric": "rule:admin or rule:member_or_creator" +"get metric": "rule:admin or rule:member_or_creator or rule:reader" +"search metric": "rule:admin or rule:member_or_creator or rule:reader" +"list metric": "rule:admin or rule:member_or_creator or rule:reader" -"get measures": "rule:admin or rule:member or rule:reader" -"post measures": "rule:admin or rule:member" +"get measures": "rule:admin or rule:member_or_creator or rule:reader" +"post measures": "rule:admin or rule:member_or_creator" From e2942251a897e64144fc2a5df6f8235abeb93bbf Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 20/26] Deconflict glance Member rule Glance adds an additional check to allow anyone access to to public resources. This rule name used to conflict with the remainder of the services. It has been adjusted to show this additional context. Pulls the member role up to the common header. --- diff --git a/common/common.yaml b/common/common.yaml index 9c20c40..67cfbde 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -10,4 +10,12 @@ reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is the default admin specification, able to control every part of the cloud without issue admin: "(is_admin:True or role:admin)" +# This is a helper role specification for members, since some deployers use "member", and some use "_member_" +_member_role: "(role:Member or role:member or role:_member_)" + +# This is the default member specification, implying that the user is a member of that +# project or domain, and has permission to modify objects inside it, but not on the cloud +# as a whole +member: "(rule:_member_role and project_id:%(project_id)s)" + # END COMMON diff --git a/services/aodh/policy.yaml b/services/aodh/policy.yaml index f8d608a..fd3cbd7 100644 --- a/services/aodh/policy.yaml +++ b/services/aodh/policy.yaml @@ -1,13 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml index b0315eb..84e894d 100644 --- a/services/cinder/policy.yaml +++ b/services/cinder/policy.yaml @@ -1,13 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/glance/policy.yaml b/services/glance/policy.yaml index 4e84881..deb7808 100644 --- a/services/glance/policy.yaml +++ b/services/glance/policy.yaml @@ -1,12 +1,9 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - # This is the default member specification, implying that the user is a member of that # project or domain, and has permission to modify objects inside it, but not on the cloud # as a whole # We add here a check for if the image is public, allowing a member to use public images on the cloud -member: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" +member_or_public: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" # This rule is specific for a user's own objects @@ -17,77 +14,77 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" # GET /v1/images # GET /v1/images/detail # GET /v2/images -"get_images": "rule:admin or rule:member or rule:reader" +"get_images": "rule:admin or rule:member_or_public or rule:reader" # Retrieve a specific image entity # HEAD /v1/images/ # GET /v1/images/ # GET /v2/images/ -"get_image": "rule:admin or rule:member or rule:reader" +"get_image": "rule:admin or rule:member_or_public or rule:reader" # Download binary image data # GET /v1/images/ # GET /v2/images//file -"download_image": "rule:admin or rule:member or rule:reader" +"download_image": "rule:admin or rule:member_or_public or rule:reader" # Upload binary image data # POST /v1/images # PUT /v1/images/ # PUT /v2/images//file -"upload_image": "rule:admin or rule:member" +"upload_image": "rule:admin or rule:member_or_public" # Copy binary image data from URL # POST /v1/images # PUT /v1/images/ -"copy_from": "rule:admin or rule:member" +"copy_from": "rule:admin or rule:member_or_public" # Create an image entity # POST /v1/images # POST /v2/images -"add_image": "rule:admin or rule:member" +"add_image": "rule:admin or rule:member_or_public" # Update an image entity # PUT /v1/images/ # PUT /v2/images/ -"modify_image": "rule:admin or rule:member" +"modify_image": "rule:admin or rule:member_or_public" # Create or update public images # POST /v1/images with attribute is_public = true # PUT /v1/images/ with attribute is_public = true # POST /v2/images with attribute visibility = public # PUT /v2/images/ with attribute visibility = public -"publicize_image": "rule:admin or rule:member" +"publicize_image": "rule:admin or rule:member_or_public" # Create or update community images # POST /v2/images with attribute visibility = community # PUT /v2/images/ with attribute visibility = community -"communitize_image": "rule:admin or rule:member" +"communitize_image": "rule:admin or rule:member_or_public" # Delete an image entity and associated binary data # DELETE /v1/images/ # DELETE /v2/images/ -"delete_image": "rule:admin or rule:member" +"delete_image": "rule:admin or rule:member_or_public" # Add a membership to the member repo of an image # POST /v2/images//members -"add_member": "rule:admin or rule:member" +"add_member": "rule:admin or rule:member_or_public" # List the members of an image # GET /v1/images//members # GET /v2/images//members -"get_members": "rule:admin or rule:member or rule:reader" +"get_members": "rule:admin or rule:member_or_public or rule:reader" # Delete a membership of an image # DELETE /v1/images//members/ # DELETE /v2/images//members/ -"delete_member": "rule:admin or rule:member" +"delete_member": "rule:admin or rule:member_or_public" # Create or update the membership of an image # PUT /v1/images//members/ # PUT /v1/images//members # POST /v2/images//members # PUT /v2/images//members/ -"modify_member": "rule:admin or rule:member" +"modify_member": "rule:admin or rule:member_or_public" # Allowed to use the image cache management API -"manage_image_cache": "rule:admin or rule:member" +"manage_image_cache": "rule:admin or rule:member_or_public" diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index bc317c1..f391941 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -1,14 +1,4 @@ - -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "((rule:_member_role and project_id:%(project_id)s) )" - - # This rule is specific for a user's own objects owner: "((rule:_member_role and user_id:%(user_id)s) )" diff --git a/services/keystone/policy.yaml b/services/keystone/policy.yaml index b92e2d3..568c4ad 100644 --- a/services/keystone/policy.yaml +++ b/services/keystone/policy.yaml @@ -1,13 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/manila/policy.yaml b/services/manila/policy.yaml index 99fdff5..6c99499 100644 --- a/services/manila/policy.yaml +++ b/services/manila/policy.yaml @@ -1,12 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml index 92f10c8..934d0f6 100644 --- a/services/neutron/policy.yaml +++ b/services/neutron/policy.yaml @@ -1,15 +1,6 @@ # FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/nova/policy.yaml b/services/nova/policy.yaml index 91e3634..b9d2bc5 100644 --- a/services/nova/policy.yaml +++ b/services/nova/policy.yaml @@ -1,13 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" diff --git a/services/panko/policy.yaml b/services/panko/policy.yaml index 457cbee..cdad18e 100644 --- a/services/panko/policy.yaml +++ b/services/panko/policy.yaml @@ -1,13 +1,4 @@ -# This is a helper role specification for members, since some deployers use "member", and some use "_member_" -_member_role: "(role:Member or role:member or role:_member_)" - -# This is the default member specification, implying that the user is a member of that -# project or domain, and has permission to modify objects inside it, but not on the cloud -# as a whole -member: "(rule:_member_role and project_id:%(project_id)s)" - - # This rule is specific for a user's own objects owner: "(rule:_member_role and user_id:%(user_id)s)" From acc43cd95b133babcb7d409628fbce8a76407978 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 21/26] pull owner, service_role and token_subject to common header --- diff --git a/common/common.yaml b/common/common.yaml index 67cfbde..0bbb075 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -18,4 +18,14 @@ _member_role: "(role:Member or role:member or role:_member_)" # as a whole member: "(rule:_member_role and project_id:%(project_id)s)" +# This rule is specific for a user's own objects +owner: "(rule:_member_role and user_id:%(user_id)s)" + +# The role used by openstack services +"service_role": "(role:service)" + +# +"token_subject": "user_id:%(target.token.user_id)s" + + # END COMMON diff --git a/services/aodh/policy.yaml b/services/aodh/policy.yaml index fd3cbd7..58b6977 100644 --- a/services/aodh/policy.yaml +++ b/services/aodh/policy.yaml @@ -1,7 +1,4 @@ -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - # RULES: # Get an alarm. diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml index 84e894d..0d3680b 100644 --- a/services/cinder/policy.yaml +++ b/services/cinder/policy.yaml @@ -1,7 +1,4 @@ -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - # Decides what is required for the 'is_admin:True' check to succeed. # "context_is_admin": "role:admin" diff --git a/services/gnocchi/policy.yaml b/services/gnocchi/policy.yaml index 6e07b4c..50166bb 100644 --- a/services/gnocchi/policy.yaml +++ b/services/gnocchi/policy.yaml @@ -9,10 +9,6 @@ _member_or_creator: "(role:Member or role:member or role:_member_ or user:%(crea # For gnocchi, this also adds a check for the resource to be part of the user's project member_or_creator: "(rule:_member_or_creator and (project_id:%(project_id)s or project_id:%(resource.project_id)s))" - -# This rule is specific for a user's own objects -owner: "(rule:_member_or_creator and user_id:%(user_id)s)" - # RULES: "get status": "rule:admin or rule:reader" diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index f391941..e659083 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -1,7 +1,4 @@ -# This rule is specific for a user's own objects -owner: "((rule:_member_role and user_id:%(user_id)s) )" - # Decides what is required for the 'is_admin:True' check to succeed. "context_is_admin": "role:admin" diff --git a/services/keystone/policy.yaml b/services/keystone/policy.yaml index 568c4ad..9d4f574 100644 --- a/services/keystone/policy.yaml +++ b/services/keystone/policy.yaml @@ -1,13 +1,4 @@ -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - -# The role used by openstack services -"service_role": "(role:service)" - -# -"token_subject": "user_id:%(target.token.user_id)s" - # RULES: # Show application credential details. diff --git a/services/manila/policy.yaml b/services/manila/policy.yaml index 6c99499..2369015 100644 --- a/services/manila/policy.yaml +++ b/services/manila/policy.yaml @@ -1,8 +1,4 @@ - -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - "default": "rule:admin or rule:member" ### Policy Rules defined in manila.policies.availability_zone diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml index 934d0f6..e110ead 100644 --- a/services/neutron/policy.yaml +++ b/services/neutron/policy.yaml @@ -1,9 +1,6 @@ # FIXME: Neutron doesn't support policy.yaml format as of OSP13, just JSON -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - "context_is_advsvc": "role:advsvc" "network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)" "admin_or_data_plane_int": "rule:admin or role:data_plane_integrator" diff --git a/services/nova/policy.yaml b/services/nova/policy.yaml index b9d2bc5..aa87829 100644 --- a/services/nova/policy.yaml +++ b/services/nova/policy.yaml @@ -1,7 +1,4 @@ -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - # RULES: # Reset the state of a given server diff --git a/services/panko/policy.yaml b/services/panko/policy.yaml index cdad18e..d74ca7b 100644 --- a/services/panko/policy.yaml +++ b/services/panko/policy.yaml @@ -1,8 +1,4 @@ -# This rule is specific for a user's own objects -owner: "(rule:_member_role and user_id:%(user_id)s)" - - ### Policy Rules defined in panko.policies.segregation # Return the user and project the requestshould be limited to From 6b4ad103544c9934a635bededd8ee396cbf41cf1 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 22/26] Pull context_is_admin to common header --- diff --git a/common/common.yaml b/common/common.yaml index 0bbb075..b3529ce 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -28,4 +28,8 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" "token_subject": "user_id:%(target.token.user_id)s" +# Decides what is required for the 'is_admin:True' check to succeed. +"context_is_admin": "role:admin" + + # END COMMON diff --git a/services/cinder/policy.yaml b/services/cinder/policy.yaml index 0d3680b..e1d3ba3 100644 --- a/services/cinder/policy.yaml +++ b/services/cinder/policy.yaml @@ -1,7 +1,4 @@ -# Decides what is required for the 'is_admin:True' check to succeed. -# "context_is_admin": "role:admin" - # RULES diff --git a/services/heat/policy.yaml b/services/heat/policy.yaml index e659083..45eed23 100644 --- a/services/heat/policy.yaml +++ b/services/heat/policy.yaml @@ -1,7 +1,4 @@ -# Decides what is required for the 'is_admin:True' check to succeed. -"context_is_admin": "role:admin" - ### Policy Rules defined in heat.policies.base # Default rule for deny everybody. diff --git a/services/neutron/policy.yaml b/services/neutron/policy.yaml index e110ead..d30245c 100644 --- a/services/neutron/policy.yaml +++ b/services/neutron/policy.yaml @@ -9,7 +9,6 @@ "shared_address_scopes": "field:address_scopes:shared=True" "external": "field:networks:router:external=True" -# "context_is_admin": "role:admin" # "owner": "tenant_id:%(tenant_id)s" # "admin_or_owner": "rule:context_is_admin or rule:owner" # "admin_or_network_owner": "rule:context_is_admin or tenant_id:%(network:tenant_id)s" From 515005c324872622eefec0e2e2adadd3ee4550ca Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 23/26] use is_admin_project --- diff --git a/common/common.yaml b/common/common.yaml index b3529ce..9a38aa8 100644 --- a/common/common.yaml +++ b/common/common.yaml @@ -1,14 +1,14 @@ # COMMON # A global reader role, that is able to read things that don't have a project_id associated -global_reader: "(role:global_reader)" +global_reader: "(role:global_reader and is_admin_project:True)" # The specification for readers, who should only be able to read, never modify, data. # This rule incorporates other less strict reader specifications, so any reader reader: "((role:reader and project_id:%(project_id)s) or rule:global_reader)" # This is the default admin specification, able to control every part of the cloud without issue -admin: "(is_admin:True or role:admin)" +admin: "(is_admin:True or role:admin and (is_admin_project:True or project_id:%(project_id)s))" # This is a helper role specification for members, since some deployers use "member", and some use "_member_" _member_role: "(role:Member or role:member or role:_member_)" @@ -29,7 +29,7 @@ owner: "(rule:_member_role and user_id:%(user_id)s)" # Decides what is required for the 'is_admin:True' check to succeed. -"context_is_admin": "role:admin" +"context_is_admin": "role:admin and (is_admin_project:True or project_id:%(project_id)s)" # END COMMON diff --git a/services/neutron/policy.json b/services/neutron/policy.json index e867e5a..b0b5601 100644 --- a/services/neutron/policy.json +++ b/services/neutron/policy.json @@ -1,9 +1,9 @@ { - "global_reader": "(role:global_reader)", + "global_reader": "(role:global_reader and is_admin_project:True )", "reader": "((role:reader and project_id:%(project_id)s) or rule:global_reader)", - "_member_role": "(role:Member or role:member or role:_member_)", + "_member_role": "(role:Member or role:member or role:_member_ and project_id:%(project_id)s)", "member": "(rule:_member_role and project_id:%(project_id)s)", - "admin": "(is_admin:True or role:admin)", + "admin": "(is_admin:True or role:admin and (is_admin_project:True or project_id:%(project_id)s)", "owner": "(rule:_member_role and user_id:%(user_id)s)", "context_is_advsvc": "role:advsvc", "network_owner": "(rule:_member_role and tenant_id:%(network:tenant_id)s)", From 5519c904979f79aada397e0aafd490f0c00bf97d Mon Sep 17 00:00:00 2001 From: Adam Young Date: Oct 18 2018 22:48:48 +0000 Subject: [PATCH 24/26] Ignore current files --- diff --git a/.gitignore b/.gitignore index 1ba70ed..10cc2d0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ build/* -*~ \ No newline at end of file +*~ +*current From a590f3bfb5b935125a819322994408e2a8a93063 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Nov 16 2018 15:25:13 +0000 Subject: [PATCH 25/26] call test functions from top level scripts create a script to update test data generate the policy files and then test or update --- diff --git a/build.sh b/build.sh index 40026c8..c0dd79e 100755 --- a/build.sh +++ b/build.sh @@ -1,10 +1,6 @@ #!/bin/sh -mkdir -p build/etc +. tests/functions -for SUBDIR in $( ls services) -do - mkdir -p build/etc/$SUBDIR - cat common/common.yaml > build/etc/$SUBDIR/policy.yaml - cat services/$SUBDIR/policy.yaml >> build/etc/$SUBDIR/policy.yaml -done +build_policy +run_policy_current diff --git a/tests/functions b/tests/functions index 1c6d589..4426985 100755 --- a/tests/functions +++ b/tests/functions @@ -1,39 +1,61 @@ - - - +build_policy(){ + REPO_DIR=/opt/stack/openstack-access-policy + mkdir -p $REPO_DIR/build/etc + for SUBDIR in $( ls $REPO_DIR/services) + do + mkdir -p $REPO_DIR/build/etc/$SUBDIR + cat $REPO_DIR/common/common.yaml > $REPO_DIR/build/etc/$SUBDIR/policy.yaml + cat $REPO_DIR/services/$SUBDIR/policy.yaml >> $REPO_DIR/build/etc/$SUBDIR/policy.yaml +done +} update_policy_origin(){ + for ACCESS in $( list_tokens ) do - for SERVICE in $( ls ../build/etc/ ) - do oslopolicy-checker --policy ../build/etc/$SERVICE/policy.yaml \ - --access $ACCESS/access.json | sort -k 2 \ - > $ACCESS/$SERVICE.origin ; + for SERVICE in $( ls $REPO_DIR/build/etc/ ) + do oslopolicy-checker \ + --policy $REPO_DIR/build/etc/$SERVICE/policy.yaml \ + --access $REPO_DIR/tests/$ACCESS/access.json | sort -k 2 \ + > $REPO_DIR/tests/$ACCESS/$SERVICE.origin ; done done } run_policy_current(){ + REPO_DIR=/opt/stack/openstack-access-policy + for ACCESS in $( list_tokens ) do - for SERVICE in $( ls ../build/etc/ ) - do oslopolicy-checker --policy ../build/etc/$SERVICE/policy.yaml \ - --access $ACCESS/access.json | sort -k 2\ - > $ACCESS/$SERVICE.current; + for SERVICE in $( ls $REPO_DIR/build/etc/ ) + do + echo testing $SERVICE with $ACCESS + oslopolicy-checker \ + --policy $REPO_DIR/build/etc/$SERVICE/policy.yaml \ + --access $REPO_DIR/tests/$ACCESS/access.json | sort -k 2\ + > $REPO_DIR/tests/$ACCESS/$SERVICE.current; + diff -ud \ + $REPO_DIR/tests/$ACCESS/$SERVICE.origin \ + $REPO_DIR/tests/$ACCESS/$SERVICE.current; + done done } show_diff(){ + REPO_DIR=/opt/stack/openstack-access-policy + for ACCESS in $( list_tokens ) do - for SERVICE in $( ls ../build/etc/ ) + for SERVICE in $( ls $REPO_DIR/build/etc/ ) do - diff -ud $ACCESS/$SERVICE.origin $ACCESS/$SERVICE.current; + diff -ud \ + $REPO_DIR/tests/$ACCESS/$SERVICE.origin \ + $REPO_DIR/tests/$ACCESS/$SERVICE.current; done done } list_tokens(){ -echo auth_token_admin auth_token_member auth_token_reader + echo auth_token_admin auth_token_member auth_token_reader } diff --git a/update_test_data.sh b/update_test_data.sh new file mode 100755 index 0000000..67331b5 --- /dev/null +++ b/update_test_data.sh @@ -0,0 +1,4 @@ +. tests/functions + +build_policy +update_policy_origin From cce1076cc57f826b06fc37790dcd25d2da0dca66 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Nov 16 2018 15:26:06 +0000 Subject: [PATCH 26/26] removed duplicate or from glance --- diff --git a/services/glance/policy.yaml b/services/glance/policy.yaml index deb7808..01b826e 100644 --- a/services/glance/policy.yaml +++ b/services/glance/policy.yaml @@ -3,7 +3,7 @@ # project or domain, and has permission to modify objects inside it, but not on the cloud # as a whole # We add here a check for if the image is public, allowing a member to use public images on the cloud -member_or_public: "(rule:_member_role and (project_id:%(project_id)s or or True:%(is_public)s))" +member_or_public: "(rule:_member_role and (project_id:%(project_id)s or True:%(is_public)s))" # This rule is specific for a user's own objects