policy.yaml¶
Use the policy.yaml
file to define additional access controls that apply to
the Rating service:
#"context_is_admin": "role:admin"
# DEPRECATED
# "admin_or_owner" has been deprecated since 22.0.0.
# CloudKitty API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in future release.
#"admin_or_owner": "is_admin:True or (role:admin and is_admin_project:True) or project_id:%(project_id)s"
#"default": ""
# Default rule for Project level non admin APIs.
#"project_member_api": "role:member and project_id:%(project_id)s"
# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or (role:admin and
# is_admin_project:True) or project_id:%(project_id)s" has been
# deprecated since 22.0.0 in favor of
# "project_member_api":"role:member and project_id:%(project_id)s".
# CloudKitty API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in future release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_member_api"
# Default rule for Project level read only APIs.
#"project_reader_api": "role:reader and project_id:%(project_id)s"
# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or (role:admin and
# is_admin_project:True) or project_id:%(project_id)s" has been
# deprecated since 22.0.0 in favor of
# "project_reader_api":"role:reader and project_id:%(project_id)s".
# CloudKitty API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in future release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_reader_api"
# Default rule for Project Member or admin APIs.
#"project_member_or_admin": "rule:project_member_api or rule:context_is_admin"
# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or (role:admin and
# is_admin_project:True) or project_id:%(project_id)s" has been
# deprecated since 22.0.0 in favor of
# "project_member_or_admin":"rule:project_member_api or
# rule:context_is_admin".
# CloudKitty API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in future release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_member_or_admin"
# Default rule for Project reader or admin APIs.
#"project_reader_or_admin": "rule:project_reader_api or rule:context_is_admin"
# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or (role:admin and
# is_admin_project:True) or project_id:%(project_id)s" has been
# deprecated since 22.0.0 in favor of
# "project_reader_or_admin":"rule:project_reader_api or
# rule:context_is_admin".
# CloudKitty API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in future release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_reader_or_admin"
# Return the list of every services mapped to a collector.
# LIST /v1/collector/mappings
# Intended scope(s): project
#"collector:list_mappings": "role:admin"
# Return a service to collector mapping.
# GET /v1/collector/mappings/{service_id}
# Intended scope(s): project
#"collector:get_mapping": "role:admin"
# Manage a service to collector mapping.
# POST /v1/collector/mappings
# DELETE /v1/collector/mappings/{service_id}
# Intended scope(s): project
#"collector:manage_mapping": "role:admin"
# Query the enable state of a collector.
# GET /v1/collector/states/{collector_id}
# Intended scope(s): project
#"collector:get_state": "role:admin"
# Set the enable state of a collector.
# PUT /v1/collector/states/{collector_id}
# Intended scope(s): project
#"collector:update_state": "role:admin"
# List available services information in Cloudkitty.
# LIST /v1/info/services
# Intended scope(s): project
#"info:list_services_info": ""
# Get specified service information.
# GET /v1/info/services/{metric_id}
# Intended scope(s): project
#"info:get_service_info": ""
# List available metrics information in Cloudkitty.
# LIST /v1/info/metrics
# Intended scope(s): project
#"info:list_metrics_info": ""
# Get specified metric information.
# GET /v1/info/metrics/{metric_id}
# Intended scope(s): project
#"info:get_metric_info": ""
# Get current configuration in Cloudkitty.
# GET /v1/info/config
# Intended scope(s): project
#"info:get_config": ""
# Return the list of loaded modules in Cloudkitty.
# LIST /v1/rating/modules
# Intended scope(s): project
#"rating:list_modules": "role:admin"
# Get specified module.
# GET /v1/rating/modules/{module_id}
# Intended scope(s): project
#"rating:get_module": "role:admin"
# Change the state and priority of a module.
# PUT /v1/rating/modules/{module_id}
# Intended scope(s): project
#"rating:update_module": "role:admin"
# Get an instant quote based on multiple resource descriptions.
# POST /v1/rating/quote
# Intended scope(s): project
#"rating:quote": ""
# Trigger a rating module list reload.
# GET /v1/rating/reload_modules
# Intended scope(s): project
#"rating:module_config": "role:admin"
# Return the list of rated tenants.
# GET /v1/report/tenants
# Intended scope(s): project
#"report:list_tenants": "role:admin"
# Return the summary to pay for a given period.
# GET /v1/report/summary
# Intended scope(s): project
#"report:get_summary": "rule:project_reader_or_admin"
# Return the amount to pay for a given period.
# GET /v1/report/total
# Intended scope(s): project
#"report:get_total": "rule:project_reader_or_admin"
# Return a list of rated resources for a time period and a tenant.
# GET /v1/storage/dataframes
# Intended scope(s): project
#"storage:list_data_frames": "rule:project_reader_or_admin"
# Add one or several DataFrames
# POST /v2/dataframes
# Intended scope(s): project
#"dataframes:add": "role:admin"
# Get DataFrames
# GET /v2/dataframes
# Intended scope(s): project
#"dataframes:get": "rule:project_reader_or_admin"
# Returns the list of loaded modules in Cloudkitty.
# GET /v2/rating/modules
# Intended scope(s): project
#"v2_rating:list_modules": "role:admin"
# Get specified module.
# GET /v2/rating/modules/{module_id}
# Intended scope(s): project
#"v2_rating:get_module": "role:admin"
# Change the state and priority of a module.
# PUT /v2/rating/modules/{module_id}
# Intended scope(s): project
#"v2_rating:update_module": "role:admin"
# Get the state of one or several scopes
# GET /v2/scope
# Intended scope(s): project
#"scope:get_state": "role:admin"
# Reset the state of one or several scopes
# PUT /v2/scope
# Intended scope(s): project
#"scope:reset_state": "role:admin"
# Enables operators to patch a storage scope
# PATCH /v2/scope
# Intended scope(s): project
#"scope:patch_state": "role:admin"
# Enables operators to create a storage scope
# POST /v2/scope
# Intended scope(s): project
#"scope:post_state": "role:admin"
# Get a rating summary
# GET /v2/summary
# Intended scope(s): project
#"summary:get_summary": "rule:project_reader_or_admin"
# Schedule a scope for reprocessing
# POST /v2/task/reprocesses
# Intended scope(s): project
#"schedule:task_reprocesses": "role:admin"
# Get reprocessing schedule tasks for scopes.
# GET /v2/task/reprocesses
# Intended scope(s): project
#"schedule:get_task_reprocesses": "role:admin"