Policy Documentation¶
The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.
designate¶
admin
Default: role:admin or is_admin:True
(no description provided)
primary_zone
Default: target.zone_type:SECONDARY
(no description provided)
owner
Default: tenant:%(tenant_id)s
(no description provided)
admin_or_owner
Default: rule:admin or rule:owner
(no description provided)
default
Default: rule:admin_or_owner
(no description provided)
target
Default: tenant:%(target_tenant_id)s
(no description provided)
owner_or_target
Default: rule:target or rule:owner
(no description provided)
admin_or_owner_or_target
Default: rule:owner_or_target or rule:admin
(no description provided)
admin_or_target
Default: rule:admin or rule:target
(no description provided)
zone_primary_or_admin
Default: ('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
(no description provided)
create_blacklist
Default: rule:admin
Operations: - POST
/v2/blacklists
Create blacklist.
- POST
find_blacklist
Default: rule:admin
Operations: - GET
/v2/blacklists
Find blacklist.
- GET
find_blacklists
Default: rule:admin
Operations: - GET
/v2/blacklists
Find blacklists.
- GET
get_blacklist
Default: rule:admin
Operations: - GET
/v2/blacklists/{blacklist_id}
Get blacklist.
- GET
update_blacklist
Default: rule:admin
Operations: - PATCH
/v2/blacklists/{blacklist_id}
Update blacklist.
- PATCH
delete_blacklist
Default: rule:admin
Operations: - DELETE
/v2/blacklists/{blacklist_id}
Delete blacklist.
- DELETE
use_blacklisted_zone
Default: rule:admin
Operations: - POST
/v2/zones
Allowed bypass the blacklist.
- POST
all_tenants
Default: rule:admin
Action on all tenants.
edit_managed_records
Default: rule:admin
Edit managed records.
use_low_ttl
Default: rule:admin
Use low TTL.
use_sudo
Default: rule:admin
Accept sudo from user to tenant.
diagnostics_ping
Default: rule:admin
Diagnose ping.
diagnostics_sync_zones
Default: rule:admin
Diagnose sync zones.
diagnostics_sync_zone
Default: rule:admin
Diagnose sync zone.
diagnostics_sync_record
Default: rule:admin
Diagnose sync record.
create_pool
Default: rule:admin
Create pool.
find_pools
Default: rule:admin
Operations: - GET
/v2/pools
Find pool.
- GET
find_pool
Default: rule:admin
Operations: - GET
/v2/pools
Find pools.
- GET
get_pool
Default: rule:admin
Operations: - GET
/v2/pools/{pool_id}
Get pool.
- GET
update_pool
Default: rule:admin
Update pool.
delete_pool
Default: rule:admin
Delete pool.
zone_create_forced_pool
Default: rule:admin
Operations: - POST
/v2/zones
load and set the pool to the one provided in the Zone attributes.
- POST
get_quotas
Default: rule:admin_or_owner
Operations: - GET
/v2/quotas
View Current Project’s Quotas.
- GET
get_quota
Default: rule:admin_or_owner
(no description provided)
set_quota
Default: rule:admin
Operations: - PATCH
/v2/quotas/{project_id}
Set Quotas.
- PATCH
reset_quotas
Default: rule:admin
Operations: - DELETE
/v2/quotas/{project_id}
Reset Quotas.
- DELETE
find_records
Default: rule:admin_or_owner
Operations: - GET
/v2/reverse/floatingips/{region}:{floatingip_id}
- GET
/v2/reverse/floatingips
Find records.
- GET
count_records
Default: rule:admin_or_owner
(no description provided)
create_recordset
Default: ('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations: - POST
/v2/zones/{zone_id}/recordsets
- PATCH
/v2/reverse/floatingips/{region}:{floatingip_id}
Create Recordset
- POST
get_recordsets
Default: rule:admin_or_owner
(no description provided)
get_recordset
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/{zone_id}/recordsets/{recordset_id}
- DELETE
/v2/zones/{zone_id}/recordsets/{recordset_id}
- PUT
/v2/zones/{zone_id}/recordsets/{recordset_id}
Get recordset
- GET
update_recordset
Default: ('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations: - PUT
/v2/zones/{zone_id}/recordsets/{recordset_id}
- PATCH
/v2/reverse/floatingips/{region}:{floatingip_id}
Update recordset
- PUT
delete_recordset
Default: ('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
Operations: - DELETE
/v2/zones/{zone_id}/recordsets/{recordset_id}
Delete RecordSet
- DELETE
count_recordset
Default: rule:admin_or_owner
Count recordsets
find_service_status
Default: rule:admin
Operations: - GET
/v2/service_status/{service_id}
Find a single Service Status
- GET
find_service_statuses
Default: rule:admin
Operations: - GET
/v2/service_status
List service statuses.
- GET
update_service_status
Default: rule:admin
(no description provided)
find_tenants
Default: rule:admin
Find all Tenants.
get_tenant
Default: rule:admin
Get all Tenants.
count_tenants
Default: rule:admin
Count tenants
create_tld
Default: rule:admin
Operations: - POST
/v2/tlds
Create Tld
- POST
find_tlds
Default: rule:admin
Operations: - GET
/v2/tlds
List Tlds
- GET
get_tld
Default: rule:admin
Operations: - GET
/v2/tlds/{tld_id}
Show Tld
- GET
update_tld
Default: rule:admin
Operations: - PATCH
/v2/tlds/{tld_id}
Update Tld
- PATCH
delete_tld
Default: rule:admin
Operations: - DELETE
/v2/tlds/{tld_id}
Delete Tld
- DELETE
create_tsigkey
Default: rule:admin
Operations: - POST
/v2/tsigkeys
Create Tsigkey
- POST
find_tsigkeys
Default: rule:admin
Operations: - GET
/v2/tsigkeys
List Tsigkeys
- GET
get_tsigkey
Default: rule:admin
Operations: - PATCH
/v2/tsigkeys/{tsigkey_id}
- GET
/v2/tsigkeys/{tsigkey_id}
Show a Tsigkey
- PATCH
update_tsigkey
Default: rule:admin
Operations: - PATCH
/v2/tsigkeys/{tsigkey_id}
Update Tsigkey
- PATCH
delete_tsigkey
Default: rule:admin
Operations: - DELETE
/v2/tsigkeys/{tsigkey_id}
Delete a Tsigkey
- DELETE
create_zone
Default: rule:admin_or_owner
Operations: - POST
/v2/zones
Create Zone
- POST
get_zones
Default: rule:admin_or_owner
(no description provided)
get_zone
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/{zone_id}
- PATCH
/v2/zones/{zone_id}
- PUT
/v2/zones/{zone_id}/recordsets/{recordset_id}
Get Zone
- GET
get_zone_servers
Default: rule:admin_or_owner
(no description provided)
find_zones
Default: rule:admin_or_owner
Operations: - GET
/v2/zones
List existing zones
- GET
update_zone
Default: rule:admin_or_owner
Operations: - PATCH
/v2/zones/{zone_id}
Update Zone
- PATCH
delete_zone
Default: rule:admin_or_owner
Operations: - DELETE
/v2/zones/{zone_id}
Delete Zone
- DELETE
xfr_zone
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/{zone_id}/tasks/xfr
Manually Trigger an Update of a Secondary Zone
- POST
abandon_zone
Default: rule:admin
Operations: - POST
/v2/zones/{zone_id}/tasks/abandon
Abandon Zone
- POST
count_zones
Default: rule:admin_or_owner
(no description provided)
count_zones_pending_notify
Default: rule:admin_or_owner
(no description provided)
purge_zones
Default: rule:admin
(no description provided)
touch_zone
Default: rule:admin_or_owner
(no description provided)
zone_export
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/exports/{zone_export_id}/export
Retrive a Zone Export from the Designate Datastore
- GET
create_zone_export
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/{zone_id}/tasks/export
Create Zone Export
- POST
find_zone_exports
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/exports
List Zone Exports
- GET
get_zone_export
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/exports/{zone_export_id}
- GET
/v2/zones/tasks/exports/{zone_export_id}/export
Get Zone Exports
- GET
update_zone_export
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/{zone_id}/tasks/export
Update Zone Exports
- POST
create_zone_import
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/tasks/imports
Create Zone Import
- POST
find_zone_imports
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/imports
List all Zone Imports
- GET
get_zone_import
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/imports/{zone_import_id}
Get Zone Imports
- GET
update_zone_import
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/tasks/imports
Update Zone Imports
- POST
delete_zone_import
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/imports/{zone_import_id}
Delete a Zone Import
- GET
create_zone_transfer_accept
Default: rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
Operations: - POST
/v2/zones/tasks/transfer_accepts
Create Zone Transfer Accept
- POST
get_zone_transfer_accept
Default: rule:admin_or_owner
Operations: - GET
/v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}
Get Zone Transfer Accept
- GET
find_zone_transfer_accepts
Default: rule:admin
Operations: - GET
/v2/zones/tasks/transfer_accepts
List Zone Transfer Accepts
- GET
find_zone_transfer_accept
Default: rule:admin
(no description provided)
update_zone_transfer_accept
Default: rule:admin
Operations: - POST
/v2/zones/tasks/transfer_accepts
Update a Zone Transfer Accept
- POST
delete_zone_transfer_accept
Default: rule:admin
(no description provided)
create_zone_transfer_request
Default: rule:admin_or_owner
Operations: - POST
/v2/zones/{zone_id}/tasks/transfer_requests
Create Zone Transfer Accept
- POST
get_zone_transfer_request
Default: rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
Operations: - GET
/v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
- PATCH
/v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
Show a Zone Transfer Request
- GET
get_zone_transfer_request_detailed
Default: rule:admin_or_owner
(no description provided)
find_zone_transfer_requests
Default: @
Operations: - GET
/v2/zones/tasks/transfer_requests
List Zone Transfer Requests
- GET
find_zone_transfer_request
Default: @
(no description provided)
update_zone_transfer_request
Default: rule:admin_or_owner
Operations: - PATCH
/v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
Update a Zone Transfer Request
- PATCH
delete_zone_transfer_request
Default: rule:admin_or_owner
Operations: - DELETE
/v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
Delete a Zone Transfer Request
- DELETE