Policy configuration¶

cinder¶

admin_or_owner

Default:

is_admin:True or (role:admin and is_admin_project:True) or project_id:%(project_id)s

DEPRECATED: This rule will be removed in the Yoga release. Default rule for most non-Admin APIs.

system_or_domain_or_project_admin

Default:

(role:admin and system_scope:all) or (role:admin and domain_id:%(domain_id)s) or (role:admin and project_id:%(project_id)s)

DEPRECATED: This rule will be removed in the Yoga release. Default rule for admins of cloud, domain or a project.

context_is_admin

Default:

role:admin

Decides what is required for the ‘is_admin:True’ check to succeed.

admin_api

Default:

is_admin:True or (role:admin and is_admin_project:True)

Default rule for most Admin APIs.

xena_system_admin_or_project_reader

Default:

(role:admin) or (role:reader and project_id:%(project_id)s)

NOTE: this purely role-based rule recognizes only project scope

xena_system_admin_or_project_member

Default:

(role:admin) or (role:member and project_id:%(project_id)s)

NOTE: this purely role-based rule recognizes only project scope

volume:attachment_create

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /attachments

Create attachment.

volume:attachment_update

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /attachments/{attachment_id}

Update attachment.

volume:attachment_delete

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /attachments/{attachment_id}

Delete attachment.

volume:attachment_complete

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /attachments/{attachment_id}/action (os-complete)

Mark a volume attachment process as completed (in-use)

volume:multiattach_bootable_volume

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /attachments

Allow multiattach of bootable volumes.

message:get_all

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /messages

List messages.

message:get

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /messages/{message_id}

Show message.

message:delete

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /messages/{message_id}

Delete message.

clusters:get_all

Default:

rule:admin_api

Operations:

• GET /clusters

• GET /clusters/detail

List clusters.

clusters:get

Default:

rule:admin_api

Operations:

• GET /clusters/{cluster_id}

Show cluster.

clusters:update

Default:

rule:admin_api

Operations:

• PUT /clusters/{cluster_id}

Update cluster.

workers:cleanup

Default:

rule:admin_api

Operations:

• POST /workers/cleanup

Clean up workers.

volume:get_snapshot_metadata

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /snapshots/{snapshot_id}/metadata

• GET /snapshots/{snapshot_id}/metadata/{key}

Show snapshot’s metadata or one specified metadata with a given key.

volume:update_snapshot_metadata

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /snapshots/{snapshot_id}/metadata

• PUT /snapshots/{snapshot_id}/metadata/{key}

Update snapshot’s metadata or one specified metadata with a given key.

volume:delete_snapshot_metadata

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /snapshots/{snapshot_id}/metadata/{key}

Delete snapshot’s specified metadata with a given key.

volume:get_all_snapshots

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /snapshots

• GET /snapshots/detail

List snapshots.

volume_extension:extended_snapshot_attributes

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /snapshots/{snapshot_id}

• GET /snapshots/detail

List or show snapshots with extended attributes.

volume:create_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /snapshots

Create snapshot.

volume:get_snapshot

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /snapshots/{snapshot_id}

Show snapshot.

volume:update_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /snapshots/{snapshot_id}

Update snapshot.

volume:delete_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /snapshots/{snapshot_id}

Delete snapshot.

volume_extension:snapshot_admin_actions:reset_status

Default:

rule:admin_api

Operations:

• POST /snapshots/{snapshot_id}/action (os-reset_status)

Reset status of a snapshot.

snapshot_extension:snapshot_actions:update_snapshot_status

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /snapshots/{snapshot_id}/action (update_snapshot_status)

Update database fields of snapshot.

volume_extension:snapshot_admin_actions:force_delete

Default:

rule:admin_api

Operations:

• POST /snapshots/{snapshot_id}/action (os-force_delete)

Force delete a snapshot.

snapshot_extension:list_manageable

Default:

rule:admin_api

Operations:

• GET /manageable_snapshots

• GET /manageable_snapshots/detail

List (in detail) of snapshots which are available to manage.

snapshot_extension:snapshot_manage

Default:

rule:admin_api

Operations:

• POST /manageable_snapshots

Manage an existing snapshot.

snapshot_extension:snapshot_unmanage

Default:

rule:admin_api

Operations:

• POST /snapshots/{snapshot_id}/action (os-unmanage)

Stop managing a snapshot.

backup:get_all

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /backups

• GET /backups/detail

List backups.

backup:backup_project_attribute

Default:

rule:admin_api

Operations:

• GET /backups/{backup_id}

• GET /backups/detail

List backups or show backup with project attributes.

backup:create

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /backups

Create backup.

backup:get

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /backups/{backup_id}

Show backup.

backup:update

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /backups/{backup_id}

Update backup.

backup:delete

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /backups/{backup_id}

Delete backup.

backup:restore

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /backups/{backup_id}/restore

Restore backup.

backup:backup-import

Default:

rule:admin_api

Operations:

• POST /backups/{backup_id}/import_record

Import backup.

backup:export-import

Default:

rule:admin_api

Operations:

• POST /backups/{backup_id}/export_record

Export backup.

volume_extension:backup_admin_actions:reset_status

Default:

rule:admin_api

Operations:

• POST /backups/{backup_id}/action (os-reset_status)

Reset status of a backup.

volume_extension:backup_admin_actions:force_delete

Default:

rule:admin_api

Operations:

• POST /backups/{backup_id}/action (os-force_delete)

Force delete a backup.

group:get_all

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /groups

• GET /groups/detail

List groups.

group:create

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups

Create group.

group:get

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /groups/{group_id}

Show group.

group:update

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /groups/{group_id}

Update group.

group:group_project_attribute

Default:

rule:admin_api

Operations:

• GET /groups/{group_id}

• GET /groups/detail

List groups or show group with project attributes.

group:group_types:create

Default:

rule:admin_api

Operations:

• POST /group_types/

Create a group type.

group:group_types:update

Default:

rule:admin_api

Operations:

• PUT /group_types/{group_type_id}

Update a group type.

group:group_types:delete

Default:

rule:admin_api

Operations:

• DELETE /group_types/{group_type_id}

Delete a group type.

group:access_group_types_specs

Default:

rule:admin_api

Operations:

• GET /group_types/{group_type_id}

Show group type with type specs attributes.

group:group_types_specs:get

Default:

rule:admin_api

Operations:

• GET /group_types/{group_type_id}/group_specs/{g_spec_id}

Show a group type spec.

group:group_types_specs:get_all

Default:

rule:admin_api

Operations:

• GET /group_types/{group_type_id}/group_specs

List group type specs.

group:group_types_specs:create

Default:

rule:admin_api

Operations:

• POST /group_types/{group_type_id}/group_specs

Create a group type spec.

group:group_types_specs:update

Default:

rule:admin_api

Operations:

• PUT /group_types/{group_type_id}/group_specs/{g_spec_id}

Update a group type spec.

group:group_types_specs:delete

Default:

rule:admin_api

Operations:

• DELETE /group_types/{group_type_id}/group_specs/{g_spec_id}

Delete a group type spec.

group:get_all_group_snapshots

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /group_snapshots

• GET /group_snapshots/detail

List group snapshots.

group:create_group_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /group_snapshots

Create group snapshot.

group:get_group_snapshot

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /group_snapshots/{group_snapshot_id}

Show group snapshot.

group:delete_group_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /group_snapshots/{group_snapshot_id}

Delete group snapshot.

group:update_group_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /group_snapshots/{group_snapshot_id}

Update group snapshot.

group:group_snapshot_project_attribute

Default:

rule:admin_api

Operations:

• GET /group_snapshots/{group_snapshot_id}

• GET /group_snapshots/detail

List group snapshots or show group snapshot with project attributes.

group:reset_group_snapshot_status

Default:

rule:admin_api

Operations:

• POST /group_snapshots/{g_snapshot_id}/action (reset_status)

Reset status of group snapshot.

group:delete

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups/{group_id}/action (delete)

Delete group.

group:reset_status

Default:

rule:admin_api

Operations:

• POST /groups/{group_id}/action (reset_status)

Reset status of group.

group:enable_replication

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups/{group_id}/action (enable_replication)

Enable replication.

group:disable_replication

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups/{group_id}/action (disable_replication)

Disable replication.

group:failover_replication

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups/{group_id}/action (failover_replication)

Fail over replication.

group:list_replication_targets

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /groups/{group_id}/action (list_replication_targets)

List failover replication.

volume_extension:qos_specs_manage:get_all

Default:

rule:admin_api

Operations:

• GET /qos-specs

• GET /qos-specs/{qos_id}/associations

List qos specs or list all associations.

volume_extension:qos_specs_manage:get

Default:

rule:admin_api

Operations:

• GET /qos-specs/{qos_id}

Show qos specs.

volume_extension:qos_specs_manage:create

Default:

rule:admin_api

Operations:

• POST /qos-specs

Create qos specs.

volume_extension:qos_specs_manage:update

Default:

rule:admin_api

Operations:

• PUT /qos-specs/{qos_id}

• GET /qos-specs/{qos_id}/disassociate_all

• GET /qos-specs/{qos_id}/associate

• GET /qos-specs/{qos_id}/disassociate

Update qos specs (including updating association).

volume_extension:qos_specs_manage:delete

Default:

rule:admin_api

Operations:

• DELETE /qos-specs/{qos_id}

• PUT /qos-specs/{qos_id}/delete_keys

delete qos specs or unset one specified qos key.

volume_extension:quota_classes:get

Default:

rule:admin_api

Operations:

• GET /os-quota-class-sets/{project_id}

Show project quota class.

volume_extension:quota_classes:update

Default:

rule:admin_api

Operations:

• PUT /os-quota-class-sets/{project_id}

Update project quota class.

volume_extension:quotas:show

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /os-quota-sets/{project_id}

• GET /os-quota-sets/{project_id}/default

• GET /os-quota-sets/{project_id}?usage=True

Show project quota (including usage and default).

volume_extension:quotas:update

Default:

rule:admin_api

Operations:

• PUT /os-quota-sets/{project_id}

Update project quota.

volume_extension:quotas:delete

Default:

rule:admin_api

Operations:

• DELETE /os-quota-sets/{project_id}

Delete project quota.

volume_extension:capabilities

Default:

rule:admin_api

Operations:

• GET /capabilities/{host_name}

Show backend capabilities.

volume_extension:services:index

Default:

rule:admin_api

Operations:

• GET /os-services

List all services.

volume_extension:services:update

Default:

rule:admin_api

Operations:

• PUT /os-services/{action}

Update service, including failover_host, thaw, freeze, disable, enable, set-log and get-log actions.

volume:freeze_host

Default:

rule:admin_api

Operations:

• PUT /os-services/freeze

Freeze a backend host.

volume:thaw_host

Default:

rule:admin_api

Operations:

• PUT /os-services/thaw

Thaw a backend host.

volume:failover_host

Default:

rule:admin_api

Operations:

• PUT /os-services/failover_host

Failover a backend host.

scheduler_extension:scheduler_stats:get_pools

Default:

rule:admin_api

Operations:

• GET /scheduler-stats/get_pools

List all backend pools.

volume_extension:hosts

Default:

rule:admin_api

Operations:

• GET /os-hosts

• PUT /os-hosts/{host_name}

• GET /os-hosts/{host_id}

List, update or show hosts for a project.

limits_extension:used_limits

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /limits

Show limits with used limit attributes.

volume_extension:list_manageable

Default:

rule:admin_api

Operations:

• GET /manageable_volumes

• GET /manageable_volumes/detail

List (in detail) of volumes which are available to manage.

volume_extension:volume_manage

Default:

rule:admin_api

Operations:

• POST /manageable_volumes

Manage existing volumes.

volume_extension:volume_unmanage

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-unmanage)

Stop managing a volume.

volume_extension:type_create

Default:

rule:admin_api

Operations:

• POST /types

Create volume type.

volume_extension:type_update

Default:

rule:admin_api

Operations:

• PUT /types

Update volume type.

volume_extension:type_delete

Default:

rule:admin_api

Operations:

• DELETE /types

Delete volume type.

volume_extension:type_get

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /types/{type_id}

Get one specific volume type.

volume_extension:type_get_all

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /types/

List volume types.

volume_extension:access_types_extra_specs

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /types/{type_id}

• GET /types

Include the volume type’s extra_specs attribute in the volume type list or show requests. The ability to make these calls is governed by other policies.

volume_extension:access_types_qos_specs_id

Default:

rule:admin_api

Operations:

• GET /types/{type_id}

• GET /types

Include the volume type’s QoS specifications ID attribute in the volume type list or show requests. The ability to make these calls is governed by other policies.

volume_extension:volume_type_encryption

Default:

rule:admin_api

DEPRECATED: This rule will be removed in the Yoga release.

volume_extension:volume_type_encryption:create

Default:

rule:admin_api

Operations:

• POST /types/{type_id}/encryption

Create volume type encryption.

volume_extension:volume_type_encryption:get

Default:

rule:admin_api

Operations:

• GET /types/{type_id}/encryption

• GET /types/{type_id}/encryption/{key}

Show a volume type’s encryption type, show an encryption specs item.

volume_extension:volume_type_encryption:update

Default:

rule:admin_api

Operations:

• PUT /types/{type_id}/encryption/{encryption_id}

Update volume type encryption.

volume_extension:volume_type_encryption:delete

Default:

rule:admin_api

Operations:

• DELETE /types/{type_id}/encryption/{encryption_id}

Delete volume type encryption.

volume_extension:volume_type_access

Default:

rule:xena_system_admin_or_project_member

Operations:

• GET /types

• GET /types/{type_id}

• POST /types

Adds the boolean field ‘os-volume-type-access:is_public’ to the responses for these API calls. The ability to make these calls is governed by other policies.

volume_extension:volume_type_access:addProjectAccess

Default:

rule:admin_api

Operations:

• POST /types/{type_id}/action (addProjectAccess)

Add volume type access for project.

volume_extension:volume_type_access:removeProjectAccess

Default:

rule:admin_api

Operations:

• POST /types/{type_id}/action (removeProjectAccess)

Remove volume type access for project.

volume_extension:volume_type_access:get_all_for_type

Default:

rule:admin_api

Operations:

• GET /types/{type_id}/os-volume-type-access

List private volume type access detail, that is, list the projects that have access to this volume type.

volume:extend

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-extend)

Extend a volume.

volume:extend_attached_volume

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-extend)

Extend a attached volume.

volume:revert_to_snapshot

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (revert)

Revert a volume to a snapshot.

volume_extension:volume_admin_actions:reset_status

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-reset_status)

Reset status of a volume.

volume:retype

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-retype)

Retype a volume.

volume:update_readonly_flag

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-update_readonly_flag)

Update a volume’s readonly flag.

volume_extension:volume_admin_actions:force_delete

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-force_delete)

Force delete a volume.

volume_extension:volume_actions:upload_public

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-volume_upload_image)

Upload a volume to image with public visibility.

volume_extension:volume_actions:upload_image

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-volume_upload_image)

Upload a volume to image.

volume_extension:volume_admin_actions:force_detach

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-force_detach)

Force detach a volume.

volume_extension:volume_admin_actions:migrate_volume

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-migrate_volume)

migrate a volume to a specified host.

volume_extension:volume_admin_actions:migrate_volume_completion

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-migrate_volume_completion)

Complete a volume migration.

volume_extension:volume_actions:initialize_connection

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-initialize_connection)

Initialize volume attachment.

volume_extension:volume_actions:terminate_connection

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-terminate_connection)

Terminate volume attachment.

volume_extension:volume_actions:roll_detaching

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-roll_detaching)

Roll back volume status to ‘in-use’.

volume_extension:volume_actions:reserve

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-reserve)

Mark volume as reserved.

volume_extension:volume_actions:unreserve

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-unreserve)

Unmark volume as reserved.

volume_extension:volume_actions:begin_detaching

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-begin_detaching)

Begin detach volumes.

volume_extension:volume_actions:attach

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-attach)

Add attachment metadata.

volume_extension:volume_actions:detach

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-detach)

Clear attachment metadata.

volume:reimage

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-reimage)

Reimage a volume in ‘available’ or ‘error’ status.

volume:reimage_reserved

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-reimage)

Reimage a volume in ‘reserved’ status.

volume:get_all_transfers

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /os-volume-transfer

• GET /os-volume-transfer/detail

• GET /volume_transfers

• GET /volume-transfers/detail

List volume transfer.

volume:create_transfer

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /os-volume-transfer

• POST /volume_transfers

Create a volume transfer.

volume:get_transfer

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /os-volume-transfer/{transfer_id}

• GET /volume-transfers/{transfer_id}

Show one specified volume transfer.

volume:accept_transfer

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /os-volume-transfer/{transfer_id}/accept

• POST /volume-transfers/{transfer_id}/accept

Accept a volume transfer.

volume:delete_transfer

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /os-volume-transfer/{transfer_id}

• DELETE /volume-transfers/{transfer_id}

Delete volume transfer.

volume:get_volume_metadata

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes/{volume_id}/metadata

• GET /volumes/{volume_id}/metadata/{key}

• POST /volumes/{volume_id}/action  (os-show_image_metadata)

Show volume’s metadata or one specified metadata with a given key.

volume:create_volume_metadata

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/metadata

Create volume metadata.

volume:update_volume_metadata

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /volumes/{volume_id}/metadata

• PUT /volumes/{volume_id}/metadata/{key}

Replace a volume’s metadata dictionary or update a single metadatum with a given key.

volume:delete_volume_metadata

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /volumes/{volume_id}/metadata/{key}

Delete a volume’s metadatum with the given key.

volume_extension:volume_image_metadata:show

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes/detail

• GET /volumes/{volume_id}

Include a volume’s image metadata in volume detail responses. The ability to make these calls is governed by other policies.

volume_extension:volume_image_metadata:set

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-set_image_metadata)

Set image metadata for a volume

volume_extension:volume_image_metadata:remove

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes/{volume_id}/action (os-unset_image_metadata)

Remove specific image metadata from a volume

volume:update_volume_admin_metadata

Default:

rule:admin_api

Operations:

• POST /volumes/{volume_id}/action (os-update_readonly_flag)

• POST /volumes/{volume_id}/action (os-attach)

Update volume admin metadata. This permission is required to complete these API calls, though the ability to make these calls is governed by other policies.

volume_extension:types_extra_specs:index

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /types/{type_id}/extra_specs

List type extra specs.

volume_extension:types_extra_specs:create

Default:

rule:admin_api

Operations:

• POST /types/{type_id}/extra_specs

Create type extra specs.

volume_extension:types_extra_specs:show

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /types/{type_id}/extra_specs/{extra_spec_key}

Show one specified type extra specs.

volume_extension:types_extra_specs:read_sensitive

Default:

rule:admin_api

Operations:

• GET /types

• GET /types/{type_id}

• GET /types/{type_id}/extra_specs

• GET /types/{type_id}/extra_specs/{extra_spec_key}

Include extra_specs fields that may reveal sensitive information about the deployment that should not be exposed to end users in various volume-type responses that show extra_specs. The ability to make these calls is governed by other policies.

volume_extension:types_extra_specs:update

Default:

rule:admin_api

Operations:

• PUT /types/{type_id}/extra_specs/{extra_spec_key}

Update type extra specs.

volume_extension:types_extra_specs:delete

Default:

rule:admin_api

Operations:

• DELETE /types/{type_id}/extra_specs/{extra_spec_key}

Delete type extra specs.

volume:create

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes

Create volume.

volume:create_from_image

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes

Create volume from image.

volume:get

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes/{volume_id}

Show volume.

volume:get_all

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes

• GET /volumes/detail

• GET /volumes/summary

List volumes or get summary of volumes.

volume:update

Default:

rule:xena_system_admin_or_project_member

Operations:

• PUT /volumes

• POST /volumes/{volume_id}/action (os-set_bootable)

Update volume or update a volume’s bootable status.

volume:delete

Default:

rule:xena_system_admin_or_project_member

Operations:

• DELETE /volumes/{volume_id}

Delete volume.

volume:force_delete

Default:

rule:admin_api

Operations:

• DELETE /volumes/{volume_id}

Force Delete a volume.

volume_extension:volume_host_attribute

Default:

rule:admin_api

Operations:

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with host attribute.

volume_extension:volume_tenant_attribute

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with tenant attribute.

volume_extension:volume_mig_status_attribute

Default:

rule:admin_api

Operations:

• GET /volumes/{volume_id}

• GET /volumes/detail

List or show volume with migration status attribute.

volume_extension:volume_encryption_metadata

Default:

rule:xena_system_admin_or_project_reader

Operations:

• GET /volumes/{volume_id}/encryption

• GET /volumes/{volume_id}/encryption/{encryption_key}

Show volume’s encryption metadata.

volume:multiattach

Default:

rule:xena_system_admin_or_project_member

Operations:

• POST /volumes

Create multiattach capable volume.

volume_extension:default_set_or_update

Default:

rule:admin_api

Operations:

• PUT /default-types

Set or update default volume type.

volume_extension:default_get

Default:

rule:admin_api

Operations:

• GET /default-types/{project-id}

Get default types.

volume_extension:default_get_all

Default:

rule:admin_api

Operations:

• GET /default-types/

Get all default types. WARNING: Changing this might open up too much information regarding cloud deployment.

volume_extension:default_unset

Default:

rule:admin_api

Operations:

• DELETE /default-types/{project-id}

Unset default type.