diff options
| author |   Emilien Macchi <emilien@redhat.com> | 2017-03-14 21:09:11 -0400 |
|---|---|---|
| committer | Emilien Macchi <emilien@redhat.com> | 2017-03-28 22:21:28 +0000 |
| commit | 91053af09dace8dba65c9e5b72eb7de15fd69522 (patch) | |
| tree | a6f588badd22243d0079b7db01bd0f629ea89881 /environments/nova-api-policy.yaml | |
| parent | 06ec138699b0658b8d005ed900d24c9d72ac8ec7 (diff) | |
Allow to configure policy.json for OpenStack projects
For both containers and classic deployments, allow to configure
policy.json for all OpenStack APIs with new parameters (hash,
empty by default).
Example of new parameter: NovaApiPolicies.
See environments/nova-api-policy.yaml for how the feature can be used.
Note: use it with extreme caution.
Partial-implement: blueprint modify-policy-json
Change-Id: I1144f339da3836c3e8c8ae4e5567afc4d1a83e95
Diffstat (limited to 'environments/nova-api-policy.yaml')
| -rw-r--r-- | environments/nova-api-policy.yaml | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/environments/nova-api-policy.yaml b/environments/nova-api-policy.yaml new file mode 100644 index 00000000..681bd010 --- /dev/null +++ b/environments/nova-api-policy.yaml @@ -0,0 +1,10 @@ +# A Heat environment file which can be used to configure access policies for +# Nova API resources. It is here for example and doesn't cover all services +# but just Nova here. +# While recipes for editing policy.json files is supported, modifying the +# policy can have unexpected side effects and is not encouraged. + +parameter_defaults: + # The target is "compute:get_all", the "list all instances" API of the Compute service. + # The rule is an empty string meaning "always". This policy allows anybody to list instances. + NovaApiPolicies: { nova-context_is_admin: { key: 'compute:get_all', value: '' } } |