Warning
JSON formatted policy file is deprecated since Designate 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
Designate, like most OpenStack services, supports Role Based Access Control (RBAC) using oslo policy to define default RBAC policies in the Designate code. These default policies can be overridden by operators using a yaml policy file. For a sample policy file, refer to policy.yaml.
Currently Designate defaults to the OpenStack legacy “admin or owner” scheme, but Designate also supports a newer RBAC model using Keystone Default Roles and Keystone Scoped Tokens via configuration settings.
Starting with the Xena release of Designate, Keystone token scopes and default roles can be enforced. By default, in the Xena release, oslo policy will not be enforcing these new roles and scopes. However, at some point in the future they may become the default. You may want to enable them now to be ready for the later transition. This section will describe those settings.
The Oslo Policy project defines two configuration settings, among others, that can be set in the Designate configuration file to influence how policies are handled by Designate. Those two settings are enforce_scope and enforce_new_defaults.
When you enable Keystone Default Roles and Keystone Scoped Tokens the Designate policy honors the following roles:
System scoped - Admin
System scoped - Reader
Project scoped - Reader
Project scoped - Member
Keystone has introduced the concept of token scopes. To ensure backward compatibility, Oslo Policy does not enforce scope validation of tokens by default.
In the Xena release, Designate supports enforcing Keystone token scopes. To enable Keystone token scoping, add the following to your Designate configuration file:
[oslo_policy]
enforce_scope = True
The primary effect of this setting is to allow a system scoped admin token when performing administrative API calls to the Designate API. The Designate API already enforces the project scoping in Keystone tokens.
The Designate Xena release added support for Keystone Default Roles in the default policies. To be backward compatible, Oslo Policy currently uses deprecated policies that do not require the new Keystone Default Roles by default.
Designate supports requiring these new Keystone Default Roles as of the Xena release. To start requiring these roles in Designate, enable the new policies by adding the following setting to your Designate configuration file:
[oslo_policy]
enforce_new_defaults = True
After you have enabled enforce_new_defaults and enforce_scope, administrative commands require a system scoped admin token. An example OpenStack Client command to create a Top Level Domain (TLD) would look like:
openstack --os-system-scope all --os-auth-url <identity endpoint URL> --os-password <admin password> --os-username admin --os-user-domain-name default create tld --name example.org
This section describes how to use Oslo Policy tools to managing Designate policies.
To generate a sample policy.yaml file from the Designate defaults, run the oslo policy generation script:
oslopolicy-sample-generator
--config-file etc/designate/designate-policy-generator.conf
--output-file policy.yaml.sample
To generate a policy file which shows the effective policy in use by the project, including all registered policy defaults and the policy overrides included in a policy.yaml file, run this command:
oslopolicy-policy-generator
--config-file etc/designate/designate-policy-generator.conf
This tool uses the output_file path from the config-file.
To generate a list of matches for policy rules that are defined in a configuration file where the rule does not differ from a registered default rule, run this command:
oslopolicy-list-redundant
--config-file etc/designate/designate-policy-generator.conf
These are rules that can be removed from the policy file with no change in effective policy.
The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.
admin
role:admin or is_admin:True
(no description provided)
owner
project_id:%(tenant_id)s
(no description provided)
admin_or_owner
rule:admin or rule:owner
(no description provided)
default
(role:admin) or (role:member and project_id:%(project_id)s)
(no description provided)
create_blacklist
role:admin
POST /v2/blacklists
project
Create blacklist.
find_blacklists
role:admin
GET /v2/blacklists
project
Find blacklists.
get_blacklist
role:admin
GET /v2/blacklists/{blacklist_id}
project
Get blacklist.
update_blacklist
role:admin
PATCH /v2/blacklists/{blacklist_id}
project
Update blacklist.
delete_blacklist
role:admin
DELETE /v2/blacklists/{blacklist_id}
project
Delete blacklist.
use_blacklisted_zone
role:admin
POST /v2/zones
project
Allowed bypass the blacklist.
all_tenants
role:admin
project
Action on all tenants.
edit_managed_records
role:admin
project
Edit managed records.
use_low_ttl
role:admin
project
Use low TTL.
use_sudo
role:admin
project
Accept sudo from user to tenant.
hard_delete
role:admin
project
Clean backend resources associated with zone
create_pool
role:admin
project
Create pool.
find_pools
role:admin
GET /v2/pools
project
Find pool.
find_pool
role:admin
GET /v2/pools
project
Find pools.
get_pool
role:admin
GET /v2/pools/{pool_id}
project
Get pool.
update_pool
role:admin
project
Update pool.
delete_pool
role:admin
project
Delete pool.
zone_create_forced_pool
role:admin
POST /v2/zones
project
load and set the pool to the one provided in the Zone attributes.
get_quotas
(role:admin) or (role:reader and project_id:%(project_id)s) or (True:%(all_tenants)s and role:reader)
GET /v2/quotas
project
View Current Project’s Quotas.
set_quota
role:admin
PATCH /v2/quotas/{project_id}
project
Set Quotas.
reset_quotas
role:admin
DELETE /v2/quotas/{project_id}
project
Reset Quotas.
find_records
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/reverse/floatingips/{region}:{floatingip_id}
GET /v2/reverse/floatingips
project
Find records.
count_records
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
create_recordset
(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('SECONDARY':%(zone_type)s) or ("True":%(zone_shared)s) and ('PRIMARY':%(zone_type)s)
POST /v2/zones/{zone_id}/recordsets
project
Create Recordset
get_recordsets
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
get_recordset
(role:admin) or (role:reader and project_id:%(project_id)s) or ("True":%(zone_shared)s)
GET /v2/zones/{zone_id}/recordsets/{recordset_id}
project
Get recordset
find_recordset
(role:admin) or (role:reader and project_id:%(project_id)s)
project
List a Recordset in a Zone
find_recordsets
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/{zone_id}/recordsets
project
List Recordsets in a Zone
update_recordset
(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('SECONDARY':%(zone_type)s) or role:member and (project_id:%(recordset_project_id)s) and ('PRIMARY':%(zone_type)s)
PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
project
Update recordset
delete_recordset
(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('PRIMARY':%(zone_type)s) or (role:admin) and ('SECONDARY':%(zone_type)s) or role:member and (project_id:%(recordset_project_id)s) and ('PRIMARY':%(zone_type)s)
DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}
project
Delete RecordSet
count_recordset
(role:admin) or (role:reader and project_id:%(project_id)s)
project
Count recordsets
find_service_status
role:admin
GET /v2/service_status/{service_id}
project
Find a single Service Status
find_service_statuses
role:admin
GET /v2/service_status
project
List service statuses.
update_service_status
role:admin
project
(no description provided)
get_zone_share
(role:admin) or (role:member and project_id:%(project_id)s)
GET /v2/zones/{zone_id}/shares/{zone_share_id}
project
Get a Zone Share
share_zone
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/shares
project
Share a Zone
find_zone_shares
@
GET /v2/zones/{zone_id}/shares
List Shared Zones
find_project_zone_share
(role:admin) or (role:member and project_id:%(project_id)s)
project
Check the can query for a specific projects shares.
unshare_zone
(role:admin) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/{zone_id}/shares/{shared_zone_id}
project
Unshare Zone
find_tenants
role:admin
project
Find all Tenants.
get_tenant
role:admin
project
Get all Tenants.
count_tenants
role:admin
project
Count tenants
create_tld
role:admin
POST /v2/tlds
project
Create Tld
find_tlds
role:admin
GET /v2/tlds
project
List Tlds
get_tld
role:admin
GET /v2/tlds/{tld_id}
project
Show Tld
update_tld
role:admin
PATCH /v2/tlds/{tld_id}
project
Update Tld
delete_tld
role:admin
DELETE /v2/tlds/{tld_id}
project
Delete Tld
create_tsigkey
role:admin
POST /v2/tsigkeys
project
Create Tsigkey
find_tsigkeys
role:admin
GET /v2/tsigkeys
project
List Tsigkeys
get_tsigkey
role:admin
GET /v2/tsigkeys/{tsigkey_id}
project
Show a Tsigkey
update_tsigkey
role:admin
PATCH /v2/tsigkeys/{tsigkey_id}
project
Update Tsigkey
delete_tsigkey
role:admin
DELETE /v2/tsigkeys/{tsigkey_id}
project
Delete a Tsigkey
create_zone
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones
project
Create Zone
get_zones
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
get_zone
(role:admin) or (role:reader and project_id:%(project_id)s) or ("True":%(zone_shared)s)
GET /v2/zones/{zone_id}
project
Get Zone
get_zone_servers
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
get_zone_ns_records
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/{zone_id}/nameservers
project
Get the Name Servers for a Zone
find_zones
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones
project
List existing zones
update_zone
(role:admin) or (role:member and project_id:%(project_id)s)
PATCH /v2/zones/{zone_id}
project
Update Zone
delete_zone
(role:admin) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/{zone_id}
project
Delete Zone
xfr_zone
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/xfr
project
Manually Trigger an Update of a Secondary Zone
abandon_zone
role:admin
POST /v2/zones/{zone_id}/tasks/abandon
project
Abandon Zone
count_zones
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
count_zones_pending_notify
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
purge_zones
role:admin
project
(no description provided)
zone_export
(role:admin) or (role:member and project_id:%(project_id)s)
GET /v2/zones/tasks/exports/{zone_export_id}/export
project
Retrive a Zone Export from the Designate Datastore
create_zone_export
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/export
project
Create Zone Export
find_zone_exports
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/exports
project
List Zone Exports
get_zone_export
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/exports/{zone_export_id}
project
Get Zone Exports
update_zone_export
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/export
project
Update Zone Exports
delete_zone_export
(role:admin) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/tasks/exports/{zone_export_id}
project
Delete a zone export
create_zone_import
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/tasks/imports
project
Create Zone Import
find_zone_imports
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/imports
project
List all Zone Imports
get_zone_import
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/imports/{zone_import_id}
project
Get Zone Imports
update_zone_import
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/tasks/imports
project
Update Zone Imports
delete_zone_import
(role:admin) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/tasks/imports/{zone_import_id}
project
Delete a Zone Import
create_zone_transfer_accept
((role:admin) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s
POST /v2/zones/tasks/transfer_accepts
project
Create Zone Transfer Accept
get_zone_transfer_accept
(role:admin) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}
project
Get Zone Transfer Accept
find_zone_transfer_accepts
role:admin
GET /v2/zones/tasks/transfer_accepts
project
List Zone Transfer Accepts
create_zone_transfer_request
(role:admin) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/transfer_requests
project
Create Zone Transfer Accept
get_zone_transfer_request
((role:admin) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s
GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
project
Show a Zone Transfer Request
get_zone_transfer_request_detailed
(role:admin) or (role:reader and project_id:%(project_id)s)
project
(no description provided)
find_zone_transfer_requests
@
GET /v2/zones/tasks/transfer_requests
List Zone Transfer Requests
update_zone_transfer_request
(role:admin) or (role:member and project_id:%(project_id)s)
PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
project
Update a Zone Transfer Request
delete_zone_transfer_request
(role:admin) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
project
Delete a Zone Transfer Request
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.