Warning
JSON formatted policy file is deprecated since Designate 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.
admin
role:admin or is_admin:True
(no description provided)
primary_zone
target.zone_type:SECONDARY
(no description provided)
owner
tenant:%(tenant_id)s
(no description provided)
admin_or_owner
rule:admin or rule:owner
(no description provided)
default
rule:admin_or_owner
(no description provided)
target
tenant:%(target_tenant_id)s
(no description provided)
owner_or_target
rule:target or rule:owner
(no description provided)
admin_or_owner_or_target
rule:owner_or_target or rule:admin
(no description provided)
admin_or_target
rule:admin or rule:target
(no description provided)
zone_primary_or_admin
('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)
(no description provided)
create_blacklist
role:admin and system_scope:all
POST /v2/blacklists
system
Create blacklist.
find_blacklist
role:reader and system_scope:all
GET /v2/blacklists
system
Find blacklist.
find_blacklists
role:reader and system_scope:all
GET /v2/blacklists
system
Find blacklists.
get_blacklist
role:reader and system_scope:all
GET /v2/blacklists/{blacklist_id}
system
Get blacklist.
update_blacklist
role:admin and system_scope:all
PATCH /v2/blacklists/{blacklist_id}
system
Update blacklist.
delete_blacklist
role:admin and system_scope:all
DELETE /v2/blacklists/{blacklist_id}
system
Delete blacklist.
use_blacklisted_zone
role:admin and system_scope:all
POST /v2/zones
system
Allowed bypass the blacklist.
all_tenants
rule:admin
Action on all tenants.
edit_managed_records
rule:admin
Edit managed records.
use_low_ttl
rule:admin
Use low TTL.
use_sudo
rule:admin
Accept sudo from user to tenant.
diagnostics_ping
rule:admin
Diagnose ping.
diagnostics_sync_zones
rule:admin
Diagnose sync zones.
diagnostics_sync_zone
rule:admin
Diagnose sync zone.
diagnostics_sync_record
rule:admin
Diagnose sync record.
create_pool
role:admin and system_scope:all
system
Create pool.
find_pools
role:reader and system_scope:all
GET /v2/pools
system
Find pool.
find_pool
role:reader and system_scope:all
GET /v2/pools
system
Find pools.
get_pool
role:reader and system_scope:all
GET /v2/pools/{pool_id}
system
Get pool.
update_pool
role:admin and system_scope:all
system
Update pool.
delete_pool
role:admin and system_scope:all
system
Delete pool.
zone_create_forced_pool
role:admin and system_scope:all
POST /v2/zones
system
load and set the pool to the one provided in the Zone attributes.
get_quotas
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/quotas
system
project
View Current Project’s Quotas.
get_quota
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
set_quota
role:admin and system_scope:all
PATCH /v2/quotas/{project_id}
system
Set Quotas.
reset_quotas
role:admin and system_scope:all
DELETE /v2/quotas/{project_id}
system
Reset Quotas.
find_records
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/reverse/floatingips/{region}:{floatingip_id}
GET /v2/reverse/floatingips
system
project
Find records.
count_records
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
create_recordset
(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)
POST /v2/zones/{zone_id}/recordsets
PATCH /v2/reverse/floatingips/{region}:{floatingip_id}
system
project
Create Recordset
get_recordsets
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
get_recordset
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/{zone_id}/recordsets/{recordset_id}
DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}
PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
system
project
Get recordset
update_recordset
(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)
PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
PATCH /v2/reverse/floatingips/{region}:{floatingip_id}
system
project
Update recordset
delete_recordset
(role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)
DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}
system
project
Delete RecordSet
count_recordset
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
Count recordsets
find_service_status
role:reader and system_scope:all
GET /v2/service_status/{service_id}
system
Find a single Service Status
find_service_statuses
role:reader and system_scope:all
GET /v2/service_status
system
List service statuses.
update_service_status
role:admin and system_scope:all
system
(no description provided)
find_tenants
role:reader and system_scope:all
system
Find all Tenants.
get_tenant
role:reader and system_scope:all
system
Get all Tenants.
count_tenants
role:reader and system_scope:all
system
Count tenants
create_tld
role:admin and system_scope:all
POST /v2/tlds
system
Create Tld
find_tlds
role:reader and system_scope:all
GET /v2/tlds
system
List Tlds
get_tld
role:reader and system_scope:all
GET /v2/tlds/{tld_id}
system
Show Tld
update_tld
role:admin and system_scope:all
PATCH /v2/tlds/{tld_id}
system
Update Tld
delete_tld
role:admin and system_scope:all
DELETE /v2/tlds/{tld_id}
system
Delete Tld
create_tsigkey
role:admin and system_scope:all
POST /v2/tsigkeys
system
Create Tsigkey
find_tsigkeys
role:reader and system_scope:all
GET /v2/tsigkeys
system
List Tsigkeys
get_tsigkey
role:reader and system_scope:all
PATCH /v2/tsigkeys/{tsigkey_id}
GET /v2/tsigkeys/{tsigkey_id}
system
Show a Tsigkey
update_tsigkey
role:admin and system_scope:all
PATCH /v2/tsigkeys/{tsigkey_id}
system
Update Tsigkey
delete_tsigkey
role:admin and system_scope:all
DELETE /v2/tsigkeys/{tsigkey_id}
system
Delete a Tsigkey
create_zone
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones
system
project
Create Zone
get_zones
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
get_zone
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/{zone_id}
PATCH /v2/zones/{zone_id}
PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
system
project
Get Zone
get_zone_servers
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
find_zones
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones
system
project
List existing zones
update_zone
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PATCH /v2/zones/{zone_id}
system
project
Update Zone
delete_zone
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/{zone_id}
system
project
Delete Zone
xfr_zone
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/xfr
system
project
Manually Trigger an Update of a Secondary Zone
abandon_zone
role:admin and system_scope:all
POST /v2/zones/{zone_id}/tasks/abandon
system
Abandon Zone
count_zones
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
count_zones_pending_notify
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
purge_zones
role:admin and system_scope:all
system
(no description provided)
touch_zone
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
system
project
(no description provided)
zone_export
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
GET /v2/zones/tasks/exports/{zone_export_id}/export
system
project
Retrive a Zone Export from the Designate Datastore
create_zone_export
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/export
system
project
Create Zone Export
find_zone_exports
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/exports
system
project
List Zone Exports
get_zone_export
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/exports/{zone_export_id}
GET /v2/zones/tasks/exports/{zone_export_id}/export
system
project
Get Zone Exports
update_zone_export
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/export
system
project
Update Zone Exports
create_zone_import
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/tasks/imports
system
project
Create Zone Import
find_zone_imports
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/imports
system
project
List all Zone Imports
get_zone_import
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/imports/{zone_import_id}
system
project
Get Zone Imports
update_zone_import
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/tasks/imports
system
project
Update Zone Imports
delete_zone_import
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
GET /v2/zones/tasks/imports/{zone_import_id}
system
project
Delete a Zone Import
create_zone_transfer_accept
rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
POST /v2/zones/tasks/transfer_accepts
Create Zone Transfer Accept
get_zone_transfer_accept
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}
system
project
Get Zone Transfer Accept
find_zone_transfer_accepts
role:reader and system_scope:all
GET /v2/zones/tasks/transfer_accepts
system
List Zone Transfer Accepts
find_zone_transfer_accept
role:reader and system_scope:all
system
(no description provided)
update_zone_transfer_accept
role:admin and system_scope:all
POST /v2/zones/tasks/transfer_accepts
system
Update a Zone Transfer Accept
delete_zone_transfer_accept
role:admin and system_scope:all
system
(no description provided)
create_zone_transfer_request
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /v2/zones/{zone_id}/tasks/transfer_requests
system
project
Create Zone Transfer Accept
get_zone_transfer_request
rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s
GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
Show a Zone Transfer Request
get_zone_transfer_request_detailed
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
(no description provided)
find_zone_transfer_requests
@
GET /v2/zones/tasks/transfer_requests
List Zone Transfer Requests
find_zone_transfer_request
@
(no description provided)
update_zone_transfer_request
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
system
project
Update a Zone Transfer Request
delete_zone_transfer_request
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
system
project
Delete a Zone Transfer Request
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.