yahoo-eng-team team mailing list archive

[Matthew Edmonds <edmondsw@xxxxxxxxxx>]

Public bug reported:

nova.api.openstack.compute.server_groups.ServerGroupController uses the
same policy check (os_compute_api:os-server-groups) for show, delete,
index, and create, instead of separating these into separate checks
(e.g. os_compute_api:os-server-groups:delete). This makes it impossible
to customize policy such that some roles are allowed to do some but not
all of these operations, E.g. show/index server groups but not
create/delete them.

Found with Newton.

** Affects: nova
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1632820

Title:
  os-server-groups policy doesn't separate CRUD actions

Status in OpenStack Compute (nova):
  New

Bug description:
  nova.api.openstack.compute.server_groups.ServerGroupController uses
  the same policy check (os_compute_api:os-server-groups) for show,
  delete, index, and create, instead of separating these into separate
  checks (e.g. os_compute_api:os-server-groups:delete). This makes it
  impossible to customize policy such that some roles are allowed to do
  some but not all of these operations, E.g. show/index server groups
  but not create/delete them.

  Found with Newton.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1632820/+subscriptions