openstack/cinder
Code Issues Proposed changes

Add create volume from image policy

Browse Source 
When deploying Cinder as an SDS without Glance we have no way to prevent
volume creation from images even when we know they will not succeed.

This patch adds a specific policy so we can prevent this specific
creation action from being accepted.  By doing so the user will know
immediately that this is not possible, instead of having to look through
the logs to see that this is not an option.

TrivialFix

Change-Id: Iabc10a1927eea6419dd677a632cfc7d32dc08091
This commit is contained in:
Gorka Eguileor 2017-01-30 12:56:26 +01:00
parent 2db1f6bdef
commit c71d978bd6
3 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cinder/tests/unit/policy.json
View File

@ -4,6 +4,7 @@
"admin_or_owner": "is_admin:True or project_id:%(project_id)s", "admin_or_owner": "is_admin:True or project_id:%(project_id)s",
"volume:create": "", "volume:create": "",
"volume:create_from_image": "",
"volume:get": "rule:admin_or_owner", "volume:get": "rule:admin_or_owner",
"volume:get_all": "", "volume:get_all": "",
"volume:get_volume_metadata": "", "volume:get_volume_metadata": "",

2
cinder/volume/api.py
View File

@ -215,7 +215,7 @@ class API(base.Base):
cgsnapshot=None, multiattach=False, source_cg=None, cgsnapshot=None, multiattach=False, source_cg=None,
group=None, group_snapshot=None, source_group=None): group=None, group_snapshot=None, source_group=None):
check_policy(context, 'create') check_policy(context, 'create_from_image' if image_id else 'create')
# NOTE(jdg): we can have a create without size if we're # NOTE(jdg): we can have a create without size if we're
# doing a create from snap or volume. Currently # doing a create from snap or volume. Currently

1
etc/cinder/policy.json
View File

@ -5,6 +5,7 @@
"admin_api": "is_admin:True or (role:admin and is_admin_project:True)", "admin_api": "is_admin:True or (role:admin and is_admin_project:True)",
"volume:create": "", "volume:create": "",
"volume:create_from_image": "",
"volume:delete": "rule:admin_or_owner", "volume:delete": "rule:admin_or_owner",
"volume:force_delete": "rule:admin_api", "volume:force_delete": "rule:admin_api",
"volume:get": "rule:admin_or_owner", "volume:get": "rule:admin_or_owner",