Designate Policies¶

[oslo_policy] enforce_scope¶

Keystone has introduced the concept of token scopes. To ensure backward compatibility, Oslo Policy does not enforce scope validation of tokens by default.

In the Xena release, Designate supports enforcing Keystone token scopes. To enable Keystone token scoping, add the following to your Designate configuration file:

[oslo_policy]
enforce_scope = True

The primary effect of this setting is to allow a system scoped admin token when performing administrative API calls to the Designate API. The Designate API already enforces the project scoping in Keystone tokens.

[oslo_policy] enforce_new_defaults¶

The Designate Xena release added support for Keystone Default Roles in the default policies. To be backward compatible, Oslo Policy currently uses deprecated policies that do not require the new Keystone Default Roles by default.

Designate supports requiring these new Keystone Default Roles as of the Xena release. To start requiring these roles in Designate, enable the new policies by adding the following setting to your Designate configuration file:

[oslo_policy]
enforce_new_defaults = True

Example OpenStack Client Command¶

After you have enabled enforce_new_defaults and enforce_scope, administrative commands require a system scoped admin token. An example OpenStack Client command to create a Top Level Domain (TLD) would look like:

openstack --os-system-scope all --os-auth-url <identity endpoint URL> --os-password <admin password> --os-username admin --os-user-domain-name default create tld --name example.org

Sample File Generation¶

To generate a sample policy.yaml file from the Designate defaults, run the oslo policy generation script:

oslopolicy-sample-generator
--config-file etc/designate/designate-policy-generator.conf
--output-file policy.yaml.sample

Merged File Generation¶

To generate a policy file which shows the effective policy in use by the project, including all registered policy defaults and the policy overrides included in a policy.yaml file, run this command:

oslopolicy-policy-generator
--config-file etc/designate/designate-policy-generator.conf

This tool uses the output_file path from the config-file.

List Redundant Configurations¶

To generate a list of matches for policy rules that are defined in a configuration file where the rule does not differ from a registered default rule, run this command:

oslopolicy-list-redundant
--config-file etc/designate/designate-policy-generator.conf

These are rules that can be removed from the policy file with no change in effective policy.

designate¶

admin

Default:

role:admin or is_admin:True

(no description provided)

owner

Default:

project_id:%(tenant_id)s

(no description provided)

admin_or_owner

Default:

rule:admin or rule:owner

(no description provided)

default

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

(no description provided)

create_blacklist

Default:

role:admin and system_scope:all

Operations:

• POST /v2/blacklists

Scope Types:

• system

Create blacklist.

find_blacklists

Default:

role:reader and system_scope:all

Operations:

• GET /v2/blacklists

Scope Types:

• system

Find blacklists.

get_blacklist

Default:

role:reader and system_scope:all

Operations:

• GET /v2/blacklists/{blacklist_id}

Scope Types:

• system

Get blacklist.

update_blacklist

Default:

role:admin and system_scope:all

Operations:

• PATCH /v2/blacklists/{blacklist_id}

Scope Types:

• system

Update blacklist.

delete_blacklist

Default:

role:admin and system_scope:all

Operations:

• DELETE /v2/blacklists/{blacklist_id}

Scope Types:

• system

Delete blacklist.

use_blacklisted_zone

Default:

role:admin and system_scope:all

Operations:

• POST /v2/zones

Scope Types:

• system

Allowed bypass the blacklist.

all_tenants

Default:

role:admin and system_scope:all

Scope Types:

• system

Action on all tenants.

edit_managed_records

Default:

role:admin and system_scope:all

Scope Types:

• system

Edit managed records.

use_low_ttl

Default:

role:admin and system_scope:all

Scope Types:

• system

Use low TTL.

use_sudo

Default:

role:admin and system_scope:all

Scope Types:

• system

Accept sudo from user to tenant.

create_pool

Default:

role:admin and system_scope:all

Scope Types:

• system

Create pool.

find_pools

Default:

role:reader and system_scope:all

Operations:

• GET /v2/pools

Scope Types:

• system

Find pool.

find_pool

Default:

role:reader and system_scope:all

Operations:

• GET /v2/pools

Scope Types:

• system

Find pools.

get_pool

Default:

role:reader and system_scope:all

Operations:

• GET /v2/pools/{pool_id}

Scope Types:

• system

Get pool.

update_pool

Default:

role:admin and system_scope:all

Scope Types:

• system

Update pool.

delete_pool

Default:

role:admin and system_scope:all

Scope Types:

• system

Delete pool.

zone_create_forced_pool

Default:

role:admin and system_scope:all

Operations:

• POST /v2/zones

Scope Types:

• system

load and set the pool to the one provided in the Zone attributes.

get_quotas

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (True:%(all_tenants)s and role:reader)

Operations:

• GET /v2/quotas

Scope Types:

• system

• project

View Current Project’s Quotas.

set_quota

Default:

role:admin and system_scope:all

Operations:

• PATCH /v2/quotas/{project_id}

Scope Types:

• system

Set Quotas.

reset_quotas

Default:

role:admin and system_scope:all

Operations:

• DELETE /v2/quotas/{project_id}

Scope Types:

• system

Reset Quotas.

find_records

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/reverse/floatingips/{region}:{floatingip_id}

• GET /v2/reverse/floatingips

Scope Types:

• system

• project

Find records.

count_records

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

create_recordset

Default:

(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations:

• POST /v2/zones/{zone_id}/recordsets

Scope Types:

• system

• project

Create Recordset

get_recordsets

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

get_recordset

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types:

• system

• project

Get recordset

find_recordset

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

List a Recordset in a Zone

find_recordsets

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/{zone_id}/recordsets

Scope Types:

• system

• project

List Recordsets in a Zone

update_recordset

Default:

(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations:

• PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types:

• system

• project

Update recordset

delete_recordset

Default:

(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)

Operations:

• DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}

Scope Types:

• system

• project

Delete RecordSet

count_recordset

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

Count recordsets

find_service_status

Default:

role:reader and system_scope:all

Operations:

• GET /v2/service_status/{service_id}

Scope Types:

• system

Find a single Service Status

find_service_statuses

Default:

role:reader and system_scope:all

Operations:

• GET /v2/service_status

Scope Types:

• system

List service statuses.

update_service_status

Default:

role:admin and system_scope:all

Scope Types:

• system

(no description provided)

find_tenants

Default:

role:reader and system_scope:all

Scope Types:

• system

Find all Tenants.

get_tenant

Default:

role:reader and system_scope:all

Scope Types:

• system

Get all Tenants.

count_tenants

Default:

role:reader and system_scope:all

Scope Types:

• system

Count tenants

create_tld

Default:

role:admin and system_scope:all

Operations:

• POST /v2/tlds

Scope Types:

• system

Create Tld

find_tlds

Default:

role:reader and system_scope:all

Operations:

• GET /v2/tlds

Scope Types:

• system

List Tlds

get_tld

Default:

role:reader and system_scope:all

Operations:

• GET /v2/tlds/{tld_id}

Scope Types:

• system

Show Tld

update_tld

Default:

role:admin and system_scope:all

Operations:

• PATCH /v2/tlds/{tld_id}

Scope Types:

• system

Update Tld

delete_tld

Default:

role:admin and system_scope:all

Operations:

• DELETE /v2/tlds/{tld_id}

Scope Types:

• system

Delete Tld

create_tsigkey

Default:

role:admin and system_scope:all

Operations:

• POST /v2/tsigkeys

Scope Types:

• system

Create Tsigkey

find_tsigkeys

Default:

role:reader and system_scope:all

Operations:

• GET /v2/tsigkeys

Scope Types:

• system

List Tsigkeys

get_tsigkey

Default:

role:reader and system_scope:all

Operations:

• GET /v2/tsigkeys/{tsigkey_id}

Scope Types:

• system

Show a Tsigkey

update_tsigkey

Default:

role:admin and system_scope:all

Operations:

• PATCH /v2/tsigkeys/{tsigkey_id}

Scope Types:

• system

Update Tsigkey

delete_tsigkey

Default:

role:admin and system_scope:all

Operations:

• DELETE /v2/tsigkeys/{tsigkey_id}

Scope Types:

• system

Delete a Tsigkey

create_zone

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones

Scope Types:

• system

• project

Create Zone

get_zones

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

get_zone

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/{zone_id}

Scope Types:

• system

• project

Get Zone

get_zone_servers

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

get_zone_ns_records

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/{zone_id}/nameservers

Scope Types:

• system

• project

Get the Name Servers for a Zone

find_zones

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones

Scope Types:

• system

• project

List existing zones

update_zone

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• PATCH /v2/zones/{zone_id}

Scope Types:

• system

• project

Update Zone

delete_zone

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/zones/{zone_id}

Scope Types:

• system

• project

Delete Zone

xfr_zone

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/{zone_id}/tasks/xfr

Scope Types:

• system

• project

Manually Trigger an Update of a Secondary Zone

abandon_zone

Default:

role:admin and system_scope:all

Operations:

• POST /v2/zones/{zone_id}/tasks/abandon

Scope Types:

• system

Abandon Zone

count_zones

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

count_zones_pending_notify

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

purge_zones

Default:

role:admin and system_scope:all

Scope Types:

• system

(no description provided)

zone_export

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/exports/{zone_export_id}/export

Scope Types:

• system

• project

Retrive a Zone Export from the Designate Datastore

create_zone_export

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/{zone_id}/tasks/export

Scope Types:

• system

• project

Create Zone Export

find_zone_exports

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/exports

Scope Types:

• system

• project

List Zone Exports

get_zone_export

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/exports/{zone_export_id}

Scope Types:

• system

• project

Get Zone Exports

update_zone_export

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/{zone_id}/tasks/export

Scope Types:

• system

• project

Update Zone Exports

delete_zone_export

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/zones/tasks/exports/{zone_export_id}

Scope Types:

• system

• project

Delete a zone export

create_zone_import

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/tasks/imports

Scope Types:

• system

• project

Create Zone Import

find_zone_imports

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/imports

Scope Types:

• system

• project

List all Zone Imports

get_zone_import

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/imports/{zone_import_id}

Scope Types:

• system

• project

Get Zone Imports

update_zone_import

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/tasks/imports

Scope Types:

• system

• project

Update Zone Imports

delete_zone_import

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/zones/tasks/imports/{zone_import_id}

Scope Types:

• system

• project

Delete a Zone Import

create_zone_transfer_accept

Default:

((role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s

Operations:

• POST /v2/zones/tasks/transfer_accepts

Scope Types:

• system

• project

Create Zone Transfer Accept

get_zone_transfer_accept

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Operations:

• GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}

Scope Types:

• system

• project

Get Zone Transfer Accept

find_zone_transfer_accepts

Default:

role:reader and system_scope:all

Operations:

• GET /v2/zones/tasks/transfer_accepts

Scope Types:

• system

List Zone Transfer Accepts

create_zone_transfer_request

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• POST /v2/zones/{zone_id}/tasks/transfer_requests

Scope Types:

• system

• project

Create Zone Transfer Accept

get_zone_transfer_request

Default:

((role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s

Operations:

• GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Scope Types:

• system

• project

Show a Zone Transfer Request

get_zone_transfer_request_detailed

Default:

(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)

Scope Types:

• system

• project

(no description provided)

find_zone_transfer_requests

Default:

@

Operations:

• GET /v2/zones/tasks/transfer_requests

List Zone Transfer Requests

update_zone_transfer_request

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Scope Types:

• system

• project

Update a Zone Transfer Request

delete_zone_transfer_request

Default:

(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)

Operations:

• DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Scope Types:

• system

• project

Delete a Zone Transfer Request