Sample Placement Policy File¶
Warning
JSON formatted policy file is deprecated since Placement 5.0.0 (Wallaby). The oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
The following is a sample placement policy file for adaptation and use.
The sample policy can also be viewed in file form
.
Important
The sample policy file is auto-generated from placement when this documentation is built. You must ensure your version of placement matches the version of this documentation.
# DEPRECATED
# "admin_api" has been deprecated since W.
# Placement API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in the placement 6.0.0 (Xena) release.
"admin_api": "role:admin"
"system_admin_api": "role:admin and system_scope:all"
# DEPRECATED
# "rule:admin_api":"role:admin" has been deprecated since W in favor
# of "system_admin_api":"role:admin and system_scope:all".
# Placement API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in the placement 6.0.0 (Xena) release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_api": "rule:system_admin_api"
"system_reader_api": "role:reader and system_scope:all"
# DEPRECATED
# "rule:admin_api":"role:admin" has been deprecated since W in favor
# of "system_reader_api":"role:reader and system_scope:all".
# Placement API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in the placement 6.0.0 (Xena) release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_api": "rule:system_reader_api"
"project_reader_api": "role:reader and project_id:%(project_id)s"
# DEPRECATED
# "rule:admin_api":"role:admin" has been deprecated since W in favor
# of "project_reader_api":"role:reader and project_id:%(project_id)s".
# Placement API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in the placement 6.0.0 (Xena) release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_api": "rule:project_reader_api"
"system_or_project_reader": "rule:system_reader_api or rule:project_reader_api"
# DEPRECATED
# "rule:admin_api":"role:admin" has been deprecated since W in favor
# of "system_or_project_reader":"rule:system_reader_api or
# rule:project_reader_api".
# Placement API policies are introducing new default roles with
# scope_type capabilities. Old policies are deprecated and silently
# going to be ignored in the placement 6.0.0 (Xena) release.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "rule:admin_api": "rule:system_or_project_reader"
"placement:resource_providers:list": "rule:system_reader_api"
"placement:resource_providers:create": "rule:system_admin_api"
"placement:resource_providers:show": "rule:system_reader_api"
"placement:resource_providers:update": "rule:system_admin_api"
"placement:resource_providers:delete": "rule:system_admin_api"
"placement:resource_classes:list": "rule:system_reader_api"
"placement:resource_classes:create": "rule:system_admin_api"
"placement:resource_classes:show": "rule:system_reader_api"
"placement:resource_classes:update": "rule:system_admin_api"
"placement:resource_classes:delete": "rule:system_admin_api"
"placement:resource_providers:inventories:list": "rule:system_reader_api"
"placement:resource_providers:inventories:create": "rule:system_admin_api"
"placement:resource_providers:inventories:show": "rule:system_reader_api"
"placement:resource_providers:inventories:update": "rule:system_admin_api"
"placement:resource_providers:inventories:delete": "rule:system_admin_api"
"placement:resource_providers:aggregates:list": "rule:system_reader_api"
"placement:resource_providers:aggregates:update": "rule:system_admin_api"
"placement:resource_providers:usages": "rule:system_reader_api"
"placement:usages": "rule:system_or_project_reader"
"placement:traits:list": "rule:system_reader_api"
"placement:traits:show": "rule:system_reader_api"
"placement:traits:update": "rule:system_admin_api"
"placement:traits:delete": "rule:system_admin_api"
"placement:resource_providers:traits:list": "rule:system_reader_api"
"placement:resource_providers:traits:update": "rule:system_admin_api"
"placement:resource_providers:traits:delete": "rule:system_admin_api"
"placement:allocations:manage": "rule:system_admin_api"
"placement:allocations:list": "rule:system_reader_api"
"placement:allocations:update": "rule:system_admin_api"
"placement:allocations:delete": "rule:system_admin_api"
"placement:resource_providers:allocations:list": "rule:system_reader_api"
"placement:allocation_candidates:list": "rule:system_reader_api"
"placement:reshaper:reshape": "rule:system_admin_api"