The following is an overview of all available policies in Nova.
Warning
JSON formatted policy file is deprecated since Nova 22.0.0(Victoria). Use YAML formatted file. Use oslopolicy-convert-json-to-yaml tool to convert the existing JSON to YAML formatted policy file in backward compatible way.
For a sample configuration file, refer to Sample Nova Policy File.
context_is_admin
role:admin
Decides what is required for the ‘is_admin:True’ check to succeed.
admin_or_owner
is_admin:True or project_id:%(project_id)s
Default rule for most non-Admin APIs.
admin_api
is_admin:True
Default rule for most Admin APIs.
system_admin_api
role:admin and system_scope:all
Default rule for System Admin APIs.
system_reader_api
role:reader and system_scope:all
Default rule for System level read only APIs.
project_admin_api
role:admin and project_id:%(project_id)s
Default rule for Project level admin APIs.
project_member_api
role:member and project_id:%(project_id)s
Default rule for Project level non admin APIs.
project_reader_api
role:reader and project_id:%(project_id)s
Default rule for Project level read only APIs.
system_admin_or_owner
rule:system_admin_api or rule:project_member_api
Default rule for System admin+owner APIs.
system_or_project_reader
rule:system_reader_api or rule:project_reader_api
Default rule for System+Project read only APIs.
os_compute_api:os-admin-actions:reset_state
rule:system_admin_api
POST /servers/{server_id}/action (os-resetState)
system
project
Reset the state of a given server
os_compute_api:os-admin-actions:inject_network_info
rule:system_admin_api
POST /servers/{server_id}/action (injectNetworkInfo)
system
project
Inject network information into the server
os_compute_api:os-admin-password
rule:system_admin_or_owner
POST /servers/{server_id}/action (changePassword)
system
project
Change the administrative password for a server
os_compute_api:os-aggregates:set_metadata
rule:system_admin_api
POST /os-aggregates/{aggregate_id}/action (set_metadata)
system
Create or replace metadata for an aggregate
os_compute_api:os-aggregates:add_host
rule:system_admin_api
POST /os-aggregates/{aggregate_id}/action (add_host)
system
Add a host to an aggregate
os_compute_api:os-aggregates:create
rule:system_admin_api
POST /os-aggregates
system
Create an aggregate
os_compute_api:os-aggregates:remove_host
rule:system_admin_api
POST /os-aggregates/{aggregate_id}/action (remove_host)
system
Remove a host from an aggregate
os_compute_api:os-aggregates:update
rule:system_admin_api
PUT /os-aggregates/{aggregate_id}
system
Update name and/or availability zone for an aggregate
os_compute_api:os-aggregates:index
rule:system_reader_api
GET /os-aggregates
system
List all aggregates
os_compute_api:os-aggregates:delete
rule:system_admin_api
DELETE /os-aggregates/{aggregate_id}
system
Delete an aggregate
os_compute_api:os-aggregates:show
rule:system_reader_api
GET /os-aggregates/{aggregate_id}
system
Show details for an aggregate
compute:aggregates:images
rule:system_admin_api
POST /os-aggregates/{aggregate_id}/images
system
Request image caching for an aggregate
os_compute_api:os-assisted-volume-snapshots:create
rule:system_admin_api
POST /os-assisted-volume-snapshots
system
Create an assisted volume snapshot
os_compute_api:os-assisted-volume-snapshots:delete
rule:system_admin_api
DELETE /os-assisted-volume-snapshots/{snapshot_id}
system
Delete an assisted volume snapshot
os_compute_api:os-attach-interfaces:list
rule:system_or_project_reader
GET /servers/{server_id}/os-interface
system
project
List port interfaces attached to a server
os_compute_api:os-attach-interfaces:show
rule:system_or_project_reader
GET /servers/{server_id}/os-interface/{port_id}
system
project
Show details of a port interface attached to a server
os_compute_api:os-attach-interfaces:create
rule:system_admin_or_owner
POST /servers/{server_id}/os-interface
system
project
Attach an interface to a server
os_compute_api:os-attach-interfaces:delete
rule:system_admin_or_owner
DELETE /servers/{server_id}/os-interface/{port_id}
system
project
Detach an interface from a server
os_compute_api:os-availability-zone:list
@
GET /os-availability-zone
system
project
List availability zone information without host information
os_compute_api:os-availability-zone:detail
rule:system_reader_api
GET /os-availability-zone/detail
system
List detailed availability zone information with host information
os_compute_api:os-baremetal-nodes:list
rule:system_reader_api
GET /os-baremetal-nodes
system
List and show details of bare metal nodes.
These APIs are proxy calls to the Ironic service and are deprecated.
os_compute_api:os-baremetal-nodes:show
rule:system_reader_api
GET /os-baremetal-nodes/{node_id}
system
Show action details for a server.
os_compute_api:os-console-auth-tokens
rule:system_reader_api
GET /os-console-auth-tokens/{console_token}
system
Show console connection information for a given console authentication token
os_compute_api:os-console-output
rule:system_admin_or_owner
POST /servers/{server_id}/action (os-getConsoleOutput)
system
project
Show console output for a server
os_compute_api:os-create-backup
rule:system_admin_or_owner
POST /servers/{server_id}/action (createBackup)
system
project
Create a back up of a server
os_compute_api:os-deferred-delete:restore
rule:system_admin_or_owner
POST /servers/{server_id}/action (restore)
system
project
Restore a soft deleted server
os_compute_api:os-deferred-delete:force
rule:system_admin_or_owner
POST /servers/{server_id}/action (forceDelete)
system
project
Force delete a server before deferred cleanup
os_compute_api:os-evacuate
rule:system_admin_api
POST /servers/{server_id}/action (evacuate)
system
project
Evacuate a server from a failed host to a new host
os_compute_api:os-extended-server-attributes
rule:system_admin_api
GET /servers/{id}
GET /servers/detail
PUT /servers/{server_id}
POST /servers/{server_id}/action (rebuild)
system
project
Return extended attributes for server.
This rule will control the visibility for a set of servers attributes:
OS-EXT-SRV-ATTR:host
OS-EXT-SRV-ATTR:instance_name
OS-EXT-SRV-ATTR:reservation_id
(since microversion 2.3)
OS-EXT-SRV-ATTR:launch_index
(since microversion 2.3)
OS-EXT-SRV-ATTR:hostname
(since microversion 2.3)
OS-EXT-SRV-ATTR:kernel_id
(since microversion 2.3)
OS-EXT-SRV-ATTR:ramdisk_id
(since microversion 2.3)
OS-EXT-SRV-ATTR:root_device_name
(since microversion 2.3)
OS-EXT-SRV-ATTR:user_data
(since microversion 2.3)
Microvision 2.75 added the above attributes in the PUT /servers/{server_id}
and POST /servers/{server_id}/action (rebuild)
API responses which are
also controlled by this policy rule, like the GET /servers*
APIs.
Microversion 2.90 made the OS-EXT-SRV-ATTR:hostname
attribute available to
all users, so this policy has no effect on that field for microversions 2.90
and greater. Controlling the visibility of this attribute for all microversions
is therefore deprecated and will be removed in a future release.
os_compute_api:extensions
@
GET /extensions
GET /extensions/{alias}
system
project
List available extensions and show information for an extension by alias
os_compute_api:os-flavor-access:add_tenant_access
rule:system_admin_api
POST /flavors/{flavor_id}/action (addTenantAccess)
system
Add flavor access to a tenant
os_compute_api:os-flavor-access:remove_tenant_access
rule:system_admin_api
POST /flavors/{flavor_id}/action (removeTenantAccess)
system
Remove flavor access from a tenant
os_compute_api:os-flavor-access
rule:system_reader_api
GET /flavors/{flavor_id}/os-flavor-access
system
List flavor access information
Allows access to the full list of tenants that have access to a flavor via an os-flavor-access API.
os_compute_api:os-flavor-extra-specs:show
rule:system_or_project_reader
GET /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
system
project
Show an extra spec for a flavor
os_compute_api:os-flavor-extra-specs:create
rule:system_admin_api
POST /flavors/{flavor_id}/os-extra_specs/
system
Create extra specs for a flavor
os_compute_api:os-flavor-extra-specs:update
rule:system_admin_api
PUT /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
system
Update an extra spec for a flavor
os_compute_api:os-flavor-extra-specs:delete
rule:system_admin_api
DELETE /flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
system
Delete an extra spec for a flavor
os_compute_api:os-flavor-extra-specs:index
rule:system_or_project_reader
GET /flavors/{flavor_id}/os-extra_specs/
GET /servers/detail
GET /servers/{server_id}
PUT /servers/{server_id}
POST /servers/{server_id}/action (rebuild)
POST /flavors
GET /flavors/detail
GET /flavors/{flavor_id}
PUT /flavors/{flavor_id}
system
project
List extra specs for a flavor. Starting with microversion 2.47, the flavor used for a server is also returned in the response when showing server details, updating a server or rebuilding a server. Starting with microversion 2.61, extra specs may be returned in responses for the flavor resource.
os_compute_api:os-flavor-manage:create
rule:system_admin_api
POST /flavors
system
Create a flavor
os_compute_api:os-flavor-manage:update
rule:system_admin_api
PUT /flavors/{flavor_id}
system
Update a flavor
os_compute_api:os-flavor-manage:delete
rule:system_admin_api
DELETE /flavors/{flavor_id}
system
Delete a flavor
os_compute_api:os-floating-ip-pools
@
GET /os-floating-ip-pools
system
project
List floating IP pools. This API is deprecated.
os_compute_api:os-floating-ips:add
rule:system_admin_or_owner
POST /servers/{server_id}/action (addFloatingIp)
system
project
Associate floating IPs to server. This API is deprecated.
os_compute_api:os-floating-ips:remove
rule:system_admin_or_owner
POST /servers/{server_id}/action (removeFloatingIp)
system
project
Disassociate floating IPs to server. This API is deprecated.
os_compute_api:os-floating-ips:list
rule:system_or_project_reader
GET /os-floating-ips
system
project
List floating IPs. This API is deprecated.
os_compute_api:os-floating-ips:create
rule:system_admin_or_owner
POST /os-floating-ips
system
project
Create floating IPs. This API is deprecated.
os_compute_api:os-floating-ips:show
rule:system_or_project_reader
GET /os-floating-ips/{floating_ip_id}
system
project
Show floating IPs. This API is deprecated.
os_compute_api:os-floating-ips:delete
rule:system_admin_or_owner
DELETE /os-floating-ips/{floating_ip_id}
system
project
Delete floating IPs. This API is deprecated.
os_compute_api:os-hosts:list
rule:system_reader_api
GET /os-hosts
system
List physical hosts.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hosts:show
rule:system_reader_api
GET /os-hosts/{host_name}
system
Show physical host.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hosts:update
rule:system_admin_api
PUT /os-hosts/{host_name}
system
Update physical host.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hosts:reboot
rule:system_admin_api
GET /os-hosts/{host_name}/reboot
system
Reboot physical host.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hosts:shutdown
rule:system_admin_api
GET /os-hosts/{host_name}/shutdown
system
Shutdown physical host.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hosts:start
rule:system_admin_api
GET /os-hosts/{host_name}/startup
system
Start physical host.
This API is deprecated in favor of os-hypervisors and os-services.
os_compute_api:os-hypervisors:list
rule:system_reader_api
GET /os-hypervisors
system
List all hypervisors.
os_compute_api:os-hypervisors:list-detail
rule:system_reader_api
GET /os-hypervisors/details
system
List all hypervisors with details
os_compute_api:os-hypervisors:statistics
rule:system_reader_api
GET /os-hypervisors/statistics
system
Show summary statistics for all hypervisors over all compute nodes.
os_compute_api:os-hypervisors:show
rule:system_reader_api
GET /os-hypervisors/{hypervisor_id}
system
Show details for a hypervisor.
os_compute_api:os-hypervisors:uptime
rule:system_reader_api
GET /os-hypervisors/{hypervisor_id}/uptime
system
Show the uptime of a hypervisor.
os_compute_api:os-hypervisors:search
rule:system_reader_api
GET /os-hypervisors/{hypervisor_hostname_pattern}/search
system
Search hypervisor by hypervisor_hostname pattern.
os_compute_api:os-hypervisors:servers
rule:system_reader_api
GET /os-hypervisors/{hypervisor_hostname_pattern}/servers
system
List all servers on hypervisors that can match the provided hypervisor_hostname pattern.
os_compute_api:os-instance-actions:events:details
rule:system_reader_api
GET /servers/{server_id}/os-instance-actions/{request_id}
system
project
Add “details” key in action events for a server.
This check is performed only after the check os_compute_api:os-instance-actions:show passes. Beginning with Microversion 2.84, new field ‘details’ is exposed via API which can have more details about event failure. That field is controlled by this policy which is system reader by default. Making the ‘details’ field visible to the non-admin user helps to understand the nature of the problem (i.e. if the action can be retried), but in the other hand it might leak information about the deployment (e.g. the type of the hypervisor).
os_compute_api:os-instance-actions:events
rule:system_reader_api
GET /servers/{server_id}/os-instance-actions/{request_id}
system
project
Add events details in action details for a server. This check is performed only after the check os_compute_api:os-instance-actions:show passes. Beginning with Microversion 2.51, events details are always included; traceback information is provided per event if policy enforcement passes. Beginning with Microversion 2.62, each event includes a hashed host identifier and, if policy enforcement passes, the name of the host.
os_compute_api:os-instance-actions:list
rule:system_or_project_reader
GET /servers/{server_id}/os-instance-actions
system
project
List actions for a server.
os_compute_api:os-instance-actions:show
rule:system_or_project_reader
GET /servers/{server_id}/os-instance-actions/{request_id}
system
project
Show action details for a server.
os_compute_api:os-instance-usage-audit-log:list
rule:system_reader_api
GET /os-instance_usage_audit_log
system
List all usage audits.
os_compute_api:os-instance-usage-audit-log:show
rule:system_reader_api
GET /os-instance_usage_audit_log/{before_timestamp}
system
List all usage audits occurred before a specified time for all servers on all compute hosts where usage auditing is configured
os_compute_api:ips:show
rule:system_or_project_reader
GET /servers/{server_id}/ips/{network_label}
system
project
Show IP addresses details for a network label of a server
os_compute_api:ips:index
rule:system_or_project_reader
GET /servers/{server_id}/ips
system
project
List IP addresses that are assigned to a server
os_compute_api:os-keypairs:index
(rule:system_reader_api) or user_id:%(user_id)s
GET /os-keypairs
system
project
List all keypairs
os_compute_api:os-keypairs:create
(rule:system_admin_api) or user_id:%(user_id)s
POST /os-keypairs
system
project
Create a keypair
os_compute_api:os-keypairs:delete
(rule:system_admin_api) or user_id:%(user_id)s
DELETE /os-keypairs/{keypair_name}
system
project
Delete a keypair
os_compute_api:os-keypairs:show
(rule:system_reader_api) or user_id:%(user_id)s
GET /os-keypairs/{keypair_name}
system
project
Show details of a keypair
os_compute_api:limits
@
GET /limits
system
project
Show rate and absolute limits for the current user project
os_compute_api:limits:other_project
rule:system_reader_api
GET /limits
system
Show rate and absolute limits of other project.
This policy only checks if the user has access to the requested project limits. And this check is performed only after the check os_compute_api:limits passes
os_compute_api:os-lock-server:lock
rule:system_admin_or_owner
POST /servers/{server_id}/action (lock)
system
project
Lock a server
os_compute_api:os-lock-server:unlock
rule:system_admin_or_owner
POST /servers/{server_id}/action (unlock)
system
project
Unlock a server
os_compute_api:os-lock-server:unlock:unlock_override
rule:system_admin_api
POST /servers/{server_id}/action (unlock)
system
project
Unlock a server, regardless who locked the server.
This check is performed only after the check os_compute_api:os-lock-server:unlock passes
os_compute_api:os-migrate-server:migrate
rule:system_admin_api
POST /servers/{server_id}/action (migrate)
system
project
Cold migrate a server to a host
os_compute_api:os-migrate-server:migrate_live
rule:system_admin_api
POST /servers/{server_id}/action (os-migrateLive)
system
project
Live migrate a server to a new host without a reboot
os_compute_api:os-migrations:index
rule:system_reader_api
GET /os-migrations
system
List migrations
os_compute_api:os-multinic:add
rule:system_admin_or_owner
POST /servers/{server_id}/action (addFixedIp)
system
project
Add a fixed IP address to a server.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-multinic:remove
rule:system_admin_or_owner
POST /servers/{server_id}/action (removeFixedIp)
system
project
Remove a fixed IP address from a server.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-networks:list
rule:system_or_project_reader
GET /os-networks
system
project
List networks for the project.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-networks:show
rule:system_or_project_reader
GET /os-networks/{network_id}
system
project
Show network details.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-pause-server:pause
rule:system_admin_or_owner
POST /servers/{server_id}/action (pause)
system
project
Pause a server
os_compute_api:os-pause-server:unpause
rule:system_admin_or_owner
POST /servers/{server_id}/action (unpause)
system
project
Unpause a paused server
os_compute_api:os-quota-class-sets:show
rule:system_reader_api
GET /os-quota-class-sets/{quota_class}
system
List quotas for specific quota classs
os_compute_api:os-quota-class-sets:update
rule:system_admin_api
PUT /os-quota-class-sets/{quota_class}
system
Update quotas for specific quota class
os_compute_api:os-quota-sets:update
rule:system_admin_api
PUT /os-quota-sets/{tenant_id}
system
Update the quotas
os_compute_api:os-quota-sets:defaults
@
GET /os-quota-sets/{tenant_id}/defaults
system
project
List default quotas
os_compute_api:os-quota-sets:show
rule:system_or_project_reader
GET /os-quota-sets/{tenant_id}
system
project
Show a quota
os_compute_api:os-quota-sets:delete
rule:system_admin_api
DELETE /os-quota-sets/{tenant_id}
system
Revert quotas to defaults
os_compute_api:os-quota-sets:detail
rule:system_or_project_reader
GET /os-quota-sets/{tenant_id}/detail
system
project
Show the detail of quota
os_compute_api:os-remote-consoles
rule:system_admin_or_owner
POST /servers/{server_id}/action (os-getRDPConsole)
POST /servers/{server_id}/action (os-getSerialConsole)
POST /servers/{server_id}/action (os-getSPICEConsole)
POST /servers/{server_id}/action (os-getVNCConsole)
POST /servers/{server_id}/remote-consoles
system
project
Generate a URL to access remove server console.
This policy is for POST /remote-consoles
API and below Server actions APIs
are deprecated:
os-getRDPConsole
os-getSerialConsole
os-getSPICEConsole
os-getVNCConsole
.
os_compute_api:os-rescue
rule:system_admin_or_owner
POST /servers/{server_id}/action (rescue)
system
project
Rescue a server
os_compute_api:os-unrescue
rule:system_admin_or_owner
POST /servers/{server_id}/action (unrescue)
system
project
Unrescue a server
os_compute_api:os-security-groups:get
rule:system_or_project_reader
GET /os-security-groups
system
project
List security groups. This API is deprecated.
os_compute_api:os-security-groups:show
rule:system_or_project_reader
GET /os-security-groups/{security_group_id}
system
project
Show security group. This API is deprecated.
os_compute_api:os-security-groups:create
rule:system_admin_or_owner
POST /os-security-groups
system
project
Create security group. This API is deprecated.
os_compute_api:os-security-groups:update
rule:system_admin_or_owner
PUT /os-security-groups/{security_group_id}
system
project
Update security group. This API is deprecated.
os_compute_api:os-security-groups:delete
rule:system_admin_or_owner
DELETE /os-security-groups/{security_group_id}
system
project
Delete security group. This API is deprecated.
os_compute_api:os-security-groups:rule:create
rule:system_admin_or_owner
POST /os-security-group-rules
system
project
Create security group Rule. This API is deprecated.
os_compute_api:os-security-groups:rule:delete
rule:system_admin_or_owner
DELETE /os-security-group-rules/{security_group_id}
system
project
Delete security group Rule. This API is deprecated.
os_compute_api:os-security-groups:list
rule:system_or_project_reader
GET /servers/{server_id}/os-security-groups
system
project
List security groups of server.
os_compute_api:os-security-groups:add
rule:system_admin_or_owner
POST /servers/{server_id}/action (addSecurityGroup)
system
project
Add security groups to server.
os_compute_api:os-security-groups:remove
rule:system_admin_or_owner
POST /servers/{server_id}/action (removeSecurityGroup)
system
project
Remove security groups from server.
os_compute_api:os-server-diagnostics
rule:system_admin_api
GET /servers/{server_id}/diagnostics
system
project
Show the usage data for a server
os_compute_api:os-server-external-events:create
rule:system_admin_api
POST /os-server-external-events
system
Create one or more external events
os_compute_api:os-server-groups:create
rule:project_member_api
POST /os-server-groups
project
Create a new server group
os_compute_api:os-server-groups:delete
rule:system_admin_or_owner
DELETE /os-server-groups/{server_group_id}
system
project
Delete a server group
os_compute_api:os-server-groups:index
rule:system_or_project_reader
GET /os-server-groups
system
project
List all server groups
os_compute_api:os-server-groups:index:all_projects
rule:system_reader_api
GET /os-server-groups
system
List all server groups for all projects
os_compute_api:os-server-groups:show
rule:system_or_project_reader
GET /os-server-groups/{server_group_id}
system
project
Show details of a server group
os_compute_api:server-metadata:index
rule:system_or_project_reader
GET /servers/{server_id}/metadata
system
project
List all metadata of a server
os_compute_api:server-metadata:show
rule:system_or_project_reader
GET /servers/{server_id}/metadata/{key}
system
project
Show metadata for a server
os_compute_api:server-metadata:create
rule:system_admin_or_owner
POST /servers/{server_id}/metadata
system
project
Create metadata for a server
os_compute_api:server-metadata:update_all
rule:system_admin_or_owner
PUT /servers/{server_id}/metadata
system
project
Replace metadata for a server
os_compute_api:server-metadata:update
rule:system_admin_or_owner
PUT /servers/{server_id}/metadata/{key}
system
project
Update metadata from a server
os_compute_api:server-metadata:delete
rule:system_admin_or_owner
DELETE /servers/{server_id}/metadata/{key}
system
project
Delete metadata from a server
os_compute_api:os-server-password:show
rule:system_or_project_reader
GET /servers/{server_id}/os-server-password
system
project
Show the encrypted administrative password of a server
os_compute_api:os-server-password:clear
rule:system_admin_or_owner
DELETE /servers/{server_id}/os-server-password
system
project
Clear the encrypted administrative password of a server
os_compute_api:os-server-tags:delete_all
rule:system_admin_or_owner
DELETE /servers/{server_id}/tags
system
project
Delete all the server tags
os_compute_api:os-server-tags:index
rule:system_or_project_reader
GET /servers/{server_id}/tags
system
project
List all tags for given server
os_compute_api:os-server-tags:update_all
rule:system_admin_or_owner
PUT /servers/{server_id}/tags
system
project
Replace all tags on specified server with the new set of tags.
os_compute_api:os-server-tags:delete
rule:system_admin_or_owner
DELETE /servers/{server_id}/tags/{tag}
system
project
Delete a single tag from the specified server
os_compute_api:os-server-tags:update
rule:system_admin_or_owner
PUT /servers/{server_id}/tags/{tag}
system
project
Add a single tag to the server if server has no specified tag
os_compute_api:os-server-tags:show
rule:system_or_project_reader
GET /servers/{server_id}/tags/{tag}
system
project
Check tag existence on the server.
compute:server:topology:index
rule:system_or_project_reader
GET /servers/{server_id}/topology
system
project
Show the NUMA topology data for a server
compute:server:topology:host:index
rule:system_reader_api
GET /servers/{server_id}/topology
system
Show the NUMA topology data for a server with host NUMA ID and CPU pinning information
os_compute_api:servers:index
rule:system_or_project_reader
GET /servers
system
project
List all servers
os_compute_api:servers:detail
rule:system_or_project_reader
GET /servers/detail
system
project
List all servers with detailed information
os_compute_api:servers:index:get_all_tenants
rule:system_reader_api
GET /servers
system
List all servers for all projects
os_compute_api:servers:detail:get_all_tenants
rule:system_reader_api
GET /servers/detail
system
List all servers with detailed information for all projects
os_compute_api:servers:allow_all_filters
rule:system_reader_api
GET /servers
GET /servers/detail
system
Allow all filters when listing servers
os_compute_api:servers:show
rule:system_or_project_reader
GET /servers/{server_id}
system
project
Show a server
os_compute_api:servers:show:host_status
rule:system_admin_api
GET /servers/{server_id}
GET /servers/detail
PUT /servers/{server_id}
POST /servers/{server_id}/action (rebuild)
system
project
Show a server with additional host status information.
This means host_status will be shown irrespective of status value. If showing
only host_status UNKNOWN is desired, use the
os_compute_api:servers:show:host_status:unknown-only
policy rule.
Microvision 2.75 added the host_status
attribute in the
PUT /servers/{server_id}
and POST /servers/{server_id}/action (rebuild)
API responses which are also controlled by this policy rule, like the
GET /servers*
APIs.
os_compute_api:servers:show:host_status:unknown-only
rule:system_admin_api
GET /servers/{server_id}
GET /servers/detail
PUT /servers/{server_id}
POST /servers/{server_id}/action (rebuild)
system
project
Show a server with additional host status information, only if host status is UNKNOWN.
This policy rule will only be enforced when the
os_compute_api:servers:show:host_status
policy rule does not pass for the
request. An example policy configuration could be where the
os_compute_api:servers:show:host_status
rule is set to allow admin-only and
the os_compute_api:servers:show:host_status:unknown-only
rule is set to
allow everyone.
os_compute_api:servers:create
rule:project_member_api
POST /servers
project
Create a server
os_compute_api:servers:create:forced_host
rule:project_admin_api
POST /servers
system
project
Create a server on the specified host and/or node.
In this case, the server is forced to launch on the specified
host and/or node by bypassing the scheduler filters unlike the
compute:servers:create:requested_destination
rule.
compute:servers:create:requested_destination
rule:project_admin_api
POST /servers
system
project
Create a server on the requested compute service host and/or hypervisor_hostname.
In this case, the requested host and/or hypervisor_hostname is
validated by the scheduler filters unlike the
os_compute_api:servers:create:forced_host
rule.
os_compute_api:servers:create:attach_volume
rule:project_member_api
POST /servers
project
Create a server with the requested volume attached to it
os_compute_api:servers:create:attach_network
rule:project_member_api
POST /servers
project
Create a server with the requested network attached to it
os_compute_api:servers:create:trusted_certs
rule:project_member_api
POST /servers
project
Create a server with trusted image certificate IDs
os_compute_api:servers:create:zero_disk_flavor
rule:project_admin_api
POST /servers
system
project
This rule controls the compute API validation behavior of creating a server with a flavor that has 0 disk, indicating the server should be volume-backed.
For a flavor with disk=0, the root disk will be set to exactly the size of the image used to deploy the instance. However, in this case the filter_scheduler cannot select the compute host based on the virtual image size. Therefore, 0 should only be used for volume booted instances or for testing purposes.
WARNING: It is a potential security exposure to enable this policy rule if users can upload their own images since repeated attempts to create a disk=0 flavor instance with a large image can exhaust the local disk of the compute (or shared storage cluster). See bug https://bugs.launchpad.net/nova/+bug/1739646 for details.
network:attach_external_network
rule:project_admin_api
POST /servers
POST /servers/{server_id}/os-interface
system
project
Attach an unshared external network to a server
os_compute_api:servers:delete
rule:system_admin_or_owner
DELETE /servers/{server_id}
system
project
Delete a server
os_compute_api:servers:update
rule:system_admin_or_owner
PUT /servers/{server_id}
system
project
Update a server
os_compute_api:servers:confirm_resize
rule:system_admin_or_owner
POST /servers/{server_id}/action (confirmResize)
system
project
Confirm a server resize
os_compute_api:servers:revert_resize
rule:system_admin_or_owner
POST /servers/{server_id}/action (revertResize)
system
project
Revert a server resize
os_compute_api:servers:reboot
rule:system_admin_or_owner
POST /servers/{server_id}/action (reboot)
system
project
Reboot a server
os_compute_api:servers:resize
rule:system_admin_or_owner
POST /servers/{server_id}/action (resize)
system
project
Resize a server
compute:servers:resize:cross_cell
!
POST /servers/{server_id}/action (resize)
system
project
Resize a server across cells. By default, this is disabled for all users and recommended to be tested in a deployment for admin users before opening it up to non-admin users. Resizing within a cell is the default preferred behavior even if this is enabled.
os_compute_api:servers:rebuild
rule:system_admin_or_owner
POST /servers/{server_id}/action (rebuild)
system
project
Rebuild a server
os_compute_api:servers:rebuild:trusted_certs
rule:system_admin_or_owner
POST /servers/{server_id}/action (rebuild)
system
project
Rebuild a server with trusted image certificate IDs
os_compute_api:servers:create_image
rule:system_admin_or_owner
POST /servers/{server_id}/action (createImage)
system
project
Create an image from a server
os_compute_api:servers:create_image:allow_volume_backed
rule:system_admin_or_owner
POST /servers/{server_id}/action (createImage)
system
project
Create an image from a volume backed server
os_compute_api:servers:start
rule:system_admin_or_owner
POST /servers/{server_id}/action (os-start)
system
project
Start a server
os_compute_api:servers:stop
rule:system_admin_or_owner
POST /servers/{server_id}/action (os-stop)
system
project
Stop a server
os_compute_api:servers:trigger_crash_dump
rule:system_admin_or_owner
POST /servers/{server_id}/action (trigger_crash_dump)
system
project
Trigger crash dump in a server
os_compute_api:servers:migrations:show
rule:system_reader_api
GET /servers/{server_id}/migrations/{migration_id}
system
project
Show details for an in-progress live migration for a given server
os_compute_api:servers:migrations:force_complete
rule:system_admin_api
POST /servers/{server_id}/migrations/{migration_id}/action (force_complete)
system
project
Force an in-progress live migration for a given server to complete
os_compute_api:servers:migrations:delete
rule:system_admin_api
DELETE /servers/{server_id}/migrations/{migration_id}
system
project
Delete(Abort) an in-progress live migration
os_compute_api:servers:migrations:index
rule:system_reader_api
GET /servers/{server_id}/migrations
system
project
Lists in-progress live migrations for a given server
os_compute_api:os-services:list
rule:system_reader_api
GET /os-services
system
List all running Compute services in a region.
os_compute_api:os-services:update
rule:system_admin_api
PUT /os-services/{service_id}
system
Update a Compute service.
os_compute_api:os-services:delete
rule:system_admin_api
DELETE /os-services/{service_id}
system
Delete a Compute service.
os_compute_api:os-shelve:shelve
rule:system_admin_or_owner
POST /servers/{server_id}/action (shelve)
system
project
Shelve server
os_compute_api:os-shelve:unshelve
rule:system_admin_or_owner
POST /servers/{server_id}/action (unshelve)
system
project
Unshelve (restore) shelved server
os_compute_api:os-shelve:shelve_offload
rule:system_admin_api
POST /servers/{server_id}/action (shelveOffload)
system
project
Shelf-offload (remove) server
os_compute_api:os-simple-tenant-usage:show
rule:system_or_project_reader
GET /os-simple-tenant-usage/{tenant_id}
system
project
Show usage statistics for a specific tenant
os_compute_api:os-simple-tenant-usage:list
rule:system_reader_api
GET /os-simple-tenant-usage
system
List per tenant usage statistics for all tenants
os_compute_api:os-suspend-server:resume
rule:system_admin_or_owner
POST /servers/{server_id}/action (resume)
system
project
Resume suspended server
os_compute_api:os-suspend-server:suspend
rule:system_admin_or_owner
POST /servers/{server_id}/action (suspend)
system
project
Suspend server
os_compute_api:os-tenant-networks:list
rule:system_or_project_reader
GET /os-tenant-networks
system
project
List project networks.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-tenant-networks:show
rule:system_or_project_reader
GET /os-tenant-networks/{network_id}
system
project
Show project network details.
This API is proxy calls to the Network service. This is deprecated.
os_compute_api:os-volumes:list
rule:system_or_project_reader
GET /os-volumes
system
project
List volumes.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:create
rule:system_admin_or_owner
POST /os-volumes
system
project
Create volume.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:detail
rule:system_or_project_reader
GET /os-volumes/detail
system
project
List volumes detail.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:show
rule:system_or_project_reader
GET /os-volumes/{volume_id}
system
project
Show volume.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:delete
rule:system_admin_or_owner
DELETE /os-volumes/{volume_id}
system
project
Delete volume.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:snapshots:list
rule:system_or_project_reader
GET /os-snapshots
system
project
List snapshots.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:snapshots:create
rule:system_admin_or_owner
POST /os-snapshots
system
project
Create snapshots.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:snapshots:detail
rule:system_or_project_reader
GET /os-snapshots/detail
system
project
List snapshots details.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:snapshots:show
rule:system_or_project_reader
GET /os-snapshots/{snapshot_id}
system
project
Show snapshot.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes:snapshots:delete
rule:system_admin_or_owner
DELETE /os-snapshots/{snapshot_id}
system
project
Delete snapshot.
This API is a proxy call to the Volume service. It is deprecated.
os_compute_api:os-volumes-attachments:index
rule:system_or_project_reader
GET /servers/{server_id}/os-volume_attachments
system
project
List volume attachments for an instance
os_compute_api:os-volumes-attachments:create
rule:system_admin_or_owner
POST /servers/{server_id}/os-volume_attachments
system
project
Attach a volume to an instance
os_compute_api:os-volumes-attachments:show
rule:system_or_project_reader
GET /servers/{server_id}/os-volume_attachments/{volume_id}
system
project
Show details of a volume attachment
os_compute_api:os-volumes-attachments:update
rule:system_admin_or_owner
PUT /servers/{server_id}/os-volume_attachments/{volume_id}
system
project
Update a volume attachment. New ‘update’ policy about ‘swap + update’ request (which is possible only >2.85) only <swap policy> is checked. We expect <swap policy> to be always superset of this policy permission.
os_compute_api:os-volumes-attachments:swap
rule:system_admin_api
PUT /servers/{server_id}/os-volume_attachments/{volume_id}
system
Update a volume attachment with a different volumeId
os_compute_api:os-volumes-attachments:delete
rule:system_admin_or_owner
DELETE /servers/{server_id}/os-volume_attachments/{volume_id}
system
project
Detach a volume from an instance
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.