Nova Policies¶
The following is an overview of all available policies in Nova.
For a sample configuration file, refer to Sample Nova Policy File.
nova¶
context_is_admin
Default: role:admin
Decides what is required for the ‘is_admin:True’ check to succeed.
admin_or_owner
Default: is_admin:True or project_id:%(project_id)s
Default rule for most non-Admin APIs.
admin_api
Default: is_admin:True
Default rule for most Admin APIs.
system_admin_api
Default: role:admin and system_scope:all
Default rule for System Admin APIs.
system_reader_api
Default: role:reader and system_scope:all
Default rule for System level read only APIs.
project_member_api
Default: role:member and project_id:%(project_id)s
Default rule for Project level non admin APIs.
project_reader_api
Default: role:reader and project_id:%(project_id)s
Default rule for Project level read only APIs.
system_admin_or_owner
Default: rule:system_admin_api or rule:project_member_api
Default rule for System admin+owner APIs.
system_or_project_reader
Default: rule:system_reader_api or rule:project_reader_api
Default rule for System+Project read only APIs.
os_compute_api:os-admin-actions:reset_state
Default: rule:system_admin_api
Operations: - POST
/servers/{server_id}/action (os-resetState)
Scope Types: - system
Reset the state of a given server
- POST
os_compute_api:os-admin-actions:inject_network_info
Default: rule:system_admin_api
Operations: - POST
/servers/{server_id}/action (injectNetworkInfo)
Scope Types: - system
Inject network information into the server
- POST
os_compute_api:os-admin-actions:reset_network
Default: rule:system_admin_api
Operations: - POST
/servers/{server_id}/action (resetNetwork)
Scope Types: - system
Reset networking on a server
- POST
os_compute_api:os-admin-password
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/action (changePassword)
Scope Types: - system
- project
Change the administrative password for a server
- POST
os_compute_api:os-agents
Default: rule:admin_api
Operations: - GET
/os-agents
- POST
/os-agents
- PUT
/os-agents/{agent_build_id}
- DELETE
/os-agents/{agent_build_id}
Scope Types: - system
Create, list, update, and delete guest agent builds
This is XenAPI driver specific. It is used to force the upgrade of the XenAPI guest agent on instance boot.
- GET
os_compute_api:os-aggregates:set_metadata
Default: rule:admin_api
Operations: - POST
/os-aggregates/{aggregate_id}/action (set_metadata)
Scope Types: - system
Create or replace metadata for an aggregate
- POST
os_compute_api:os-aggregates:add_host
Default: rule:admin_api
Operations: - POST
/os-aggregates/{aggregate_id}/action (add_host)
Scope Types: - system
Add a host to an aggregate
- POST
os_compute_api:os-aggregates:create
Default: rule:admin_api
Operations: - POST
/os-aggregates
Scope Types: - system
Create an aggregate
- POST
os_compute_api:os-aggregates:remove_host
Default: rule:admin_api
Operations: - POST
/os-aggregates/{aggregate_id}/action (remove_host)
Scope Types: - system
Remove a host from an aggregate
- POST
os_compute_api:os-aggregates:update
Default: rule:admin_api
Operations: - PUT
/os-aggregates/{aggregate_id}
Scope Types: - system
Update name and/or availability zone for an aggregate
- PUT
os_compute_api:os-aggregates:index
Default: rule:admin_api
Operations: - GET
/os-aggregates
Scope Types: - system
List all aggregates
- GET
os_compute_api:os-aggregates:delete
Default: rule:admin_api
Operations: - DELETE
/os-aggregates/{aggregate_id}
Scope Types: - system
Delete an aggregate
- DELETE
os_compute_api:os-aggregates:show
Default: rule:admin_api
Operations: - GET
/os-aggregates/{aggregate_id}
Scope Types: - system
Show details for an aggregate
- GET
compute:aggregates:images
Default: rule:admin_api
Operations: - POST
/os-aggregates/{aggregate_id}/images
Scope Types: - system
Request image caching for an aggregate
- POST
os_compute_api:os-assisted-volume-snapshots:create
Default: rule:system_admin_api
Operations: - POST
/os-assisted-volume-snapshots
Scope Types: - system
Create an assisted volume snapshot
- POST
os_compute_api:os-assisted-volume-snapshots:delete
Default: rule:system_admin_api
Operations: - DELETE
/os-assisted-volume-snapshots/{snapshot_id}
Scope Types: - system
Delete an assisted volume snapshot
- DELETE
os_compute_api:os-attach-interfaces:list
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-interface
Scope Types: - system
- project
List port interfaces attached to a server
- GET
os_compute_api:os-attach-interfaces:show
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-interface/{port_id}
Scope Types: - system
- project
Show details of a port interface attached to a server
- GET
os_compute_api:os-attach-interfaces:create
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/os-interface
Scope Types: - system
- project
Attach an interface to a server
- POST
os_compute_api:os-attach-interfaces:delete
Default: rule:system_admin_or_owner
Operations: - DELETE
/servers/{server_id}/os-interface/{port_id}
Scope Types: - system
- project
Detach an interface from a server
- DELETE
os_compute_api:os-availability-zone:list
Default: @
Operations: - GET
/os-availability-zone
Scope Types: - system
- project
List availability zone information without host information
- GET
os_compute_api:os-availability-zone:detail
Default: rule:system_reader_api
Operations: - GET
/os-availability-zone/detail
Scope Types: - system
List detailed availability zone information with host information
- GET
os_compute_api:os-baremetal-nodes
Default: rule:admin_api
Operations: - GET
/os-baremetal-nodes
- GET
/os-baremetal-nodes/{node_id}
List and show details of bare metal nodes.
These APIs are proxy calls to the Ironic service and are deprecated.
- GET
os_compute_api:os-console-auth-tokens
Default: rule:admin_api
Operations: - GET
/os-console-auth-tokens/{console_token}
Scope Types: - system
Show console connection information for a given console authentication token
- GET
os_compute_api:os-console-output
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/action (os-getConsoleOutput)
Scope Types: - system
- project
Show console output for a server
- POST
os_compute_api:os-create-backup
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/action (createBackup)
Scope Types: - system
- project
Create a back up of a server
- POST
os_compute_api:os-deferred-delete:restore
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/action (restore)
Scope Types: - system
- project
Restore a soft deleted server
- POST
os_compute_api:os-deferred-delete:force
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/action (forceDelete)
Scope Types: - system
- project
Force delete a server before deferred cleanup
- POST
os_compute_api:os-evacuate
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/action (evacuate)
Scope Types: - system
Evacuate a server from a failed host to a new host
- POST
os_compute_api:os-extended-server-attributes
Default: rule:admin_api
Operations: - GET
/servers/{id}
- GET
/servers/detail
- PUT
/servers/{server_id}
- POST
/servers/{server_id}/action (rebuild)
Return extended attributes for server.
This rule will control the visibility for a set of servers attributes:
OS-EXT-SRV-ATTR:host
OS-EXT-SRV-ATTR:instance_name
OS-EXT-SRV-ATTR:reservation_id
(since microversion 2.3)OS-EXT-SRV-ATTR:launch_index
(since microversion 2.3)OS-EXT-SRV-ATTR:hostname
(since microversion 2.3)OS-EXT-SRV-ATTR:kernel_id
(since microversion 2.3)OS-EXT-SRV-ATTR:ramdisk_id
(since microversion 2.3)OS-EXT-SRV-ATTR:root_device_name
(since microversion 2.3)OS-EXT-SRV-ATTR:user_data
(since microversion 2.3)
Microvision 2.75 added the above attributes in the
PUT /servers/{server_id}
andPOST /servers/{server_id}/action (rebuild)
API responses which are also controlled by this policy rule, like theGET /servers*
APIs.- GET
os_compute_api:extensions
Default: rule:admin_or_owner
Operations: - GET
/extensions
- GET
/extensions/{alias}
List available extensions and show information for an extension by alias
- GET
os_compute_api:os-flavor-access:add_tenant_access
Default: rule:admin_api
Operations: - POST
/flavors/{flavor_id}/action (addTenantAccess)
Scope Types: - system
Add flavor access to a tenant
- POST
os_compute_api:os-flavor-access:remove_tenant_access
Default: rule:admin_api
Operations: - POST
/flavors/{flavor_id}/action (removeTenantAccess)
Scope Types: - system
Remove flavor access from a tenant
- POST
os_compute_api:os-flavor-access
Default: rule:admin_or_owner
Operations: - GET
/flavors/{flavor_id}/os-flavor-access
Scope Types: - system
List flavor access information
Allows access to the full list of tenants that have access to a flavor via an os-flavor-access API.
- GET
os_compute_api:os-flavor-extra-specs:show
Default: rule:admin_or_owner
Operations: - GET
/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
Show an extra spec for a flavor
- GET
os_compute_api:os-flavor-extra-specs:create
Default: rule:admin_api
Operations: - POST
/flavors/{flavor_id}/os-extra_specs/
Create extra specs for a flavor
- POST
os_compute_api:os-flavor-extra-specs:update
Default: rule:admin_api
Operations: - PUT
/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
Update an extra spec for a flavor
- PUT
os_compute_api:os-flavor-extra-specs:delete
Default: rule:admin_api
Operations: - DELETE
/flavors/{flavor_id}/os-extra_specs/{flavor_extra_spec_key}
Delete an extra spec for a flavor
- DELETE
os_compute_api:os-flavor-extra-specs:index
Default: rule:admin_or_owner
Operations: - GET
/flavors/{flavor_id}/os-extra_specs/
- GET
/servers/detail
- GET
/servers/{server_id}
- PUT
/servers/{server_id}
- POST
/servers/{server_id}/action (rebuild)
- POST
/flavors
- GET
/flavors/detail
- GET
/flavors/{flavor_id}
- PUT
/flavors/{flavor_id}
List extra specs for a flavor. Starting with microversion 2.47, the flavor used for a server is also returned in the response when showing server details, updating a server or rebuilding a server. Starting with microversion 2.61, extra specs may be returned in responses for the flavor resource.
- GET
os_compute_api:os-flavor-manage:create
Default: rule:admin_api
Operations: - POST
/flavors
Create a flavor
- POST
os_compute_api:os-flavor-manage:update
Default: rule:admin_api
Operations: - PUT
/flavors/{flavor_id}
Update a flavor
- PUT
os_compute_api:os-flavor-manage:delete
Default: rule:admin_api
Operations: - DELETE
/flavors/{flavor_id}
Delete a flavor
- DELETE
os_compute_api:os-floating-ip-pools
Default: rule:admin_or_owner
Operations: - GET
/os-floating-ip-pools
List floating IP pools. This API is deprecated.
- GET
os_compute_api:os-floating-ips
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (addFloatingIp)
- POST
/servers/{server_id}/action (removeFloatingIp)
- GET
/os-floating-ips
- POST
/os-floating-ips
- GET
/os-floating-ips/{floating_ip_id}
- DELETE
/os-floating-ips/{floating_ip_id}
Manage a project’s floating IPs. These APIs are all deprecated.
- POST
os_compute_api:os-hosts
Default: rule:admin_api
Operations: - GET
/os-hosts
- GET
/os-hosts/{host_name}
- PUT
/os-hosts/{host_name}
- GET
/os-hosts/{host_name}/reboot
- GET
/os-hosts/{host_name}/shutdown
- GET
/os-hosts/{host_name}/startup
List, show and manage physical hosts.
These APIs are all deprecated in favor of os-hypervisors and os-services.
- GET
os_compute_api:os-hypervisors
Default: rule:admin_api
Operations: - GET
/os-hypervisors
- GET
/os-hypervisors/details
- GET
/os-hypervisors/statistics
- GET
/os-hypervisors/{hypervisor_id}
- GET
/os-hypervisors/{hypervisor_id}/uptime
- GET
/os-hypervisors/{hypervisor_hostname_pattern}/search
- GET
/os-hypervisors/{hypervisor_hostname_pattern}/servers
Policy rule for hypervisor related APIs.
This rule will be checked for the following APIs:
List all hypervisors, list all hypervisors with details, show summary statistics for all hypervisors over all compute nodes, show details for a hypervisor, show the uptime of a hypervisor, search hypervisor by hypervisor_hostname pattern and list all servers on hypervisors that can match the provided hypervisor_hostname pattern.
- GET
os_compute_api:os-instance-actions:events
Default: rule:system_reader_api
Operations: - GET
/servers/{server_id}/os-instance-actions/{request_id}
Scope Types: - system
Add events details in action details for a server. This check is performed only after the check os_compute_api:os-instance-actions:show passes. Beginning with Microversion 2.51, events details are always included; traceback information is provided per event if policy enforcement passes. Beginning with Microversion 2.62, each event includes a hashed host identifier and, if policy enforcement passes, the name of the host.
- GET
os_compute_api:os-instance-actions:list
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-instance-actions
Scope Types: - system
- project
List actions for a server.
- GET
os_compute_api:os-instance-actions:show
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-instance-actions/{request_id}
Scope Types: - system
- project
Show action details for a server.
- GET
os_compute_api:os-instance-usage-audit-log
Default: rule:admin_api
Operations: - GET
/os-instance_usage_audit_log
- GET
/os-instance_usage_audit_log/{before_timestamp}
List all usage audits and that occurred before a specified time for all servers on all compute hosts where usage auditing is configured
- GET
os_compute_api:ips:show
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/ips/{network_label}
Show IP addresses details for a network label of a server
- GET
os_compute_api:ips:index
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/ips
List IP addresses that are assigned to a server
- GET
os_compute_api:os-keypairs:index
Default: rule:admin_api or user_id:%(user_id)s
Operations: - GET
/os-keypairs
List all keypairs
- GET
os_compute_api:os-keypairs:create
Default: rule:admin_api or user_id:%(user_id)s
Operations: - POST
/os-keypairs
Create a keypair
- POST
os_compute_api:os-keypairs:delete
Default: rule:admin_api or user_id:%(user_id)s
Operations: - DELETE
/os-keypairs/{keypair_name}
Delete a keypair
- DELETE
os_compute_api:os-keypairs:show
Default: rule:admin_api or user_id:%(user_id)s
Operations: - GET
/os-keypairs/{keypair_name}
Show details of a keypair
- GET
os_compute_api:limits
Default: rule:admin_or_owner
Operations: - GET
/limits
Show rate and absolute limits for the project
- GET
os_compute_api:os-lock-server:lock
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (lock)
Lock a server
- POST
os_compute_api:os-lock-server:unlock
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (unlock)
Unlock a server
- POST
os_compute_api:os-lock-server:unlock:unlock_override
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/action (unlock)
Unlock a server, regardless who locked the server.
This check is performed only after the check os_compute_api:os-lock-server:unlock passes
- POST
os_compute_api:os-migrate-server:migrate
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/action (migrate)
Cold migrate a server to a host
- POST
os_compute_api:os-migrate-server:migrate_live
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/action (os-migrateLive)
Live migrate a server to a new host without a reboot
- POST
os_compute_api:os-migrations:index
Default: rule:admin_api
Operations: - GET
/os-migrations
List migrations
- GET
os_compute_api:os-multinic
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (addFixedIp)
- POST
/servers/{server_id}/action (removeFixedIp)
Add or remove a fixed IP address from a server.
These APIs are proxy calls to the Network service. These are all deprecated.
- POST
os_compute_api:os-networks:view
Default: rule:admin_or_owner
Operations: - GET
/os-networks
- GET
/os-networks/{network_id}
List networks for the project and show details for a network.
These APIs are proxy calls to the Network service. These are all deprecated.
- GET
os_compute_api:os-pause-server:pause
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (pause)
Pause a server
- POST
os_compute_api:os-pause-server:unpause
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (unpause)
Unpause a paused server
- POST
os_compute_api:os-quota-class-sets:show
Default: is_admin:True or quota_class:%(quota_class)s
Operations: - GET
/os-quota-class-sets/{quota_class}
List quotas for specific quota classs
- GET
os_compute_api:os-quota-class-sets:update
Default: rule:admin_api
Operations: - PUT
/os-quota-class-sets/{quota_class}
Update quotas for specific quota class
- PUT
os_compute_api:os-quota-sets:update
Default: rule:admin_api
Operations: - PUT
/os-quota-sets/{tenant_id}
Update the quotas
- PUT
os_compute_api:os-quota-sets:defaults
Default: @
Operations: - GET
/os-quota-sets/{tenant_id}/defaults
List default quotas
- GET
os_compute_api:os-quota-sets:show
Default: rule:admin_or_owner
Operations: - GET
/os-quota-sets/{tenant_id}
Show a quota
- GET
os_compute_api:os-quota-sets:delete
Default: rule:admin_api
Operations: - DELETE
/os-quota-sets/{tenant_id}
Revert quotas to defaults
- DELETE
os_compute_api:os-quota-sets:detail
Default: rule:admin_or_owner
Operations: - GET
/os-quota-sets/{tenant_id}/detail
Show the detail of quota
- GET
os_compute_api:os-remote-consoles
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (os-getRDPConsole)
- POST
/servers/{server_id}/action (os-getSerialConsole)
- POST
/servers/{server_id}/action (os-getSPICEConsole)
- POST
/servers/{server_id}/action (os-getVNCConsole)
- POST
/servers/{server_id}/remote-consoles
Generate a URL to access remove server console
- POST
os_compute_api:os-rescue
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (rescue)
- POST
/servers/{server_id}/action (unrescue)
Rescue/unrescue a server
- POST
os_compute_api:os-security-groups
Default: rule:admin_or_owner
Operations: - GET
/os-security-groups
- GET
/os-security-groups/{security_group_id}
- POST
/os-security-groups
- PUT
/os-security-groups/{security_group_id}
- DELETE
/os-security-groups/{security_group_id}
- GET
/servers/{server_id}/os-security-groups
- POST
/servers/{server_id}/action (addSecurityGroup)
- POST
/servers/{server_id}/action (removeSecurityGroup)
List, show, add, or remove security groups.
APIs which are directly related to security groups resource are deprecated: Lists, shows information for, creates, updates and deletes security groups. Creates and deletes security group rules. All these APIs are deprecated.
APIs which are related to server resource are not deprecated: Lists Security Groups for a server. Add Security Group to a server and remove security group from a server.
- GET
os_compute_api:os-server-diagnostics
Default: rule:admin_api
Operations: - GET
/servers/{server_id}/diagnostics
Show the usage data for a server
- GET
os_compute_api:os-server-external-events:create
Default: rule:admin_api
Operations: - POST
/os-server-external-events
Create one or more external events
- POST
os_compute_api:os-server-groups:create
Default: rule:admin_or_owner
Operations: - POST
/os-server-groups
Create a new server group
- POST
os_compute_api:os-server-groups:delete
Default: rule:admin_or_owner
Operations: - DELETE
/os-server-groups/{server_group_id}
Delete a server group
- DELETE
os_compute_api:os-server-groups:index
Default: rule:admin_or_owner
Operations: - GET
/os-server-groups
List all server groups
- GET
os_compute_api:os-server-groups:show
Default: rule:admin_or_owner
Operations: - GET
/os-server-groups/{server_group_id}
Show details of a server group
- GET
os_compute_api:server-metadata:index
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/metadata
List all metadata of a server
- GET
os_compute_api:server-metadata:show
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/metadata/{key}
Show metadata for a server
- GET
os_compute_api:server-metadata:create
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/metadata
Create metadata for a server
- POST
os_compute_api:server-metadata:update_all
Default: rule:admin_or_owner
Operations: - PUT
/servers/{server_id}/metadata
Replace metadata for a server
- PUT
os_compute_api:server-metadata:update
Default: rule:admin_or_owner
Operations: - PUT
/servers/{server_id}/metadata/{key}
Update metadata from a server
- PUT
os_compute_api:server-metadata:delete
Default: rule:admin_or_owner
Operations: - DELETE
/servers/{server_id}/metadata/{key}
Delete metadata from a server
- DELETE
os_compute_api:os-server-password
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/os-server-password
- DELETE
/servers/{server_id}/os-server-password
Show and clear the encrypted administrative password of a server
- GET
os_compute_api:os-server-tags:delete_all
Default: rule:admin_or_owner
Operations: - DELETE
/servers/{server_id}/tags
Delete all the server tags
- DELETE
os_compute_api:os-server-tags:index
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/tags
List all tags for given server
- GET
os_compute_api:os-server-tags:update_all
Default: rule:admin_or_owner
Operations: - PUT
/servers/{server_id}/tags
Replace all tags on specified server with the new set of tags.
- PUT
os_compute_api:os-server-tags:delete
Default: rule:admin_or_owner
Operations: - DELETE
/servers/{server_id}/tags/{tag}
Delete a single tag from the specified server
- DELETE
os_compute_api:os-server-tags:update
Default: rule:admin_or_owner
Operations: - PUT
/servers/{server_id}/tags/{tag}
Add a single tag to the server if server has no specified tag
- PUT
os_compute_api:os-server-tags:show
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/tags/{tag}
Check tag existence on the server.
- GET
compute:server:topology:index
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}/topology
Show the NUMA topology data for a server
- GET
compute:server:topology:host:index
Default: rule:admin_api
Operations: - GET
/servers/{server_id}/topology
Show the NUMA topology data for a server with host NUMA ID and CPU pinning information
- GET
os_compute_api:servers:index
Default: rule:admin_or_owner
Operations: - GET
/servers
List all servers
- GET
os_compute_api:servers:detail
Default: rule:admin_or_owner
Operations: - GET
/servers/detail
List all servers with detailed information
- GET
os_compute_api:servers:index:get_all_tenants
Default: rule:admin_api
Operations: - GET
/servers
List all servers for all projects
- GET
os_compute_api:servers:detail:get_all_tenants
Default: rule:admin_api
Operations: - GET
/servers/detail
List all servers with detailed information for all projects
- GET
os_compute_api:servers:allow_all_filters
Default: rule:admin_api
Operations: - GET
/servers
- GET
/servers/detail
Allow all filters when listing servers
- GET
os_compute_api:servers:show
Default: rule:admin_or_owner
Operations: - GET
/servers/{server_id}
Show a server
- GET
os_compute_api:servers:show:host_status
Default: rule:admin_api
Operations: - GET
/servers/{server_id}
- GET
/servers/detail
- PUT
/servers/{server_id}
- POST
/servers/{server_id}/action (rebuild)
Show a server with additional host status information.
This means host_status will be shown irrespective of status value. If showing only host_status UNKNOWN is desired, use the
os_compute_api:servers:show:host_status:unknown-only
policy rule.Microvision 2.75 added the
host_status
attribute in thePUT /servers/{server_id}
andPOST /servers/{server_id}/action (rebuild)
API responses which are also controlled by this policy rule, like theGET /servers*
APIs.- GET
os_compute_api:servers:show:host_status:unknown-only
Default: rule:admin_api
Operations: - GET
/servers/{server_id}
- GET
/servers/detail
Show a server with additional host status information, only if host status is UNKNOWN.
This policy rule will only be enforced when the
os_compute_api:servers:show:host_status
policy rule does not pass for the request. An example policy configuration could be where theos_compute_api:servers:show:host_status
rule is set to allow admin-only and theos_compute_api:servers:show:host_status:unknown-only
rule is set to allow everyone.- GET
os_compute_api:servers:create
Default: rule:admin_or_owner
Operations: - POST
/servers
Create a server
- POST
os_compute_api:servers:create:forced_host
Default: rule:admin_api
Operations: - POST
/servers
Create a server on the specified host and/or node.
In this case, the server is forced to launch on the specified host and/or node by bypassing the scheduler filters unlike the
compute:servers:create:requested_destination
rule.- POST
compute:servers:create:requested_destination
Default: rule:admin_api
Operations: - POST
/servers
Create a server on the requested compute service host and/or hypervisor_hostname.
In this case, the requested host and/or hypervisor_hostname is validated by the scheduler filters unlike the
os_compute_api:servers:create:forced_host
rule.- POST
os_compute_api:servers:create:attach_volume
Default: rule:admin_or_owner
Operations: - POST
/servers
Create a server with the requested volume attached to it
- POST
os_compute_api:servers:create:attach_network
Default: rule:admin_or_owner
Operations: - POST
/servers
Create a server with the requested network attached to it
- POST
os_compute_api:servers:create:trusted_certs
Default: rule:admin_or_owner
Operations: - POST
/servers
Create a server with trusted image certificate IDs
- POST
os_compute_api:servers:create:zero_disk_flavor
Default: rule:admin_api
Operations: - POST
/servers
This rule controls the compute API validation behavior of creating a server with a flavor that has 0 disk, indicating the server should be volume-backed.
For a flavor with disk=0, the root disk will be set to exactly the size of the image used to deploy the instance. However, in this case the filter_scheduler cannot select the compute host based on the virtual image size. Therefore, 0 should only be used for volume booted instances or for testing purposes.
WARNING: It is a potential security exposure to enable this policy rule if users can upload their own images since repeated attempts to create a disk=0 flavor instance with a large image can exhaust the local disk of the compute (or shared storage cluster). See bug https://bugs.launchpad.net/nova/+bug/1739646 for details.
- POST
network:attach_external_network
Default: is_admin:True
Operations: - POST
/servers
- POST
/servers/{server_id}/os-interface
Attach an unshared external network to a server
- POST
os_compute_api:servers:delete
Default: rule:admin_or_owner
Operations: - DELETE
/servers/{server_id}
Delete a server
- DELETE
os_compute_api:servers:update
Default: rule:admin_or_owner
Operations: - PUT
/servers/{server_id}
Update a server
- PUT
os_compute_api:servers:confirm_resize
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (confirmResize)
Confirm a server resize
- POST
os_compute_api:servers:revert_resize
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (revertResize)
Revert a server resize
- POST
os_compute_api:servers:reboot
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (reboot)
Reboot a server
- POST
os_compute_api:servers:resize
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (resize)
Resize a server
- POST
compute:servers:resize:cross_cell
Default: !
Operations: - POST
/servers/{server_id}/action (resize)
Resize a server across cells. By default, this is disabled for all users and recommended to be tested in a deployment for admin users before opening it up to non-admin users. Resizing within a cell is the default preferred behavior even if this is enabled.
- POST
os_compute_api:servers:rebuild
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (rebuild)
Rebuild a server
- POST
os_compute_api:servers:rebuild:trusted_certs
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (rebuild)
Rebuild a server with trusted image certificate IDs
- POST
os_compute_api:servers:create_image
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (createImage)
Create an image from a server
- POST
os_compute_api:servers:create_image:allow_volume_backed
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (createImage)
Create an image from a volume backed server
- POST
os_compute_api:servers:start
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (os-start)
Start a server
- POST
os_compute_api:servers:stop
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (os-stop)
Stop a server
- POST
os_compute_api:servers:trigger_crash_dump
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (trigger_crash_dump)
Trigger crash dump in a server
- POST
os_compute_api:servers:migrations:show
Default: rule:admin_api
Operations: - GET
/servers/{server_id}/migrations/{migration_id}
Show details for an in-progress live migration for a given server
- GET
os_compute_api:servers:migrations:force_complete
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/migrations/{migration_id}/action (force_complete)
Force an in-progress live migration for a given server to complete
- POST
os_compute_api:servers:migrations:delete
Default: rule:admin_api
Operations: - DELETE
/servers/{server_id}/migrations/{migration_id}
Delete(Abort) an in-progress live migration
- DELETE
os_compute_api:servers:migrations:index
Default: rule:admin_api
Operations: - GET
/servers/{server_id}/migrations
Lists in-progress live migrations for a given server
- GET
os_compute_api:os-services:list
Default: rule:system_reader_api
Operations: - GET
/os-services
Scope Types: - system
List all running Compute services in a region.
- GET
os_compute_api:os-services:update
Default: rule:system_admin_api
Operations: - PUT
/os-services/{service_id}
Scope Types: - system
Update a Compute service.
- PUT
os_compute_api:os-services:delete
Default: rule:system_admin_api
Operations: - DELETE
/os-services/{service_id}
Scope Types: - system
Delete a Compute service.
- DELETE
os_compute_api:os-shelve:shelve
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (shelve)
Shelve server
- POST
os_compute_api:os-shelve:unshelve
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (unshelve)
Unshelve (restore) shelved server
- POST
os_compute_api:os-shelve:shelve_offload
Default: rule:admin_api
Operations: - POST
/servers/{server_id}/action (shelveOffload)
Shelf-offload (remove) server
- POST
os_compute_api:os-simple-tenant-usage:show
Default: rule:admin_or_owner
Operations: - GET
/os-simple-tenant-usage/{tenant_id}
Show usage statistics for a specific tenant
- GET
os_compute_api:os-simple-tenant-usage:list
Default: rule:admin_api
Operations: - GET
/os-simple-tenant-usage
List per tenant usage statistics for all tenants
- GET
os_compute_api:os-suspend-server:resume
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (resume)
Resume suspended server
- POST
os_compute_api:os-suspend-server:suspend
Default: rule:admin_or_owner
Operations: - POST
/servers/{server_id}/action (suspend)
Suspend server
- POST
os_compute_api:os-tenant-networks
Default: rule:admin_or_owner
Operations: - GET
/os-tenant-networks
- GET
/os-tenant-networks/{network_id}
Create, list, show information for, and delete project networks.
These APIs are proxy calls to the Network service. These are all deprecated.
- GET
os_compute_api:os-used-limits
Default: rule:admin_api
Operations: - GET
/limits
Show rate and absolute limits for the project.
This policy only checks if the user has access to the requested project limits. And this check is performed only after the check os_compute_api:limits passes
- GET
os_compute_api:os-volumes
Default: rule:admin_or_owner
Operations: - GET
/os-volumes
- POST
/os-volumes
- GET
/os-volumes/detail
- GET
/os-volumes/{volume_id}
- DELETE
/os-volumes/{volume_id}
- GET
/os-snapshots
- POST
/os-snapshots
- GET
/os-snapshots/detail
- GET
/os-snapshots/{snapshot_id}
- DELETE
/os-snapshots/{snapshot_id}
Manage volumes for use with the Compute API.
Lists, shows details, creates, and deletes volumes and snapshots. These APIs are proxy calls to the Volume service. These are all deprecated.
- GET
os_compute_api:os-volumes-attachments:index
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-volume_attachments
Scope Types: - system
- project
List volume attachments for an instance
- GET
os_compute_api:os-volumes-attachments:create
Default: rule:system_admin_or_owner
Operations: - POST
/servers/{server_id}/os-volume_attachments
Scope Types: - system
- project
Attach a volume to an instance
- POST
os_compute_api:os-volumes-attachments:show
Default: rule:system_or_project_reader
Operations: - GET
/servers/{server_id}/os-volume_attachments/{volume_id}
Scope Types: - system
- project
Show details of a volume attachment
- GET
os_compute_api:os-volumes-attachments:update
Default: rule:system_admin_api
Operations: - PUT
/servers/{server_id}/os-volume_attachments/{volume_id}
Scope Types: - system
Update a volume attachment
- PUT
os_compute_api:os-volumes-attachments:delete
Default: rule:system_admin_or_owner
Operations: - DELETE
/servers/{server_id}/os-volume_attachments/{volume_id}
Scope Types: - system
- project
Detach a volume from an instance
- DELETE