Warning
JSON formatted policy files were deprecated in the Wallaby development
cycle due to the Victoria deprecation by the olso.policy
library.
Use the oslopolicy-convert-json-to-yaml tool
to convert the existing JSON to YAML formatted policy file in backward
compatible way.
The following is an overview of all available policies in Ironic. For a sample configuration file, refer to Ironic Policy.
admin_api
role:admin or role:administrator
Legacy rule for cloud admin access
public_api
is_public_api:True
Internal flag for public API routes
show_password
!
Show or mask secrets within node driver information in API responses
show_instance_secrets
!
Show or mask secrets within instance information in API responses
is_member
(project_domain_id:default or project_domain_id:None) and (project_name:demo or project_name:baremetal)
May be used to restrict access to specific projects
is_observer
rule:is_member and (role:observer or role:baremetal_observer)
Read-only API access
is_admin
rule:admin_api or (rule:is_member and role:baremetal_admin)
Full read/write API access
is_node_owner
project_id:%(node.owner)s
Owner of node
is_node_lessee
project_id:%(node.lessee)s
Lessee of node
is_allocation_owner
project_id:%(allocation.owner)s
Owner of allocation
baremetal:node:create
role:admin and system_scope:all
POST /nodes
system
project
Create Node records
baremetal:node:create:self_owned_node
role:admin
POST /nodes
system
project
Create node records which will be tracked as owned by the associated user project.
baremetal:node:list
role:reader
GET /nodes
GET /nodes/detail
system
project
Retrieve multiple Node records, filtered by an explicit owner or the client project_id
baremetal:node:list_all
role:reader and system_scope:all
GET /nodes
GET /nodes/detail
system
Retrieve multiple Node records
baremetal:node:get
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}
system
project
Retrieve a single Node record
baremetal:node:get:filter_threshold
role:reader and system_scope:all
GET /nodes/{node_ident}
system
project
Filter to allow operators to govern the threshold where information should be filtered. Non-authorized users will be subjected to additional API policy checks for API content response bodies.
baremetal:node:get:last_error
(role:reader and system_scope:all) or (role:reader and project_id:%(node.owner)s)
GET /nodes/{node_ident}
system
project
Governs if the node last_error field is masked from API clients with insufficient privileges.
baremetal:node:get:reservation
(role:reader and system_scope:all) or (role:reader and project_id:%(node.owner)s)
GET /nodes/{node_ident}
system
project
Governs if the node reservation field is masked from API clients with insufficient privileges.
baremetal:node:get:driver_internal_info
(role:reader and system_scope:all) or (role:reader and project_id:%(node.owner)s)
GET /nodes/{node_ident}
system
project
Governs if the node driver_internal_info field is masked from API clients with insufficient privileges.
baremetal:node:get:driver_info
(role:reader and system_scope:all) or (role:reader and project_id:%(node.owner)s)
GET /nodes/{node_ident}
system
project
Governs if the driver_info field is masked from API clients with insufficient privileges.
baremetal:node:update:driver_info
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node driver_info field can be updated via the API clients.
baremetal:node:update:properties
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node properties field can be updated via the API clients.
baremetal:node:update:chassis_uuid
role:admin and system_scope:all
PATCH /nodes/{node_ident}
system
project
Governs if node chassis_uuid field can be updated via the API clients.
baremetal:node:update:instance_uuid
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node instance_uuid field can be updated via the API clients.
baremetal:node:update:lessee
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node lessee field can be updated via the API clients.
baremetal:node:update:owner
role:member and system_scope:all
PATCH /nodes/{node_ident}
system
project
Governs if node owner field can be updated via the API clients.
baremetal:node:update:driver_interfaces
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node driver and driver interfaces field can be updated via the API clients.
baremetal:node:update:network_data
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node driver_info field can be updated via the API clients.
baremetal:node:update:conductor_group
role:member and system_scope:all
PATCH /nodes/{node_ident}
system
project
Governs if node conductor_group field can be updated via the API clients.
baremetal:node:update:name
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node name field can be updated via the API clients.
baremetal:node:update:retired
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PATCH /nodes/{node_ident}
system
project
Governs if node retired and retired reason can be updated by API clients.
baremetal:node:update
(role:member and system_scope:all) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
PATCH /nodes/{node_ident}
system
project
Generalized update of node records
baremetal:node:update_extra
(role:member and system_scope:all) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
PATCH /nodes/{node_ident}
system
project
Update Node extra field
baremetal:node:update_instance_info
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
PATCH /nodes/{node_ident}
system
project
Update Node instance_info field
baremetal:node:update_owner_provisioned
role:admin and system_scope:all
PATCH /nodes/{node_ident}
system
Update Node owner even when Node is provisioned
baremetal:node:delete
role:admin and system_scope:all
DELETE /nodes/{node_ident}
system
project
Delete Node records
baremetal:node:delete:self_owned_node
role:admin and project_id:%(node.owner)s
DELETE /nodes/{node_ident}
system
project
Delete node records which are associated with the requesting project.
baremetal:node:validate
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
GET /nodes/{node_ident}/validate
system
project
Request active validation of Nodes
baremetal:node:set_maintenance
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
PUT /nodes/{node_ident}/maintenance
system
project
Set maintenance flag, taking a Node out of service
baremetal:node:clear_maintenance
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
DELETE /nodes/{node_ident}/maintenance
system
project
Clear maintenance flag, placing the Node into service again
baremetal:node:get_boot_device
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
GET /nodes/{node_ident}/management/boot_device
GET /nodes/{node_ident}/management/boot_device/supported
system
project
Retrieve Node boot device metadata
baremetal:node:set_boot_device
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/management/boot_device
system
project
Change Node boot device
baremetal:node:get_indicator_state
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}/management/indicators/{component}/{indicator}
GET /nodes/{node_ident}/management/indicators
system
project
Retrieve Node indicators and their states
baremetal:node:set_indicator_state
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/management/indicators/{component}/{indicator}
system
project
Change Node indicator state
baremetal:node:inject_nmi
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/management/inject_nmi
system
project
Inject NMI for a node
baremetal:node:get_states
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}/states
system
project
View Node power and provision state
baremetal:node:set_power_state
(role:member and system_scope:all) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
PUT /nodes/{node_ident}/states/power
system
project
Change Node power status
baremetal:node:set_boot_mode
(role:member and system_scope:all) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
PUT /nodes/{node_ident}/states/boot_mode
system
project
Change Node boot mode
baremetal:node:set_secure_boot
(role:member and system_scope:all) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
PUT /nodes/{node_ident}/states/secure_boot
system
project
Change Node secure boot state
baremetal:node:set_provision_state
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
PUT /nodes/{node_ident}/states/provision
system
project
Change Node provision status
baremetal:node:set_raid_state
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/states/raid
system
project
Change Node RAID status
baremetal:node:get_console
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
GET /nodes/{node_ident}/states/console
system
project
Get Node console connection information
baremetal:node:set_console_state
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/states/console
system
project
Change Node console status
baremetal:node:vif:list
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}/vifs
system
project
List VIFs attached to node
baremetal:node:vif:attach
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
POST /nodes/{node_ident}/vifs
system
project
Attach a VIF to a node
baremetal:node:vif:detach
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
DELETE /nodes/{node_ident}/vifs/{node_vif_ident}
system
project
Detach a VIF from a node
baremetal:node:traits:list
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}/traits
system
project
List node traits
baremetal:node:traits:set
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PUT /nodes/{node_ident}/traits
PUT /nodes/{node_ident}/traits/{trait}
system
project
Add a trait to, or replace all traits of, a node
baremetal:node:traits:delete
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
DELETE /nodes/{node_ident}/traits
DELETE /nodes/{node_ident}/traits/{trait}
system
project
Remove one or all traits from a node
baremetal:node:bios:get
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /nodes/{node_ident}/bios
GET /nodes/{node_ident}/bios/{setting}
system
project
Retrieve Node BIOS information
baremetal:node:disable_cleaning
role:admin and system_scope:all
PATCH /nodes/{node_ident}
system
Disable Node disk cleaning
baremetal:node:history:get
(role:reader and system_scope:all) or (role:reader and project_id:%(node.owner)s)
GET /nodes/{node_ident}/history
GET /nodes/{node_ident}/history/{event_ident}
system
project
Filter to allow operators to retreive history records for a node.
baremetal:port:get
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /ports/{port_id}
GET /nodes/{node_ident}/ports
GET /nodes/{node_ident}/ports/detail
GET /portgroups/{portgroup_ident}/ports
GET /portgroups/{portgroup_ident}/ports/detail
system
project
Retrieve Port records
baremetal:port:list
role:reader
GET /ports
GET /ports/detail
system
project
Retrieve multiple Port records, filtered by owner
baremetal:port:list_all
role:reader and system_scope:all
GET /ports
GET /ports/detail
system
project
Retrieve multiple Port records
baremetal:port:create
(role:admin and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
POST /ports
system
project
Create Port records
baremetal:port:delete
(role:admin and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
DELETE /ports/{port_id}
system
project
Delete Port records
baremetal:port:update
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PATCH /ports/{port_id}
system
project
Update Port records
baremetal:portgroup:get
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /portgroups
GET /portgroups/detail
GET /portgroups/{portgroup_ident}
GET /nodes/{node_ident}/portgroups
GET /nodes/{node_ident}/portgroups/detail
system
project
Retrieve Portgroup records
baremetal:portgroup:create
(role:admin and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
POST /portgroups
system
project
Create Portgroup records
baremetal:portgroup:delete
(role:admin and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
DELETE /portgroups/{portgroup_ident}
system
project
Delete Portgroup records
baremetal:portgroup:update
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s)
PATCH /portgroups/{portgroup_ident}
system
project
Update Portgroup records
baremetal:portgroup:list
role:reader
GET /portgroups
GET /portgroups/detail
system
project
Retrieve multiple Port records, filtered by owner
baremetal:portgroup:list_all
role:reader and system_scope:all
GET /portgroups
GET /portgroups/detail
system
project
Retrieve multiple Port records
baremetal:chassis:get
role:reader and system_scope:all
GET /chassis
GET /chassis/detail
GET /chassis/{chassis_id}
system
Retrieve Chassis records
baremetal:chassis:create
role:admin and system_scope:all
POST /chassis
system
Create Chassis records
baremetal:chassis:delete
role:admin and system_scope:all
DELETE /chassis/{chassis_id}
system
Delete Chassis records
baremetal:chassis:update
role:member and system_scope:all
PATCH /chassis/{chassis_id}
system
Update Chassis records
baremetal:driver:get
role:reader and system_scope:all
GET /drivers
GET /drivers/{driver_name}
system
View list of available drivers
baremetal:driver:get_properties
role:reader and system_scope:all
GET /drivers/{driver_name}/properties
system
View driver-specific properties
baremetal:driver:get_raid_logical_disk_properties
role:reader and system_scope:all
GET /drivers/{driver_name}/raid/logical_disk_properties
system
View driver-specific RAID metadata
baremetal:node:vendor_passthru
role:admin and system_scope:all
GET nodes/{node_ident}/vendor_passthru/methods
GET nodes/{node_ident}/vendor_passthru?method={method_name}
PUT nodes/{node_ident}/vendor_passthru?method={method_name}
POST nodes/{node_ident}/vendor_passthru?method={method_name}
PATCH nodes/{node_ident}/vendor_passthru?method={method_name}
DELETE nodes/{node_ident}/vendor_passthru?method={method_name}
system
project
Access vendor-specific Node functions
baremetal:driver:vendor_passthru
role:admin and system_scope:all
GET drivers/{driver_name}/vendor_passthru/methods
GET drivers/{driver_name}/vendor_passthru?method={method_name}
PUT drivers/{driver_name}/vendor_passthru?method={method_name}
POST drivers/{driver_name}/vendor_passthru?method={method_name}
PATCH drivers/{driver_name}/vendor_passthru?method={method_name}
DELETE drivers/{driver_name}/vendor_passthru?method={method_name}
system
Access vendor-specific Driver functions
baremetal:node:ipa_heartbeat
<empty string>
POST /heartbeat/{node_ident}
Receive heartbeats from IPA ramdisk
baremetal:driver:ipa_lookup
<empty string>
GET /lookup
Access IPA ramdisk functions
baremetal:volume:list_all
role:reader and system_scope:all
GET /volume/connectors
GET /volume/targets
GET /nodes/{node_ident}/volume/connectors
GET /nodes/{node_ident}/volume/targets
system
project
Retrieve a list of all Volume connector and target records
baremetal:volume:list
role:reader
GET /volume/connectors
GET /volume/targets
GET /nodes/{node_ident}/volume/connectors
GET /nodes/{node_ident}/volume/targets
system
project
Retrieve a list of Volume connector and target records
baremetal:volume:get
(role:reader and system_scope:all) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))
GET /volume
GET /volume/connectors
GET /volume/connectors/{volume_connector_id}
GET /volume/targets
GET /volume/targets/{volume_target_id}
GET /nodes/{node_ident}/volume
GET /nodes/{node_ident}/volume/connectors
GET /nodes/{node_ident}/volume/targets
system
project
Retrieve Volume connector and target records
baremetal:volume:create
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
POST /volume/connectors
POST /volume/targets
system
project
Create Volume connector and target records
baremetal:volume:delete
(role:member and system_scope:all) or (role:admin and project_id:%(node.owner)s) or (role:manager and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
DELETE /volume/connectors/{volume_connector_id}
DELETE /volume/targets/{volume_target_id}
system
project
Delete Volume connector and target records
baremetal:volume:update
(role:member and system_scope:all) or (role:member and project_id:%(node.owner)s) or (role:admin and project_id:%(node.lessee)s) or (role:manager and project_id:%(node.lessee)s)
PATCH /volume/connectors/{volume_connector_id}
PATCH /volume/targets/{volume_target_id}
system
project
Update Volume connector and target records
baremetal:volume:view_target_properties
(role:reader and system_scope:all) or (role:admin)
GET /volume/connectors/{volume_connector_id}
GET /volume/targets/{volume_target_id}
system
project
Ability to view volume target properties
baremetal:conductor:get
role:reader and system_scope:all
GET /conductors
GET /conductors/{hostname}
system
Retrieve Conductor records
baremetal:allocation:get
(role:reader and system_scope:all) or (role:reader and project_id:%(allocation.owner)s)
GET /allocations/{allocation_id}
GET /nodes/{node_ident}/allocation
system
project
Retrieve Allocation records
baremetal:allocation:list
role:reader
GET /allocations
system
project
Retrieve multiple Allocation records, filtered by owner
baremetal:allocation:list_all
role:reader and system_scope:all
GET /allocations
system
project
Retrieve multiple Allocation records
baremetal:allocation:create
(role:member and system_scope:all) or (role:member)
POST /allocations
system
project
Create Allocation records
baremetal:allocation:create_restricted
role:member and system_scope:all
POST /allocations
system
project
Create Allocation records with a specific owner.
baremetal:allocation:delete
(role:member and system_scope:all) or (role:member and project_id:%(allocation.owner)s)
DELETE /allocations/{allocation_id}
DELETE /nodes/{node_ident}/allocation
system
project
Delete Allocation records
baremetal:allocation:update
(role:member and system_scope:all) or (role:member and project_id:%(allocation.owner)s)
PATCH /allocations/{allocation_id}
system
project
Change name and extra fields of an allocation
baremetal:allocation:create_pre_rbac
(rule:is_member and role:baremetal_admin) or (is_admin_project:True and role:admin)
PATCH /allocations/{allocation_id}
project
Logical restrictor to prevent legacy allocation rule missuse - Requires blank allocations to originate from the legacy baremetal_admin.
baremetal:events:post
role:admin and system_scope:all
POST /events
system
Post events
baremetal:deploy_template:get
role:reader and system_scope:all
GET /deploy_templates
GET /deploy_templates/{deploy_template_ident}
system
Retrieve Deploy Template records
baremetal:deploy_template:create
role:admin and system_scope:all
POST /deploy_templates
system
Create Deploy Template records
baremetal:deploy_template:delete
role:admin and system_scope:all
DELETE /deploy_templates/{deploy_template_ident}
system
Delete Deploy Template records
baremetal:deploy_template:update
role:admin and system_scope:all
PATCH /deploy_templates/{deploy_template_ident}
system
Update Deploy Template records
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.