From 243f2a098711df764738ecff0534338a0e962c98 Mon Sep 17 00:00:00 2001
From: Jian Qiu <swordqiu@gmail.com>
Date: Tue, 5 Apr 2022 11:15:05 +0800
Subject: [PATCH] fix: opsadmin should have project list and get permission
 (#13894)

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
---
 pkg/keystone/locale/predefined_yaml.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkg/keystone/locale/predefined_yaml.go b/pkg/keystone/locale/predefined_yaml.go
index 0e78a8db0b..c2c63d2a85 100644
--- a/pkg/keystone/locale/predefined_yaml.go
+++ b/pkg/keystone/locale/predefined_yaml.go
@@ -46,9 +46,15 @@ policy:
   image:
     '*':
       '*': allow
+  identity:
+    '*':
+	  '*': deny
+	  list: allow
+	  get: allow
   log:
     actions:
       list: deny
+	  get: deny
 `
 
 var secAdminPolicy = `
@@ -104,6 +110,7 @@ policy:
   log:
     actions:
       list: deny
+	  get: deny
   yunionconf:
     '*':
       '*': allow
@@ -119,6 +126,11 @@ policy:
       '*': deny
       get: allow
       list: allow
+  identity:
+	'*':
+	  '*': deny
+	  list: allow
+	  get: allow
 `
 
 var normalUserPolicy = `