opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(common): remove service default policy (#18312)

Browse Source
This commit is contained in:
屈轩
2023-10-13 14:00:39 +08:00
committed by GitHub
parent 115eb587e3
commit 6ff9e75fb1
8 changed files with 655 additions and 671 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudid/policy/defaults.go
+66 -67
View File
@@ -15,9 +15,6 @@
package policy
import (
"yunion.io/x/pkg/util/rbacscope"
api "yunion.io/x/onecloud/pkg/apis/cloudid"
common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/util/rbacutils"
)
@@ -33,78 +30,80 @@ const (
var (
predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudpolicies",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudpolicies",
Action: PolicyActionGet,
Result: rbacutils.Allow,
/*
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudpolicies",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudpolicies",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudgroups",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudgroups",
Action: PolicyActionGet,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudgroups",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudgroups",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudusers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudusers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudusers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudusers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "samlusers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "samlusers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "samlusers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "samlusers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
},
},
},
*/
}
)
pkg/compute/policy/defaults.go
+367 -362
View File
@@ -37,145 +37,147 @@ var (
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "zones",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zones",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudregions",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudregions",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cachedimages",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cachedimages",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dbinstance_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dbinstance_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "serverskus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "serverskus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "secgrouprules",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "elasticcacheskus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "elasticcacheskus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "secgrouprules",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "loadbalancerclusters",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "schedtags",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_recordsets",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_recodsets",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_zonecaches",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_zonecaches",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionGet,
Extra: []string{"saml"},
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "waf_rules",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "waf_rules",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
/*
{
Service: api.SERVICE_TYPE,
Resource: "zones",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zones",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudregions",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudregions",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cachedimages",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cachedimages",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dbinstance_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dbinstance_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "serverskus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "serverskus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "secgrouprules",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "elasticcacheskus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "elasticcacheskus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "secgrouprules",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "loadbalancerclusters",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "schedtags",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_recordsets",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_recodsets",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_zonecaches",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "dns_zonecaches",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionGet,
Extra: []string{"saml"},
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "waf_rules",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "waf_rules",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
*/
{
Service: api.SERVICE_TYPE,
Resource: "capabilities",
@@ -184,235 +186,238 @@ var (
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
/*
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionGet,
Result: rbacutils.Allow,
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
},
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "keypairs",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudproviders",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudproviders",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "domain_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "domain_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "infras_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "infras_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "vpcs",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "vpcs",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "wires",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "wires",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "proxysettings",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "proxysettings",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nat_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nat_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nas_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nas_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "modelarts_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "modelarts_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudaccounts",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudproviders",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "cloudproviders",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "domain_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "domain_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "infras_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "infras_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "vpcs",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "vpcs",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "wires",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "wires",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "proxysettings",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "proxysettings",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nat_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nat_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nas_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "nas_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "modelarts_skus",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "modelarts_skus",
Action: PolicyActionGet,
Result: rbacutils.Allow,
*/
/*
{
Auth: true,
Scope: rbacscope.ScopeProject,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "region_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "region_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zone_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zone_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "project_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "project_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "networks",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "networks",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeProject,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "region_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "region_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zone_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "zone_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "project_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "project_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
/*{
Service: api.SERVICE_TYPE,
Resource: "networks",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "networks",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
*/
},
},
*/
}
)
pkg/image/policy/defaults.go
+18 -41
View File
@@ -30,49 +30,26 @@ const (
var (
predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
{
Auth: true,
Scope: rbacscope.ScopeProject,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "image_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
/*
{
Auth: true,
Scope: rbacscope.ScopeProject,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "image_quotas",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "image_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
},
{
Service: api.SERVICE_TYPE,
Resource: "image_quotas",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
/*{
Service: api.SERVICE_TYPE,
Resource: "images",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "images",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "guestimages",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "guestimages",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
*/
},
},
*/
{
// for anonymous update torrent status
Auth: false,
pkg/keystone/models/rolepolicies.go
+3
View File
@@ -494,6 +494,9 @@ func (manager *SRolePolicyManager) GetMatchPolicyGroupByCred(userCred api.IRbacI
case rbacscope.ScopeProject:
consolePolicyName = options.Options.ProjectDashboardPolicy
}
if len(consolePolicyName) == 0 {
continue
}
names, policies, err = appendPolicy(names, policies, scope, consolePolicyName, nameOnly)
if err != nil {
return nil, nil, errors.Wrapf(err, "appendConsolePolicy %s %s", scope, consolePolicyName)
pkg/keystone/options/options.go
+3 -3
View File
@@ -60,9 +60,9 @@ type SKeystoneOptions struct {
DomainAdminRoleToNotify string `help:"domain admin role to notify" default:"domainadmin"`
AdminRoleToNotify string `help:"admin role to notify" default:"admin"`
SystemDashboardPolicy string `help:"dashboard policy name for system view" default:"sys-dashboard"`
DomainDashboardPolicy string `help:"dashboard policy name for domain view" default:"domain-dashboard"`
ProjectDashboardPolicy string `help:"dashboard policy name for project view" default:"project-dashboard"`
SystemDashboardPolicy string `help:"dashboard policy name for system view" default:""`
DomainDashboardPolicy string `help:"dashboard policy name for domain view" default:""`
ProjectDashboardPolicy string `help:"dashboard policy name for project view" default:""`
NoPolicyViolationCheck bool `help:"do not check policy violation when modify or assign policy" default:"false"`
pkg/logger/policy/defaults.go
+24 -25
View File
@@ -15,9 +15,6 @@
package policy
import (
"yunion.io/x/pkg/util/rbacscope"
api "yunion.io/x/onecloud/pkg/apis/logger"
common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/util/rbacutils"
)
@@ -30,30 +27,32 @@ const (
var (
predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
/*
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "actions",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
},
},
},
*/
}
)
pkg/notify/policy/defaults.go
+138 -139
View File
@@ -15,9 +15,6 @@
package policy
import (
"yunion.io/x/pkg/util/rbacscope"
api "yunion.io/x/onecloud/pkg/apis/notify"
common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/util/rbacutils"
)
@@ -33,150 +30,152 @@ const (
var (
predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
/*
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "receivers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "topics",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "topics",
Action: PolicyActionList,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "topics",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "topics",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
},
},
},
},
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
{
Auth: true,
Scope: rbacscope.ScopeDomain,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
},
},
},
},
*/
}
)
pkg/yunionconf/policy/defaults.go
+36 -34
View File
@@ -32,42 +32,44 @@ const (
var (
predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
/*
{
Auth: true,
Scope: rbacscope.ScopeUser,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "parameters",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
},
},
},
*/
{
Auth: true,
Scope: rbacscope.ScopeProject,