Difference between revisions of "Cyborg/Policy"

Revision as of 17:23, 10 February 2020

		Project-scope			System-scope
Route	Method	reader	member	admin	reader	member	admin	no auth	RBAC Name	Notes
/	GET							x	N/A	No restrictions on this route
/v2	GET							x	N/A	No restrictions on this route
/v2/device_profiles	GET	x							cyborg:device_profile:get_all
/v2/device_profiles	POST						x		cyborg:device_profile:create
/v2/device_profiles/{device_profiles_uuid}	GET	x			x				cyborg:device_profile:get_one
/v2/device_profiles/{device_profiles_uuid}	DELETE						x		cyborg:device_profile:delete
/v2/device_profiles?value={device_profile_name1},{device_profile_name2}	DELETE						x		cyborg:device_profile:delete
/v2/accelerator_requests	GET	x							cyborg:arq:get_all
/v2/accelerator_requests	POST		x						cyborg:arq:create	current rule: any role is allowed to do post action.This is too permissive,instead it should be at least "role:member" with scope_type ["project"]
/v2/accelerator_requests/{arq_uuid}	GET	x							cyborg:arq:get_one
/v2/accelerator_requests/{arq_uuid}	PATCH			x(admin_or_owner)					cyborg:arq:update
/v2/accelerator_requests?arqs={arq_uuid}	DELETE			x(admin_or_owner)					cyborg:arq:delete
/v2/accelerator_requests?instance={instance_uuid}	DELETE			x(admin_or_owner)					cyborg:arq:delete
/v2/devices	GET	x			x				cyborg:device:get_all
	GET	x			x				cyborg:device:get_one
	PATCH						x		cyborg:device:update	Update the firmware or shell image (FPGA bitstream) for the specified device
/v2/deployables/{uuid}	PATCH			x					cyborg:deployable:update	Update the FPGA bitstream for the specified deployable.

Reference:

When considering which role is appropriate for each API operation, one can follow the recommended migration strategy agreed by Keystone Team: https://etherpad.openstack.org/p/policy-migration-steps

Questions (tied to RBAC Name):

cyborg:arq:create
- (Yumeng) current rule: any role is allowed to do post action. This is too permissive, instead, it should be at least "role:member" with scope_type ["project"]
cyborg:device:get_all
cyborg:device:update
- (Yumeng) Is it necessary to allow a system-scope user to read and update one device? For example, when one device is shared by different projects, we should allow a role at a system-scope level to access this device, right?
  - (Yumeng) yes, we agreed on the weekly meeting that a device is a system-level resource, so sys_admin is required for device: update.

cyborg:deployable:update
- (Yumeng) ditto for deployable update
  - (Yumeng) we agreed that deployable: update requires project_admin.

@@ Line 23: / Line 23: @@
 | rowspan="2" | /v2/accelerator_requests || GET || x ||  ||  ||  ||  ||  ||  || cyborg:arq:get_all ||
 |-
-| POST ||  || x || x ||  ||  ||  ||  || cyborg:arq:create || current rule: any role is allowed to do post action.This is too permissive,instead it should be at least "role:member" with scope_type ["project"]
+| POST ||  || x ||  ||  ||  ||  ||  || cyborg:arq:create || current rule: any role is allowed to do post action.This is too permissive,instead it should be at least "role:member" with scope_type ["project"]
 |-
 | rowspan="2" | /v2/accelerator_requests/{arq_uuid} || GET || x ||  ||  ||  ||  ||  ||  || cyborg:arq:get_one ||