From: Xing Yang <xing.yang@emc.com>
Date: Tue, 18 Nov 2014 04:28:39 +0000 (-0500)
Subject: Disable Cgsnapshot APIs by default
X-Git-Url: https://review.fuel-infra.org/gitweb?a=commitdiff_plain;h=95a39d9c326fd218c835c3387380c094efad7a99;p=openstack-build%2Fcinder-build.git

Disable Cgsnapshot APIs by default

Currently consistency group APIs are disabled by default because there are
only a very small number of drivers that have implemented them. In
cinder/etc/cinder/policy.json, there are the following entries:

    "consistencygroup:create" : "group:nobody",
    "consistencygroup:delete": "group:nobody",
    "consistencygroup:get": "group:nobody",
    "consistencygroup:get_all": "group:nobody",
    "consistencygroup:create_cgsnapshot" : "",
    "consistencygroup:delete_cgsnapshot": "",
    "consistencygroup:get_cgsnapshot": "",
    "consistencygroup:get_all_cgsnapshots": "",

Note that Cgsnapshot related APIs are not disabled by default. They should be
disabled to be consistent. So the policy entries will be changed to the
following in this patch:

    "consistencygroup:create" : "group:nobody",
    "consistencygroup:delete": "group:nobody",
    "consistencygroup:get": "group:nobody",
    "consistencygroup:get_all": "group:nobody",
    "consistencygroup:create_cgsnapshot" : "group:nobody",
    "consistencygroup:delete_cgsnapshot": "group:nobody",
    "consistencygroup:get_cgsnapshot": "group:nobody",
    "consistencygroup:get_all_cgsnapshots": "group:nobody",

Note: If a driver has CG functions implemented, the CG APIs have to be enabled
by changing "group:nobody" to "" for the CG functions to work.

Change-Id: If59b3da1e84e25e1f547793638c58966e10f488c
Closes-Bug: #1393652
---

diff --git a/etc/cinder/policy.json b/etc/cinder/policy.json
index 8f3a7b2f9..5289e7d51 100644
--- a/etc/cinder/policy.json
+++ b/etc/cinder/policy.json
@@ -71,10 +71,10 @@
     "consistencygroup:get": "group:nobody",
     "consistencygroup:get_all": "group:nobody",
 
-    "consistencygroup:create_cgsnapshot" : "",
-    "consistencygroup:delete_cgsnapshot": "",
-    "consistencygroup:get_cgsnapshot": "",
-    "consistencygroup:get_all_cgsnapshots": "",
+    "consistencygroup:create_cgsnapshot" : "group:nobody",
+    "consistencygroup:delete_cgsnapshot": "group:nobody",
+    "consistencygroup:get_cgsnapshot": "group:nobody",
+    "consistencygroup:get_all_cgsnapshots": "group:nobody",
 
     "scheduler_extension:scheduler_stats:get_pools" : "rule:admin_api"
 }