Granular placement policy

Registered by Matt Riedemann on 2018-03-08

Build on https://blueprints.launchpad.net/nova/+spec/placement-api-policy-authz from Ocata to provider granular policy enforcement in the Placement API.

Currently, everything in the Placement API is hard-coded to require users with the 'admin' role.

In this blueprint, we will add per-route policy rules and allow the ability for operators to define their own rules.

Policies will all be defined in code and documented per: https://governance.openstack.org/tc/goals/queens/policy-in-code.html

Blueprint information

Status:
Complete
Approver:
melanie witt
Priority:
Medium
Drafter:
Matt Riedemann
Direction:
Approved
Assignee:
Matt Riedemann
Definition:
Approved
Series goal:
Accepted for rocky
Implementation:
Implemented
Milestone target:
milestone icon rocky-3
Started by
Matt Riedemann on 2018-03-15
Completed by
Matt Riedemann on 2018-06-19

Related branches

Sprints

Whiteboard

There is a WIP patch started here: https://review.openstack.org/#/c/524425/

There was agreement in today's nova meeting to approve this as a specless blueprint since the changes will be backward compatible by default and mostly mechanical. -- mriedem 20180315

Gerrit topic: https://review.openstack.org/#q,topic:bp/granular-placement-policy,n,z

Addressed by: https://review.openstack.org/524425
    WIP: General policy sample file for placement

Addressed by: https://review.openstack.org/564846
    Deduplicate config/policy reference docs from main index

Addressed by: https://review.openstack.org/565225
    Cleanup placement policy generator docs

Addressed by: https://review.openstack.org/565578
    Add granular policy rules for /resource_classes*

Addressed by: https://review.openstack.org/568666
    Add granular policy rules for resource providers inventories

Addressed by: https://review.openstack.org/568706
    Add granular policy rules for usages

Addressed by: https://review.openstack.org/570588
    Follow up changes to granular placement policy reviews

Addressed by: https://review.openstack.org/570621
    Add granular placement policy rules for aggregates

Addressed by: https://review.openstack.org/570625
    Add granular policy rules for traits in placement

Addressed by: https://review.openstack.org/570655
    Add granular policy rules for placement allocations

Addressed by: https://review.openstack.org/570656
    Add granular policy rules for allocation candidates

Addressed by: https://review.openstack.org/571201
    Set scope for remaining placement policy rules

(?)

Work Items

Dependency tree

* Blueprints in grey have been implemented.

This blueprint contains Public information 
Everyone can see this information.

Subscribers

No subscribers.