Policy Documentation

The following is an overview of all available policies in Designate. For a sample configuration file, refer to policy.yaml.

designate

admin

Default:role:admin or is_admin:True

(no description provided)

primary_zone

Default:target.zone_type:SECONDARY

(no description provided)

owner

Default:tenant:%(tenant_id)s

(no description provided)

admin_or_owner

Default:rule:admin or rule:owner

(no description provided)

default

Default:rule:admin_or_owner

(no description provided)

target

Default:tenant:%(target_tenant_id)s

(no description provided)

owner_or_target

Default:rule:target or rule:owner

(no description provided)

admin_or_owner_or_target

Default:rule:owner_or_target or rule:admin

(no description provided)

admin_or_target

Default:rule:admin or rule:target

(no description provided)

zone_primary_or_admin

Default:('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

(no description provided)

create_blacklist

Default:

rule:admin

Operations:

• POST /v2/blacklists

Create blacklist.

find_blacklist

Default:

rule:admin

Operations:

• GET /v2/blacklists

Find blacklist.

find_blacklists

Default:

rule:admin

Operations:

• GET /v2/blacklists

Find blacklists.

get_blacklist

Default:

rule:admin

Operations:

• GET /v2/blacklists/{blacklist_id}

Get blacklist.

update_blacklist

Default:

rule:admin

Operations:

• PATCH /v2/blacklists/{blacklist_id}

Update blacklist.

delete_blacklist

Default:

rule:admin

Operations:

• DELETE /v2/blacklists/{blacklist_id}

Delete blacklist.

use_blacklisted_zone

Default:

rule:admin

Operations:

• POST /v2/zones

Allowed bypass the blacklist.

all_tenants

Default:rule:admin

Action on all tenants.

edit_managed_records

Default:rule:admin

Edit managed records.

use_low_ttl

Default:rule:admin

Use low TTL.

use_sudo

Default:rule:admin

Accept sudo from user to tenant.

diagnostics_ping

Default:rule:admin

Diagnose ping.

diagnostics_sync_zones

Default:rule:admin

Diagnose sync zones.

diagnostics_sync_zone

Default:rule:admin

Diagnose sync zone.

diagnostics_sync_record

Default:rule:admin

Diagnose sync record.

create_pool

Default:rule:admin

Create pool.

find_pools

Default:

rule:admin

Operations:

• GET /v2/pools

Find pool.

find_pool

Default:

rule:admin

Operations:

• GET /v2/pools

Find pools.

get_pool

Default:

rule:admin

Operations:

• GET /v2/pools/{pool_id}

Get pool.

update_pool

Default:rule:admin

Update pool.

delete_pool

Default:rule:admin

Delete pool.

zone_create_forced_pool

Default:

rule:admin

Operations:

• POST /v2/zones

load and set the pool to the one provided in the Zone attributes.

get_quotas

Default:

rule:admin_or_owner

Operations:

• GET /v2/quotas

View Current Project’s Quotas.

get_quota

Default:rule:admin_or_owner

(no description provided)

set_quota

Default:

rule:admin

Operations:

• PATCH /v2/quotas/{project_id}

Set Quotas.

reset_quotas

Default:

rule:admin

Operations:

• DELETE /v2/quotas/{project_id}

Reset Quotas.

find_records

Default:

rule:admin_or_owner

Operations:

• GET /v2/reverse/floatingips/{region}:{floatingip_id}
• GET /v2/reverse/floatingips

Find records.

count_records

Default:rule:admin_or_owner

(no description provided)

create_recordset

Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

Operations:

• POST /v2/zones/{zone_id}/recordsets
• PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Create Recordset

get_recordsets

Default:rule:admin_or_owner

(no description provided)

get_recordset

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/{zone_id}/recordsets/{recordset_id}
• DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}
• PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Get recordset

update_recordset

Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

Operations:

• PUT /v2/zones/{zone_id}/recordsets/{recordset_id}
• PATCH /v2/reverse/floatingips/{region}:{floatingip_id}

Update recordset

delete_recordset

Default:

('PRIMARY':%(zone_type)s and rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND is_admin:True)

Operations:

• DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}

Delete RecordSet

count_recordset

Default:rule:admin_or_owner

Count recordsets

find_service_status

Default:

rule:admin

Operations:

• GET /v2/service_status/{service_id}

Find a single Service Status

find_service_statuses

Default:

rule:admin

Operations:

• GET /v2/service_status

List service statuses.

update_service_status

Default:rule:admin

(no description provided)

find_tenants

Default:rule:admin

Find all Tenants.

get_tenant

Default:rule:admin

Get all Tenants.

count_tenants

Default:rule:admin

Count tenants

create_tld

Default:

rule:admin

Operations:

• POST /v2/tlds

Create Tld

find_tlds

Default:

rule:admin

Operations:

• GET /v2/tlds

List Tlds

get_tld

Default:

rule:admin

Operations:

• GET /v2/tlds/{tld_id}

Show Tld

update_tld

Default:

rule:admin

Operations:

• PATCH /v2/tlds/{tld_id}

Update Tld

delete_tld

Default:

rule:admin

Operations:

• DELETE /v2/tlds/{tld_id}

Delete Tld

create_tsigkey

Default:

rule:admin

Operations:

• POST /v2/tsigkeys

Create Tsigkey

find_tsigkeys

Default:

rule:admin

Operations:

• GET /v2/tsigkeys

List Tsigkeys

get_tsigkey

Default:

rule:admin

Operations:

• PATCH /v2/tsigkeys/{tsigkey_id}
• GET /v2/tsigkeys/{tsigkey_id}

Show a Tsigkey

update_tsigkey

Default:

rule:admin

Operations:

• PATCH /v2/tsigkeys/{tsigkey_id}

Update Tsigkey

delete_tsigkey

Default:

rule:admin

Operations:

• DELETE /v2/tsigkeys/{tsigkey_id}

Delete a Tsigkey

create_zone

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones

Create Zone

get_zones

Default:rule:admin_or_owner

(no description provided)

get_zone

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/{zone_id}
• PATCH /v2/zones/{zone_id}
• PUT /v2/zones/{zone_id}/recordsets/{recordset_id}

Get Zone

get_zone_servers

Default:rule:admin_or_owner

(no description provided)

find_zones

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones

List existing zones

update_zone

Default:

rule:admin_or_owner

Operations:

• PATCH /v2/zones/{zone_id}

Update Zone

delete_zone

Default:

rule:admin_or_owner

Operations:

• DELETE /v2/zones/{zone_id}

Delete Zone

xfr_zone

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/{zone_id}/tasks/xfr

Manually Trigger an Update of a Secondary Zone

abandon_zone

Default:

rule:admin

Operations:

• POST /v2/zones/{zone_id}/tasks/abandon

Abandon Zone

count_zones

Default:rule:admin_or_owner

(no description provided)

count_zones_pending_notify

Default:rule:admin_or_owner

(no description provided)

purge_zones

Default:rule:admin

(no description provided)

touch_zone

Default:rule:admin_or_owner

(no description provided)

zone_export

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/exports/{zone_export_id}/export

Retrive a Zone Export from the Designate Datastore

create_zone_export

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/{zone_id}/tasks/export

Create Zone Export

find_zone_exports

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/exports

List Zone Exports

get_zone_export

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/exports/{zone_export_id}
• GET /v2/zones/tasks/exports/{zone_export_id}/export

Get Zone Exports

update_zone_export

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/{zone_id}/tasks/export

Update Zone Exports

create_zone_import

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/tasks/imports

Create Zone Import

find_zone_imports

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/imports

List all Zone Imports

get_zone_import

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/imports/{zone_import_id}

Get Zone Imports

update_zone_import

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/tasks/imports

Update Zone Imports

delete_zone_import

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/imports/{zone_import_id}

Delete a Zone Import

create_zone_transfer_accept

Default:

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s

Operations:

• POST /v2/zones/tasks/transfer_accepts

Create Zone Transfer Accept

get_zone_transfer_accept

Default:

rule:admin_or_owner

Operations:

• GET /v2/zones/tasks/transfer_requests/{zone_transfer_accept_id}

Get Zone Transfer Accept

find_zone_transfer_accepts

Default:

rule:admin

Operations:

• GET /v2/zones/tasks/transfer_accepts

List Zone Transfer Accepts

find_zone_transfer_accept

Default:rule:admin

(no description provided)

update_zone_transfer_accept

Default:

rule:admin

Operations:

• POST /v2/zones/tasks/transfer_accepts

Update a Zone Transfer Accept

delete_zone_transfer_accept

Default:rule:admin

(no description provided)

create_zone_transfer_request

Default:

rule:admin_or_owner

Operations:

• POST /v2/zones/{zone_id}/tasks/transfer_requests

Create Zone Transfer Accept

get_zone_transfer_request

Default:

rule:admin_or_owner OR tenant:%(target_tenant_id)s OR None:%(target_tenant_id)s

Operations:

• GET /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}
• PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Show a Zone Transfer Request

get_zone_transfer_request_detailed

Default:rule:admin_or_owner

(no description provided)

find_zone_transfer_requests

Default:

@

Operations:

• GET /v2/zones/tasks/transfer_requests

List Zone Transfer Requests

find_zone_transfer_request

Default:@

(no description provided)

update_zone_transfer_request

Default:

rule:admin_or_owner

Operations:

• PATCH /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Update a Zone Transfer Request

delete_zone_transfer_request

Default:

rule:admin_or_owner

Operations:

• DELETE /v2/zones/tasks/transfer_requests/{zone_transfer_request_id}

Delete a Zone Transfer Request