The following is an overview of all available policies in Ironic. For a sample configuration file, refer to Ironic Policy.
admin_api
role:admin or role:administrator
Legacy rule for cloud admin access
public_api
is_public_api:True
Internal flag for public API routes
show_password
!
Show or mask secrets within node driver information in API responses
show_instance_secrets
!
Show or mask secrets within instance information in API responses
is_member
(project_domain_id:default or project_domain_id:None) and (project_name:demo or project_name:baremetal)
May be used to restrict access to specific projects
is_observer
rule:is_member and (role:observer or role:baremetal_observer)
Read-only API access
is_admin
rule:admin_api or (rule:is_member and role:baremetal_admin)
Full read/write API access
is_node_owner
project_id:%(node.owner)s
Owner of node
is_node_lessee
project_id:%(node.lessee)s
Lessee of node
is_allocation_owner
project_id:%(allocation.owner)s
Owner of allocation
baremetal:node:create
rule:is_admin
POST /nodes
Create Node records
baremetal:node:get
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}
Retrieve a single Node record
baremetal:node:list
rule:baremetal:node:get
GET /nodes
GET /nodes/detail
Retrieve multiple Node records, filtered by owner
baremetal:node:list_all
rule:baremetal:node:get
GET /nodes
GET /nodes/detail
Retrieve multiple Node records
baremetal:node:update
rule:is_admin
PATCH /nodes/{node_ident}
Update Node records
baremetal:node:update_extra
rule:baremetal:node:update
PATCH /nodes/{node_ident}
Update Node extra field
baremetal:node:update_instance_info
rule:baremetal:node:update
PATCH /nodes/{node_ident}
Update Node instance_info field
baremetal:node:update_owner_provisioned
rule:is_admin
PATCH /nodes/{node_ident}
Update Node owner even when Node is provisioned
baremetal:node:delete
rule:is_admin
DELETE /nodes/{node_ident}
Delete Node records
baremetal:node:validate
rule:is_admin
GET /nodes/{node_ident}/validate
Request active validation of Nodes
baremetal:node:set_maintenance
rule:is_admin
PUT /nodes/{node_ident}/maintenance
Set maintenance flag, taking a Node out of service
baremetal:node:clear_maintenance
rule:is_admin
DELETE /nodes/{node_ident}/maintenance
Clear maintenance flag, placing the Node into service again
baremetal:node:get_boot_device
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}/management/boot_device
GET /nodes/{node_ident}/management/boot_device/supported
Retrieve Node boot device metadata
baremetal:node:set_boot_device
rule:is_admin
PUT /nodes/{node_ident}/management/boot_device
Change Node boot device
baremetal:node:get_indicator_state
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}/management/indicators/{component}/{indicator}
GET /nodes/{node_ident}/management/indicators
Retrieve Node indicators and their states
baremetal:node:set_indicator_state
rule:is_admin
PUT /nodes/{node_ident}/management/indicators/{component}/{indicator}
Change Node indicator state
baremetal:node:inject_nmi
rule:is_admin
PUT /nodes/{node_ident}/management/inject_nmi
Inject NMI for a node
baremetal:node:get_states
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}/states
View Node power and provision state
baremetal:node:set_power_state
rule:is_admin
PUT /nodes/{node_ident}/states/power
Change Node power status
baremetal:node:set_provision_state
rule:is_admin
PUT /nodes/{node_ident}/states/provision
Change Node provision status
baremetal:node:set_raid_state
rule:is_admin
PUT /nodes/{node_ident}/states/raid
Change Node RAID status
baremetal:node:get_console
rule:is_admin
GET /nodes/{node_ident}/states/console
Get Node console connection information
baremetal:node:set_console_state
rule:is_admin
PUT /nodes/{node_ident}/states/console
Change Node console status
baremetal:node:vif:list
rule:is_admin
GET /nodes/{node_ident}/vifs
List VIFs attached to node
baremetal:node:vif:attach
rule:is_admin
POST /nodes/{node_ident}/vifs
Attach a VIF to a node
baremetal:node:vif:detach
rule:is_admin
DELETE /nodes/{node_ident}/vifs/{node_vif_ident}
Detach a VIF from a node
baremetal:node:traits:list
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}/traits
List node traits
baremetal:node:traits:set
rule:is_admin
PUT /nodes/{node_ident}/traits
PUT /nodes/{node_ident}/traits/{trait}
Add a trait to, or replace all traits of, a node
baremetal:node:traits:delete
rule:is_admin
DELETE /nodes/{node_ident}/traits
DELETE /nodes/{node_ident}/traits/{trait}
Remove one or all traits from a node
baremetal:node:bios:get
rule:is_admin or rule:is_observer
GET /nodes/{node_ident}/bios
GET /nodes/{node_ident}/bios/{setting}
Retrieve Node BIOS information
baremetal:port:get
rule:is_admin or rule:is_observer
GET /ports/{port_id}
GET /nodes/{node_ident}/ports
GET /nodes/{node_ident}/ports/detail
GET /portgroups/{portgroup_ident}/ports
GET /portgroups/{portgroup_ident}/ports/detail
Retrieve Port records
baremetal:port:list
rule:baremetal:port:get
GET /ports
GET /ports/detail
Retrieve multiple Port records, filtered by owner
baremetal:port:list_all
rule:baremetal:port:get
GET /ports
GET /ports/detail
Retrieve multiple Port records
baremetal:port:create
rule:is_admin
POST /ports
Create Port records
baremetal:port:delete
rule:is_admin
DELETE /ports/{port_id}
Delete Port records
baremetal:port:update
rule:is_admin
PATCH /ports/{port_id}
Update Port records
baremetal:portgroup:get
rule:is_admin or rule:is_observer
GET /portgroups
GET /portgroups/detail
GET /portgroups/{portgroup_ident}
GET /nodes/{node_ident}/portgroups
GET /nodes/{node_ident}/portgroups/detail
Retrieve Portgroup records
baremetal:portgroup:create
rule:is_admin
POST /portgroups
Create Portgroup records
baremetal:portgroup:delete
rule:is_admin
DELETE /portgroups/{portgroup_ident}
Delete Portgroup records
baremetal:portgroup:update
rule:is_admin
PATCH /portgroups/{portgroup_ident}
Update Portgroup records
baremetal:chassis:get
rule:is_admin or rule:is_observer
GET /chassis
GET /chassis/detail
GET /chassis/{chassis_id}
Retrieve Chassis records
baremetal:chassis:create
rule:is_admin
POST /chassis
Create Chassis records
baremetal:chassis:delete
rule:is_admin
DELETE /chassis/{chassis_id}
Delete Chassis records
baremetal:chassis:update
rule:is_admin
PATCH /chassis/{chassis_id}
Update Chassis records
baremetal:driver:get
rule:is_admin or rule:is_observer
GET /drivers
GET /drivers/{driver_name}
View list of available drivers
baremetal:driver:get_properties
rule:is_admin or rule:is_observer
GET /drivers/{driver_name}/properties
View driver-specific properties
baremetal:driver:get_raid_logical_disk_properties
rule:is_admin or rule:is_observer
GET /drivers/{driver_name}/raid/logical_disk_properties
View driver-specific RAID metadata
baremetal:node:vendor_passthru
rule:is_admin
GET nodes/{node_ident}/vendor_passthru/methods
GET nodes/{node_ident}/vendor_passthru?method={method_name}
PUT nodes/{node_ident}/vendor_passthru?method={method_name}
POST nodes/{node_ident}/vendor_passthru?method={method_name}
PATCH nodes/{node_ident}/vendor_passthru?method={method_name}
DELETE nodes/{node_ident}/vendor_passthru?method={method_name}
Access vendor-specific Node functions
baremetal:driver:vendor_passthru
rule:is_admin
GET drivers/{driver_name}/vendor_passthru/methods
GET drivers/{driver_name}/vendor_passthru?method={method_name}
PUT drivers/{driver_name}/vendor_passthru?method={method_name}
POST drivers/{driver_name}/vendor_passthru?method={method_name}
PATCH drivers/{driver_name}/vendor_passthru?method={method_name}
DELETE drivers/{driver_name}/vendor_passthru?method={method_name}
Access vendor-specific Driver functions
baremetal:node:ipa_heartbeat
rule:public_api
POST /heartbeat/{node_ident}
Send heartbeats from IPA ramdisk
baremetal:driver:ipa_lookup
rule:public_api
GET /lookup
Access IPA ramdisk functions
baremetal:volume:get
rule:is_admin or rule:is_observer
GET /volume
GET /volume/connectors
GET /volume/connectors/{volume_connector_id}
GET /volume/targets
GET /volume/targets/{volume_target_id}
GET /nodes/{node_ident}/volume
GET /nodes/{node_ident}/volume/connectors
GET /nodes/{node_ident}/volume/targets
Retrieve Volume connector and target records
baremetal:volume:create
rule:is_admin
POST /volume/connectors
POST /volume/targets
Create Volume connector and target records
baremetal:volume:delete
rule:is_admin
DELETE /volume/connectors/{volume_connector_id}
DELETE /volume/targets/{volume_target_id}
Delete Volume connector and target records
baremetal:volume:update
rule:is_admin
PATCH /volume/connectors/{volume_connector_id}
PATCH /volume/targets/{volume_target_id}
Update Volume connector and target records
baremetal:conductor:get
rule:is_admin or rule:is_observer
GET /conductors
GET /conductors/{hostname}
Retrieve Conductor records
baremetal:allocation:get
rule:is_admin or rule:is_observer
GET /allocations/{allocation_id}
GET /nodes/{node_ident}/allocation
Retrieve Allocation records
baremetal:allocation:list
rule:baremetal:allocation:get
GET /allocations
Retrieve multiple Allocation records, filtered by owner
baremetal:allocation:list_all
rule:baremetal:allocation:get
GET /allocations
Retrieve multiple Allocation records
baremetal:allocation:create
rule:is_admin
POST /allocations
Create Allocation records
baremetal:allocation:create_restricted
rule:baremetal:allocation:create
POST /allocations
Create Allocation records that are restricted to an owner
baremetal:allocation:delete
rule:is_admin
DELETE /allocations/{allocation_id}
DELETE /nodes/{node_ident}/allocation
Delete Allocation records
baremetal:allocation:update
rule:is_admin
PATCH /allocations/{allocation_id}
Change name and extra fields of an allocation
baremetal:events:post
rule:is_admin
POST /events
Post events
baremetal:deploy_template:get
rule:is_admin or rule:is_observer
GET /deploy_templates
GET /deploy_templates/{deploy_template_ident}
Retrieve Deploy Template records
baremetal:deploy_template:create
rule:is_admin
POST /deploy_templates
Create Deploy Template records
baremetal:deploy_template:delete
rule:is_admin
DELETE /deploy_templates/{deploy_template_ident}
Delete Deploy Template records
baremetal:deploy_template:update
rule:is_admin
PATCH /deploy_templates/{deploy_template_ident}
Update Deploy Template records
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.