Merge "Update authorization actions for services API"

cinder/api/contrib/services.py

@@ -79,7 +79,7 @@ class ServiceController(wsgi.Controller):
         Filter by host & service name.
         """
         context = req.environ['cinder.context']
-        authorize(context)
+        authorize(context, action='index')
         detailed = self.ext_mgr.is_loaded('os-extended-services')
         now = timeutils.utcnow()
         services = db.service_get_all(context)
@@ -142,7 +142,7 @@ class ServiceController(wsgi.Controller):
     def update(self, req, id, body):
         """Enable/Disable scheduling for a service."""
         context = req.environ['cinder.context']
-        authorize(context)
+        authorize(context, action='update')
 
         ext_loaded = self.ext_mgr.is_loaded('os-extended-services')
         ret_val = {}

cinder/tests/unit/policy.json

@@ -63,6 +63,8 @@
     "volume_extension:quotas:update": "",
     "volume_extension:quotas:delete": "",
     "volume_extension:quota_classes": "",
+    "volume_extension:services:index": "",
+    "volume_extension:services:update" : "rule:admin_api",
     "volume_extension:volume_manage": "rule:admin_api",
     "volume_extension:volume_unmanage": "rule:admin_api",
 

etc/cinder/policy.json

@@ -48,7 +48,8 @@
     "volume_extension:volume_tenant_attribute": "rule:admin_or_owner",
     "volume_extension:volume_mig_status_attribute": "rule:admin_api",
     "volume_extension:hosts": "rule:admin_api",
-    "volume_extension:services": "rule:admin_api",
+    "volume_extension:services:index": "",
+    "volume_extension:services:update" : "rule:admin_api",
 
     "volume_extension:volume_manage": "rule:admin_api",
     "volume_extension:volume_unmanage": "rule:admin_api",