31b34e91e0
Inclusion of a project_id in API URLs is now optional, and no longer required. Removing the project_id requirement facilitates supporting Secure RBAC's notion of system scope, in which an API method is not associated with a specific project. The API v3 routing is enhanced to provide duplicate routes for API methods that traditionally required a project_id in the URL: - The existing route for which a project_id is in the URL - A new route for when the URL does not include a project_id To test both routes and ensure there are no regresssions, the "API samples" functional tests include a project_id in the URLs, and the rest of the functional tests do not include the project_id. This is handled by changing the 'noauth' WSGI middleware to no longer add the project_id, and adding a new 'noauth_include_project_id' middleware filter that implements the legacy behavior. A new microversion V3.67 is introduced, but it only serves to inform clients whether the project_id is optional or required. When an API node supports mv 3.67, the project_id is optional in all API requests, even when the request specifies a earlier microversion. See the spec Ia44f199243be8f862520d7923007e7182b32f67d for more details on this behavior. Note: Much of the groundwork for this is based on manila's patch I5127e150e8a71e621890f30dba6720b3932cf583. DocImpact APIImpact Implements: blueprint project-id-optional-in-urls Change-Id: I3729cbe1902ab4dc335451d13ed921ec236fb8fd
60 lines
1.9 KiB
PHP
60 lines
1.9 KiB
PHP
#############
|
|
# OpenStack #
|
|
#############
|
|
|
|
[composite:osapi_volume]
|
|
use = call:cinder.api:root_app_factory
|
|
/: apiversions
|
|
/v3: openstack_volume_api_v3
|
|
|
|
[composite:openstack_volume_api_v3]
|
|
use = call:cinder.api.middleware.auth:pipeline_factory
|
|
noauth = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth apiv3
|
|
noauth_include_project_id = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler noauth_include_project_id apiv3
|
|
keystone = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3
|
|
keystone_nolimit = cors http_proxy_to_wsgi request_id faultwrap sizelimit osprofiler authtoken keystonecontext apiv3
|
|
|
|
[filter:request_id]
|
|
paste.filter_factory = oslo_middleware.request_id:RequestId.factory
|
|
|
|
[filter:http_proxy_to_wsgi]
|
|
paste.filter_factory = oslo_middleware.http_proxy_to_wsgi:HTTPProxyToWSGI.factory
|
|
|
|
[filter:cors]
|
|
paste.filter_factory = oslo_middleware.cors:filter_factory
|
|
oslo_config_project = cinder
|
|
|
|
[filter:faultwrap]
|
|
paste.filter_factory = cinder.api.middleware.fault:FaultWrapper.factory
|
|
|
|
[filter:osprofiler]
|
|
paste.filter_factory = osprofiler.web:WsgiMiddleware.factory
|
|
|
|
[filter:noauth]
|
|
paste.filter_factory = cinder.api.middleware.auth:NoAuthMiddleware.factory
|
|
|
|
[filter:noauth_include_project_id]
|
|
paste.filter_factory = cinder.api.middleware.auth:NoAuthMiddlewareIncludeProjectID.factory
|
|
|
|
[filter:sizelimit]
|
|
paste.filter_factory = oslo_middleware.sizelimit:RequestBodySizeLimiter.factory
|
|
|
|
[app:apiv3]
|
|
paste.app_factory = cinder.api.v3.router:APIRouter.factory
|
|
|
|
[pipeline:apiversions]
|
|
pipeline = cors http_proxy_to_wsgi faultwrap osvolumeversionapp
|
|
|
|
[app:osvolumeversionapp]
|
|
paste.app_factory = cinder.api.versions:Versions.factory
|
|
|
|
##########
|
|
# Shared #
|
|
##########
|
|
|
|
[filter:keystonecontext]
|
|
paste.filter_factory = cinder.api.middleware.auth:CinderKeystoneContext.factory
|
|
|
|
[filter:authtoken]
|
|
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
|