<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="" style="margin: 0px;">Hi, </div>
<div class="" style="margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;">I am trying to setup the policies for nova. Can you please have a look if thats correct? </div>
<div class="" style="margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;"><br class="">
</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">nova/policy.json</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;"><span class="" style="font-family: Helvetica; font-size: 12px;">————————————————————————————————</span></div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">"context_is_admin": "role:admin",</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">"admin_or_owner": "is_admin:True or project_id:%(project_id)s",</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">"owner": "user_id:%(user_id)s",</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">"admin_or_user": "is_admin:True or user_id:%(user_id)s",</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">"default": "rule:admin_or_owner”,</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;"><br class="">
</div>
<div class="" style="margin: 0px; font-size: 11px; font-family: Menlo;">
<div class="" style="margin: 0px;">"compute:get_all": “rule:admin_or_user",</div>
</div>
<div class="">————————————————————————————————</div>
<div class=""><br class="">
</div>
<div class="">I want users to only see there own instances, not the instances of all the users in the same tenant. </div>
<div class=""><br class="">
</div>
<div class="">I have restarted the nova-api service on controller, but no effect. I have noticed that if I put “rule:<span class="" style="font-family: Menlo; font-size: 11px;">context_is_admin</span>” in “<span style="font-family: Menlo; font-size: 11px;" class="">compute:get_all</span>"
than except “admin" no one can see anything so system is reading the file correctly. </div>
<div class=""><br class="">
</div>
<div class="">Important: </div>
<div class=""><br class="">
</div>
<div class="">1 - I haven’t changed the <span class="" style="font-family: Menlo; font-size: 11px;"> </span><span class="" style="font-family: Menlo; font-size: 11px;">/etc/openstack-dashboard/nova_policy.json</span><span class="" style="font-family: Menlo; font-size: 11px;"> </span></div>
<div class=""><span class="" style="font-family: Menlo; font-size: 11px;"><br class="">
</span></div>
<div class="">2 - I have only used the command line client tool to confirm the behaviour. </div>
<div class=""><br class="">
</div>
<div class="">I am running Juno release.</div>
<div class=""><br class="">
</div>
<div class="">Please point to some document that discuss all the policy parameters.</div>
<div class=""><br class="">
</div>
<div class="">Thanks in advance. </div>
<div class=""><br class="">
</div>
<div class="">/Salman</div>
</body>
</html>