# glance.api.v2.policy module

class glance.api.v2.policy.APIPolicyBase(context, target=None, enforcer=None)

  Bases: `object`

  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters

      name – Policy name to check

    Returns

      bool indicating if the policy is allowed.

class glance.api.v2.policy.CacheImageAPIPolicy(context, image=None, policy_str=None, target=None, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  manage_image_cache()

class glance.api.v2.policy.DiscoveryAPIPolicy(context, target=None, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  stores_info_detail()

class glance.api.v2.policy.ImageAPIPolicy(context, image, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  add_image()
  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters

      name – Policy name to check

    Returns

      bool indicating if the policy is allowed.

  copy_image()
  deactivate_image()
  delete_image()
  delete_locations()
  download_image()
  get_image()
  get_image_location()
  get_images()
  property is_created

    Signal whether the image actually exists or not.

    False if the image is only being proposed by a create operation, True if it has already been created.

  modify_image()
  reactivate_image()
  update_locations()
  update_property(name, value=None)
  upload_image()

class glance.api.v2.policy.MemberAPIPolicy(context, image, target=None, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  add_member()
  delete_member()
  get_member()
  get_members()
  modify_member()

class glance.api.v2.policy.MetadefAPIPolicy(context, md_resource=None, target=None, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  add_metadef_namespace()
  add_metadef_object()
  add_metadef_property()
  add_metadef_resource_type_association()
  add_metadef_tag()
  add_metadef_tags()
  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters

      name – Policy name to check

    Returns

      bool indicating if the policy is allowed.

  delete_metadef_namespace()
  delete_metadef_object()
  delete_metadef_tag()
  delete_metadef_tags()
  get_metadef_namespace()
  get_metadef_namespaces()
  get_metadef_object()
  get_metadef_objects()
  get_metadef_properties()
  get_metadef_property()
  get_metadef_resource_type()
  get_metadef_tag()
  get_metadef_tags()
  list_metadef_resource_types()
  modify_metadef_namespace()
  modify_metadef_object()
  modify_metadef_property()
  modify_metadef_tag()
  remove_metadef_property()
  remove_metadef_resource_type_association()

class glance.api.v2.policy.TasksAPIPolicy(context, target=None, enforcer=None)

  Bases: `glance.api.v2.policy.APIPolicyBase`

  tasks_api_access()

glance.api.v2.policy.check_admin_or_same_owner(context, properties)

  Check that legacy behavior on create with owner is preserved.

  Legacy behavior requires a static check that owner is not inconsistent with the context, unless the caller is an admin. Enforce that here, if needed.

  Parameters

    - context – A RequestContext

    - properties – The properties being used to create the image, which may contain an owner

  Raises

    exception.Forbidden if the context is not an admin and owner is set to something other than the context’s project

glance.api.v2.policy.check_is_image_mutable(context, image)

  Replicate the DB-layer admin-or-owner check for the API.

  Much of the API code depends on hard-coded admin-or-owner enforcement in the DB or authorization layer, as the policy layer is largely a no-op by default. During blueprint policy-refactor, we are trying to remove as much of that as possible, but in certain places we need to do that (if secure_rbac is not enabled). This transitional helper provides a way to do that enforcement where necessary.

  Parameters

    - context – A RequestContext

    - image – An ImageProxy

  Raises

    exception.Forbidden if the context is not the owner or an admin

this page last updated: 2026-03-19 02:17:34

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug