# glance.api.v2.policy module

class glance.api.v2.policy.APIPolicyBase(context, target=None, enforcer=None)

  Bases: `object`

  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters:

      name – Policy name to check

    Returns:

      bool indicating if the policy is allowed.

class glance.api.v2.policy.CacheImageAPIPolicy(context, image=None, policy_str=None, target=None, enforcer=None)

  Bases: `APIPolicyBase`

  manage_image_cache()

class glance.api.v2.policy.DiscoveryAPIPolicy(context, target=None, enforcer=None)

  Bases: `APIPolicyBase`

  stores_info_detail()

class glance.api.v2.policy.ImageAPIPolicy(context, image, enforcer=None)

  Bases: `APIPolicyBase`

  add_image()
  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters:

      name – Policy name to check

    Returns:

      bool indicating if the policy is allowed.

  copy_image()
  deactivate_image()
  delete_image()
  delete_locations()
  download_image()
  get_image()
  get_image_location()
  get_images()
  property is_created

    Signal whether the image actually exists or not.

    False if the image is only being proposed by a create operation, True if it has already been created.

  modify_image()
  reactivate_image()
  update_locations()
  update_property(name, value=None)
  upload_image()

class glance.api.v2.policy.MemberAPIPolicy(context, image, target=None, enforcer=None)

  Bases: `APIPolicyBase`

  add_member()
  delete_member()
  get_member()
  get_members()
  modify_member()

class glance.api.v2.policy.MetadefAPIPolicy(context, md_resource=None, target=None, enforcer=None)

  Bases: `APIPolicyBase`

  add_metadef_namespace()
  add_metadef_object()
  add_metadef_property()
  add_metadef_resource_type_association()
  add_metadef_tag()
  add_metadef_tags()
  check(name, *args)

    Perform a soft check of a named policy.

    This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.

    Parameters:

      name – Policy name to check

    Returns:

      bool indicating if the policy is allowed.

  delete_metadef_namespace()
  delete_metadef_object()
  delete_metadef_tag()
  delete_metadef_tags()
  get_metadef_namespace()
  get_metadef_namespaces()
  get_metadef_object()
  get_metadef_objects()
  get_metadef_properties()
  get_metadef_property()
  get_metadef_resource_type()
  get_metadef_tag()
  get_metadef_tags()
  list_metadef_resource_types()
  modify_metadef_namespace()
  modify_metadef_object()
  modify_metadef_property()
  modify_metadef_tag()
  remove_metadef_property()
  remove_metadef_resource_type_association()

class glance.api.v2.policy.TasksAPIPolicy(context, target=None, enforcer=None)

  Bases: `APIPolicyBase`

  tasks_api_access()

glance.api.v2.policy.check_admin_or_same_owner(context, properties)

  Check that legacy behavior on create with owner is preserved.

  Legacy behavior requires a static check that owner is not inconsistent with the context, unless the caller is an admin. Enforce that here, if needed.

  Parameters:

    - context – A RequestContext

    - properties – The properties being used to create the image, which may contain an owner

  Raises:

    exception.Forbidden if the context is not an admin and owner is set to something other than the context’s project

glance.api.v2.policy.check_is_image_mutable(context, image)

  Replicate the DB-layer admin-or-owner check for the API.

  Much of the API code depends on hard-coded admin-or-owner enforcement in the DB or authorization layer, as the policy layer is largely a no-op by default. During blueprint policy-refactor, we are trying to remove as much of that as possible, but in certain places we need to do that (if secure_rbac is not enabled). This transitional helper provides a way to do that enforcement where necessary.

  Parameters:

    - context – A RequestContext

    - image – An ImageProxy

  Raises:

    exception.Forbidden if the context is not the owner or an admin

this page last updated: 2026-03-19 01:38:33

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug