openstack/glance
Code Issues Proposed changes

Add release note about policy-refactor

Browse Source 
Related to blueprint policy-refactor

Change-Id: I0f6ff686df6449eecd23e1c64f21a5b4ccae652b
This commit is contained in:
Dan Smith
2021-08-25 09:41:59 -07:00
parent f094b7d2b2
commit 0406cb6c41
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
releasenotes/notes/policy-refactor-xena-0cddb7f2d492cb3a.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
security:
- |
The Xena release of Glance is a midpoint in the process of
refactoring how our policies are applied to API operations. The
goal of applying policy enforcement in the API will ultimately
increase the flexibility operators have over which users can do
what operations to which images, and provides a path for compliant
Secure RBAC and scoped tokens. In Xena, some policies are more
flexible than they once were, allowing for more fine-grained
assignment of responsibilities, but not all things are possible
yet. If `enforce_secure_rbac` is not enabled, most things are
still enforcing the legacy behavior of hard and fast
admin-or-owner requirements.