The events api RBAC cannot be configured using the ceilometer policy.json . There are 2 reasons for this:
1. This is because /ceilometer/api/controllers/v2/events.py>>EventsController.get_all , get_one etc implementation uses the decorator @v2_utils.requires_admin, which mandates the user to be an admin.
RBAC rules for each REST call must be configurable and controlled via the respective policy.json file and not hardcoded in this manner.
2. Even if we fix problem 1 above by removing the requires_admin decorator and by enforcing the policy via oslo_policy , ownership based rbac rules will not apply for events. (Ownership based rules implies stuff like "owner": "user_id:%(user_id)s" etc , where we can specifically define that the REST call output is available only to the owner of the data (like a specific user or a project). There are multiple cases for eg. in the case of audit data , where the data should be seen only either by the owner of the data or an admin from within a specific project - and not by admins from other projects). For this requirement, the event object should have user and project related information , which it doesn't currently have as seen below.
{
"raw":{
},
"traits":[
],
"generated":"2015-06-02T12:34:12.449000",
"message_id":"b80ef947-091c-43a1-8df6-81173a0d4780",
"event_type":"audit.http.request"
}
IRC chat with Gordon : http://
Gordon,
Please take a look at the changesets below :
1a). https:/
b) https:/
2. https:/