Actions Supported by Role/Policy-based Authorization
This section describes the actions supported by ASM in policy-based authorization.
Supported Actions
IAM provides system-defined policies that can be directly used. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The common concepts related to policies are listed below.
- Permissions: statements that allow or deny certain operations in a policy
- APIs: APIs that can be called in a custom policy
- Actions: specific operations that are allowed or denied
- Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
The check mark (√) and cross symbol (x) indicate that an action takes effect or does not take effect for the corresponding type of projects.
ASM supports the following actions that can be defined in custom policies:
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Creating a service mesh | POST /v1/{project_id}/meshes | asm:mesh:create | √ | √ |
| Deleting a service mesh | DELETE /v1/{project_id}/meshes/{id} | asm:mesh:delete | √ | √ |
| Querying the service mesh list | GET /v1/{project_id}/meshes | asm:mesh:get | √ | √ |
| Querying the details about a service mesh | GET /v1/{project_id}/meshes/{id} | asm:mesh:list | √ | √ |
| Upgrading a service mesh | POST /v1/{project_id}/mesh-upgrade GET /v1/{project_id}/mesh-upgrade/{id} PUT /v1/{project_id}/mesh-upgrade/{id} DELETE /v1/{project_id}/mesh-upgrade/{id} | asm:mesh:upgrade | √ | √ |
| Querying a service mesh upgrade task | GET /v1/{project_id}/mesh-job/{id} | asm:mesh:getUpgradeJob | √ | √ |
| Updating a service mesh | PUT /v2/projects/:project_id/meshes/:mesh_id | asm:mesh:update | √ | √ |
| Obtaining a candidate cluster | GET /v3/projects/:project_id/clusters-to-be-added | asm:mesh:getAvailableClusters | √ | × |
| Querying the Service list of a service mesh | GET /v3/meshes/:mesh_id/namespaces/:namespace/services | asm:mesh:listServices | √ | √ |
| Querying the Service of a service mesh | GET /v3/meshes/:mesh_id/namespaces/:namespace/services/:service | asm:mesh:getService | √ | √ |
| Validating the Service of a service mesh | POST /v2/meshes/:mesh_id/namespaces/:namespace/services/validate | asm:mesh:getService | √ | √ |
| Repairing the Service of a service mesh with just one click | POST /v2/meshes/:mesh_id/namespaces/:namespace/services/format | asm:mesh:updateService | √ | √ |
| Querying service access authorization | GET /v3/meshes/:mesh_id/authorizations | asm:mesh:getServiceGovernance | √ | √ |
| Creating service access authorization | POST /v3/meshes/:mesh_id/authorizations | asm:mesh:updateServiceGovernance | √ | √ |
| Deleting service access authorization | DELETE /v3/meshes/:mesh_id/authorizations | asm:mesh:updateServiceGovernance | √ | √ |
| Updating the namespace injection configuration | PUT /v2/meshes/:mesh_id/injection | asm:mesh:updateNamespace | √ | √ |
| Obtaining the namespace injection configuration | GET /v2/meshes/:mesh_id/injection | asm:mesh:getNamespace | √ | √ |
| Obtaining the namespace list | GET /v2/meshes/:mesh_id/namespaces | asm:mesh:listNamespaces | √ | √ |
| Obtaining a grayscale release traffic policy | GET /v2/meshes/:mesh_id/namespaces/:namespace/services/:service/virtualroutes | asm:mesh:getRelease | √ | √ |
| Updating a grayscale release traffic policy | PUT /v2/meshes/:mesh_id/namespaces/:namespace/services/:service/virtualroutes | asm:mesh:updateRelease | √ | √ |
| Creating a grayscale release task | POST /v2/meshes/:mesh_id/namespaces/:namespace/releases | asm:mesh:createRelease | √ | √ |
| Obtaining the details about a grayscale release task | GET /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id | asm:mesh:getRelease | √ | √ |
| Obtaining the grayscale release task list | GET /v2/meshes/:mesh_id/releases | asm:mesh:listReleases | √ | √ |
| Updating a grayscale release task | PUT /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id | asm:mesh:updateRelease | √ | √ |
| Deleting a grayscale release task | DELETE /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id | asm:mesh:deleteRelease | √ | √ |
| Creating a gateway | POST /v2/meshes/:mesh_id/gateways | asm:mesh:createGateway | √ | √ |
| Obtaining the gateway list | GET /v3/meshes/:mesh_id/gateways | asm:mesh:listGateways | √ | √ |
| Deleting a gateway | POST /v2/meshes/:mesh_id/gateways/:gateway | asm:mesh:deleteGateway | √ | √ |
| Adding a route to a gateway | POST /v3/meshes/:mesh_id/gateways/:gateway/addroute | asm:mesh:createGatewayRoute | √ | √ |
| Obtaining the route list of a gateway | POST /v2/meshes/:mesh_id/gateways/:gateway/routes | asm:mesh:listGatewayRoutes | √ | √ |
| Removing a route from a gateway | POST /v3/meshes/:mesh_id/gateways/:gateway/removeroute | asm:mesh:deleteGatewayRoute | √ | √ |
| Creating a workshop | POST /v2/meshes/:mesh_id/workshops | asm:mesh:createWorkshop | √ | √ |
| Deleting a workshop | DELETE /v2/meshes/:mesh_id/workshops/:workshop | asm:mesh:deleteWorkshop | √ | √ |
| Obtaining the workshop list | GET /v2/meshes/:mesh_id/workshops | asm:mesh:listWorkshops | √ | √ |
| Forwarding an Istio query request | GET /apis/*.istio.io/* | asm:mesh:getServiceGovernance | √ | √ |
| Forwarding an Istio creation request | POST /apis/*.istio.io/* | asm:mesh:updateServiceGovernance | √ | √ |
| Forwarding an Istio deletion request | DELETE /apis/*.istio.io/* | asm:mesh:updateServiceGovernance | √ | √ |
| Forwarding an Istio update request | PUT/apis/*.istio.io/* | asm:mesh:updateServiceGovernance | √ | √ |
| Querying resources | POST /v2/:project_id/:resourcetype/resource-instances/filter | asm:mesh:listResourcesByTag | √ | × |
| Querying the number of resource instances | POST /v2/:project_id/:resourcetype/resource-instances/count | asm:mesh:listResourcesByTag | √ | × |
| Creating resource tags in batches | POST /v2/:project_id/:resourcetype/:resourceid/tags/create | asm:mesh:tagResource | √ | √ |
| Deleting resource tags in batches | DELETE /v2/:project_id/:resourcetype/:resourceid/tags/delete | asm:mesh:unTagResource | √ | √ |
| Querying tags of a resource | GET /v2/:project_id/:resourcetype/:resourceid/tags | asm:mesh:listTagsForResource | √ | √ |
| Querying tags by project | GET /v2/:project_id/:resourcetype/tags | asm:mesh:listTags | √ | × |
| Viewing the service topology | GET /api/namespaces/:namespace/services/:service/graph GET /api/graph | asm:mesh:getTopology | √ | √ |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
