49b4dd3478
This allows access to external networks to be controlled via the RBAC framework added during Liberty with a new 'access_as_external' action. A migration adds all current external networks to the RBAC policies table with a wildcard indicating that all tenants can access the network as RBAC. Unlike the conversion of shared networks to RBAC, the external table is left in the DB to avoid invasive changes throughout the codebase to calculate the flag relative to the caller. So the current 'external' flag is used throughout the code base as it previously was for wiring up floating IPs, router gateway ports, etc. Then the RBAC entries are only referenced when determining what networks to show the tenants. API Behavior: * Marking a network as 'external' will automatically create a wildcard entry that allows that network to be accessed by all tenants. * An external network may have all of its RBAC entries deleted and then only an admin will be able to attach to it. * An RBAC 'access_as_external' entry cannot be deleted if it is required for a tenant that currently has a router attached to that network. * Creating an 'access_as_external' RBAC entry will automatically convert the network into an external network. (This is to enable a workflow where a private external network is never visible to everyone.) * The default policy.json will prevent a non-admin from creating wildcard 'access_as_external' RBAC entries to align with the current default policy we have on setting the 'external' field on the network to prevent poluting everyone else's network lists. * The default policy.json will allow a tenant to create an 'access_as_external' RBAC entry to allow specific tenants (including itself) the ability to use its network as an external network. Closes-Bug: #1547985 DocImpact: External networks can now have access restricted to small subsets of tenants APIImpact: 'access_as_external' will be allowed as an action in the RBAC API for networks Change-Id: I4d8ee78a9763c58884e4fd3d7b40133da659cd61
20 lines
887 B
YAML
20 lines
887 B
YAML
---
|
|
prelude: >
|
|
External networks can now be controlled using the
|
|
RBAC framework that was added in Liberty. This allows
|
|
networks to be made available to specific tenants
|
|
(as opposed to all tenants) to be used as an external
|
|
gateway for routers and floating IPs.
|
|
features:
|
|
- External networks can now be controlled using the
|
|
RBAC framework that was added in Liberty. This allows
|
|
networks to be made available to specific tenants
|
|
(as opposed to all tenants) to be used as an external
|
|
gateway for routers and floating IPs.
|
|
By default this feature will also allow regular tenants
|
|
to make their networks available as external networks
|
|
to other individual tenants (or even themselves), but
|
|
they are prevented from using the wildcard to share to
|
|
all tenants. This behavior can be adjusted via
|
|
policy.json by the operator if desired.
|