7b18c0ecbb
This is a small update to include a message to warn that these overrides should not be used separately. Also including the --reuse-values parameter. This makes sure that it keeps the current configuration, adding the new override values. Closes-Bug: #1953056 Signed-off-by: Pedro Almeida <pedro.monteiroazevedodemouraalmeida@windriver.com> Change-Id: I0e3595d4bc9839a3e4246a206192018b927f2c5a |
||
---|---|---|
.. | ||
tests | ||
.gitignore | ||
cinder-policy-overrides.yml | ||
glance-policy-overrides.yml | ||
horizon-policy-overrides.yml | ||
keystone-policy-overrides.yml | ||
neutron-policy-overrides.yml | ||
nova-policy-overrides.yml | ||
README.md | ||
test-requirements.txt | ||
tox.ini |
Enhanced Policies
This repository aims to provide enhanced policies for stx-openstack.
It's important that all the overrides files get applied, some of the rules present in a policy from one service might depend on other services to work (e.g. nova commands might depend on glance/cinder/neutron permissions). They should not be used separately.
Design | Roles | Permissions summary |
---|---|---|
Default Role: | member | Users with 'member' can manage certain resources of the project. |
New Role to add: | project_admin | Users with role 'project_admin' could manage all resources of the project |
New Role to add: | project_readonly | Users with role 'project_readonly' can only get list and detail of resources of the project, and shared resources of other projects |
Setting up the environment
Make sure you have access to the Openstack CLI, follow the instructions on this doc.
- Transfer the policies to your cloud's controller:
rsync -avP *-policy-overrides.yml <user>@<controller-floating-ip>:~/rbac
- Log into your active controller
- Create your clouds.yaml file
cat <<EOF >clouds.yaml clouds: openstack: region_name: RegionOne identity_api_version: 3 endpoint_type: internalURL auth: username: 'admin' password: '<PASSWORD FOR ADMIN>' project_name: 'admin' project_domain_name: 'default' user_domain_name: 'default' auth_url: 'http://keystone.openstack.svc.cluster.local/v3' EOF
- Create the custom roles:
# Assuming you are using method 1 export OS_CLOUD=openstack openstack role create project_admin openstack role create project_readonly
- In order to enable the extensions required for some of the Neutron tests, include the following configuration to the Neutron helm override YML file:
conf: neutron: DEFAULT: service_plugins: - router - network_segment_range - qos - segments - port_forwarding - trunk plugins: ml2_conf: ml2: extension_drivers: - port_security - qos openvswitch_agent: agent: extensions: - qos - port_forwarding
- Apply the policy overrides for each service to your cloud
source /etc/platform/openrc system helm-override-update stx-openstack keystone openstack --reuse-values --values=rbac/keystone-policy-overrides.yml system helm-override-update stx-openstack cinder openstack --reuse-values --values=rbac/cinder-policy-overrides.yml system helm-override-update stx-openstack nova openstack --reuse-values --values=rbac/nova-policy-overrides.yml system helm-override-update stx-openstack neutron openstack --reuse-values --values=rbac/neutron-policy-overrides.yml system helm-override-update stx-openstack glance openstack --reuse-values --values=rbac/glance-policy-overrides.yml system helm-override-update stx-openstack horizon openstack --reuse-values --values=rbac/horizon-policy-overrides.yml system application-apply stx-openstack
- Watch for application overrides to finish applying
watch system application-show stx-openstack
Running tests
Please follow the instructions below to test the enhanced policies on your system. We assume that the New Roles were created on you system and the overrides were successfully applied.
-
Get to the rbac folder you transfered into your controller node
cd ~/rbac
-
IMPORTANT: create a venv and install the test dependencies
if [ ! -d .venv ]; then python3 -m venv .venv fi source .venv/bin/activate pip install --upgrade pip pip install -r test-requirements.txt
-
Download CirrOS image (dependency for nova and cinder tests)
wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img
-
Execute the tests On StarlingX:
export OS_CLOUD=openstack pytest tests/
On WindRiver Openstack:
export OS_CLOUD=openstack pytest tests/ --env wro
If things go awry...
WARNING: The following script might DELETE some existing configuration if not used carefully!
One can use the run-cleanup-all.sh script to remove any leftovers from the test on the environment:
export OS_CLOUD=openstack
bash run-cleanup-all.sh
Role Permission Details
Role Permissions | identity(keystone) | compute(nova) | networking(neutron) | image(glance) | volume(cinder) |
---|---|---|---|---|---|
member | All operations that legacy role 'member' can do | 1 - Can get list and detail of instances 2 - Can create instance/Can open console of instances 3 - Can access log of instance 4 - Can manage keypairs of his/her own |
1 - Can only create/update/delete port 2 - Can get list and detail of resources: subnetpool, address scope, networks, subnets, etc. |
1,can create and update image, upload image content |
1 - Can create volume 2 - Can create volume from image 3 - Can create volume snapshot 4 - Can create volume-backup |
project_admin | all operations that legacy role 'member' can do; | all operations that legacy role 'member' can do |
1 - All operations that legacy role 'member' can do 2 - Can create/update/delete 'shared' subnetpool 3 - Can create/update/delete address scope 4 - Can create/update/delete shared network |
1 - All operations that legacy role 'member' can do 2 - Can publicize_image |
1 - All operations that legacy role 'member' can do |
project_readonly | all operations that legacy role 'member' can do |
1 - Can only get list and detail of instances 2 - Can manage key-pairs of his/her own |
1 - Can only get list and detail of resources: subnetpool, address scopes, networks, subnets,etc. | 1 - Can only get list and detail of images | 1 - Can only get list and detail of volumes, backups, snapshots |