Non-admin access to cluster controller config

[Dean Henrichsmeyer]

Right now, the only way you can get access to static/dynamic IP ranges of interfaces is as an admin user. We need access to that information as a normal user.

[Julian Edwards (julian-edwards)]

I'd like to understand the use case for this — what are you doing with those ranges? I consider them internal to MAAS but perhaps there's something I hadn't considered. Ideally, I'd want all useful network info in the network API.

Thanks!

[Julian Edwards (julian-edwards)]

One point to note is that if we did this it would allow any user to know intricate details of networks in maas, which is not necessarily desirable — unless you're an attacker.

[Dean Henrichsmeyer (dean)]

I share in your concern of the validity of the request.

If you take the approach that a MAAS user should have access to the resources MAAS manages in order to properly use them, it makes sense.

If you're creating users in MAAS and you want to limit their access to configuration options for security concerns, that's also valid.

I wasn't going to file it but Mark wants all users in MAAS to have access to the information. The first use case is the one he's going for. He mentioned at some point having some checkpoints such as limiting the number of IPs users can consume, etc, but at any rate, he wants all of the information available.

Thanks.

[Dean Henrichsmeyer (dean)]

Sorry, I forgot to answer your initial question. We're configuring Neutron in OpenStack based on upon the networks defined in MAAS and the machines registered in MAAS that can see one or more of the defined networks.

A valid use case is to use one physical network for both host infrastructure and "public" IPs and for that we need to know the ranges allocated in MAAS for the managed network.

Thanks.