RBAC -access_as_external lack of flexibility

[Alex Stafeyev]

If we have an external network, with default rbac policy, and even 1 tenant is using this network, we can not delete the default rbac policy in order to decide to which tenants this network will be exposed.
In this situation the network will be exposed to all tenants unless the admin first disconnects ( clears the network ports from all tenants - Router gw/Vms usage, etc ) the using tenant and then makes the needed changes.

In a situation with many tenants this will be non user friendly.

MITAKA.

[Kevin Benton (kevinbenton)]

You should be able to grant access to the specific tenant that is using the network and then remove the wildcard policy.

[Alex Stafeyev (astafeye)]

My goal is to remove the wildcard rbac policy when one of the tenants is already using this network.
So how t ogrant access to specific tenant provides me solution to this issue.
It would be great if you could show examples :)

tnx

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]

[Kevin Benton (kevinbenton)]

Sorry to comment a year later, but in case someone else stumbles across this, please refer to the networking guide section on rbac policies to see how to share with a specific tenant: https://docs.openstack.org/mitaka/networking-guide/config-rbac.html