Nova ignores reader role conventions in default policies

[Florian Faltermeier]

In keystone, if I grant someone the reader role on a project the readonly (role reader) user is able to create a new instance within the project.

Openstack Version: wallaby

1. Create a user within a project and add role reader to the user.
2. Login with the readonly user into the project and try to create an instance.

Florian

[melanie witt (melwitt)]

This sounds like you might not enabled the new policy default roles [1] in nova [2].

In nova, the new policy default roles need to be enabled in order to use them [3], for example:

  [oslo_policy]
  enforce_new_defaults = True

Can you confirm whether you have enabled this config?

I'm marking this bug as Incomplete for now and if you can respond with more information, you can set this bug back to New in order to alert us to your response.

[1] https://docs.openstack.org/keystone/latest//admin/service-api-protection.html
[2] https://docs.openstack.org/nova/latest/configuration/policy-concepts.html
[3] https://docs.openstack.org/nova/latest/configuration/config.html#oslo_policy.enforce_new_defaults

[Launchpad Janitor (janitor)]

[Expired for OpenStack Compute (nova) because there has been no activity for 60 days.]