Policy ignored for get_all and get volume(s)

[Sam Morrison]

Trying to allow a certain role to be able to do the either a "cinder list --all-tenants" or a "cinder show <any UUID>" and the policy is ignored.

Looked in the code and it's hard coded at the DB layer to filter out volumes that aren't owned by the context user.

Nova had this issue to and it would be great to fix this in cinder.

[Yuriy Nesenenko (ynesenenko)]

To allow a certain role to be able to do either 'cinder list --all-tenants' or 'cinder show <UUID>' we can configure policy.json
We can create corresponding "new-role" role in keystone and add it to file /etc/cinder/policy.json "context_is_admin": "role:admin or role:new-role" to grant admin context which allow to do 'cinder list --all-tenants'

[Sam Morrison (sorrison)]

This is not acceptable. I want more finer grain access. Eg a read only role. Not another global admin.

[Yuriy Nesenenko (ynesenenko)]

Unfortunately only admin user can get a list of roles at default settings in reystoneclient.

[Yuriy Nesenenko (ynesenenko)]

Unfortunately only admin user can get a list of roles at default settings in keystoneclient. It's hard to allow a certain role to be able to do 'cinder list --all-tenants' if the user isnot admin.

[Sean McGinnis (sean-mcginnis)]

Unassigning due to no activity.