As a user of a project, I can see resource types associated to private namespaces I don't have access to:
╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source alicerc ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ openstack token issue /usr/lib/python3/dist-packages/secretstorage/dhcrypto.py:15: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead from cryptography.utils import int_from_bytes /usr/lib/python3/dist-packages/secretstorage/util.py:19: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead from cryptography.utils import int_from_bytes +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2021-02-25T16:54:12+0000 | | id | gAAAAABgN8gkFiVP108Fi8-OaWdPklyi0_UN3UrEE_q4d5HGqYXFZy5rZ5Mf_MUnAJx-VFJmBMXsM_pxQDyP07O8R8rBHNC6hhayqRXnwCDg6LGAwdYP9kJP5Fcx2_2WHmeqdXwLwc7I88XP7v1SJqjkb0D0JEFYoPq4qne4Jk9Raq5JaJ-DKUo | | project_id | 67f1495e5dc145abbfa7059c63c6eda2 | | user_id | 91cdb182eaf841f4869e66d6b0f0f32a | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-list +------------------------------------------+ | namespace | +------------------------------------------+ | OS::Software::DBMS | | CIM::ResourceAllocationSettingData | | OS::Compute::CPUPinning | | OS::Compute::Watchdog | | OS::Compute::GuestMemoryBacking | | OS::Compute::AggregateDiskFilter | | OS::Compute::RandomNumberGenerator | | OS::Compute::Hypervisor | | OS::Compute::AggregateIoOpsFilter | | OS::Compute::VirtCPUTopology | | OS::Compute::HostCapabilities | | CIM::ProcessorAllocationSettingData | | OS::Compute::GuestShutdownBehavior | | OS::Cinder::Volumetype | | OS::Software::WebServers | | OS::Compute::Libvirt | | OS::Compute::XenAPI | | OS::Compute::Quota | | OS::Compute::VMwareFlavor | | OS::Compute::VMwareQuotaFlavor | | OS::Compute::InstanceData | | OS::Compute::LibvirtImage | | OS::Compute::AggregateNumInstancesFilter | | OS::Glance::Signatures | | CIM::VirtualSystemSettingData | | CIM::StorageAllocationSettingData | | OS::Software::Runtimes | | OS::Compute::VMware | +------------------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-namespace-create alice-namespace +------------+----------------------------------+ | Property | Value | +------------+----------------------------------+ | created_at | 2021-02-25T15:55:55Z | | namespace | alice-namespace | | owner | 67f1495e5dc145abbfa7059c63c6eda2 | | protected | False | | schema | /v2/schemas/metadefs/namespace | | updated_at | 2021-02-25T15:55:55Z | | visibility | private | +------------+----------------------------------+ ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-associate --name alice-resource-type alice-namespace +------------+----------------------+ | Property | Value | +------------+----------------------+ | created_at | 2021-02-25T15:57:29Z | | name | alice-resource-type | | updated_at | 2021-02-25T15:57:29Z | +------------+----------------------+
Now as a separate user
╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ source openrc demo demo is_service_enabled:29: command not found: set +o xtrace WARNING: setting legacy OS_TENANT_NAME to support cli tools. ╭─ubuntu@glance-devstack ~/devstack ‹master*› ╰─➤ $ glance md-resource-type-list +---------------------+ | name | +---------------------+ | OS::Glance::Image | | OS::Cinder::Volume | | OS::Nova::Server | | OS::Nova::Aggregate | | OS::Nova::Flavor | | OS::Trove::Instance | | bar | | test | | alice-resource-type | +---------------------+
As a user of a project, I can see resource types associated to private namespaces I don't have access to:
╭─ubuntu@ glance- devstack ~/devstack ‹master*› glance- devstack ~/devstack ‹master*› python3/ dist-packages/ secretstorage/ dhcrypto. py:15: CryptographyDep recationWarning : int_from_bytes is deprecated, use int.from_bytes instead python3/ dist-packages/ secretstorage/ util.py: 19: CryptographyDep recationWarning : int_from_bytes is deprecated, use int.from_bytes instead ------+ ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ---+ ------+ ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ---+ 25T16:54: 12+0000 | P108Fi8- OaWdPklyi0_ UN3UrEE_ q4d5HGqYXFZy5rZ 5Mf_MUnAJx- VFJmBMXsM_ pxQDyP07O8R8rBH NC6hhayqRXnwCDg 6LGAwdYP9kJP5Fc x2_2WHmeqdXwLwc 7I88XP7v1SJqjkb 0D0JEFYoPq4qne4 Jk9Raq5JaJ- DKUo | bbfa7059c63c6ed a2 | 4869e66d6b0f0f3 2a | ------+ ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ---+ glance- devstack ~/devstack ‹master*› ------- ------- ------- ------- ------- -+ ------- ------- ------- ------- ------- -+ locationSetting Data | :CPUPinning | :Watchdog | :GuestMemoryBac king | :AggregateDiskF ilter | :RandomNumberGe nerator | :Hypervisor | :AggregateIoOps Filter | :VirtCPUTopolog y | :HostCapabiliti es | llocationSettin gData | :GuestShutdownB ehavior | :Volumetype | :WebServers | :Libvirt | :VMwareFlavor | :VMwareQuotaFla vor | :InstanceData | :LibvirtImage | :AggregateNumIn stancesFilter | :Signatures | temSettingData | ocationSettingD ata | :Runtimes | ------- ------- ------- ------- ------- -+ glance- devstack ~/devstack ‹master*› ------+ ------- ------- ------- ------- ------+ ------+ ------- ------- ------- ------- ------+ 25T15:55: 55Z | bbfa7059c63c6ed a2 | metadefs/ namespace | 25T15:55: 55Z | ------+ ------- ------- ------- ------- ------+ glance- devstack ~/devstack ‹master*› type-associate --name alice-resource-type alice-namespace ------+ ------- ------- ------- -+ ------+ ------- ------- ------- -+ 25T15:57: 29Z | 25T15:57: 29Z | ------+ ------- ------- ------- -+
╰─➤ $ source alicerc
╭─ubuntu@
╰─➤ $ openstack token issue
/usr/lib/
from cryptography.utils import int_from_bytes
/usr/lib/
from cryptography.utils import int_from_bytes
+------
| Field | Value |
+------
| expires | 2021-02-
| id | gAAAAABgN8gkFiV
| project_id | 67f1495e5dc145a
| user_id | 91cdb182eaf841f
+------
╭─ubuntu@
╰─➤ $ glance md-namespace-list
+------
| namespace |
+------
| OS::Software::DBMS |
| CIM::ResourceAl
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| CIM::ProcessorA
| OS::Compute:
| OS::Cinder:
| OS::Software:
| OS::Compute:
| OS::Compute::XenAPI |
| OS::Compute::Quota |
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Compute:
| OS::Glance:
| CIM::VirtualSys
| CIM::StorageAll
| OS::Software:
| OS::Compute::VMware |
+------
╭─ubuntu@
╰─➤ $ glance md-namespace-create alice-namespace
+------
| Property | Value |
+------
| created_at | 2021-02-
| namespace | alice-namespace |
| owner | 67f1495e5dc145a
| protected | False |
| schema | /v2/schemas/
| updated_at | 2021-02-
| visibility | private |
+------
╭─ubuntu@
╰─➤ $ glance md-resource-
+------
| Property | Value |
+------
| created_at | 2021-02-
| name | alice-resource-type |
| updated_at | 2021-02-
+------
Now as a separate user
╭─ubuntu@ glance- devstack ~/devstack ‹master*› enabled: 29: command not found: set +o xtrace glance- devstack ~/devstack ‹master*› type-list ------- ------- -+ ------- ------- -+ ------- ------- -+
╰─➤ $ source openrc demo demo
is_service_
WARNING: setting legacy OS_TENANT_NAME to support cli tools.
╭─ubuntu@
╰─➤ $ glance md-resource-
+------
| name |
+------
| OS::Glance::Image |
| OS::Cinder::Volume |
| OS::Nova::Server |
| OS::Nova::Aggregate |
| OS::Nova::Flavor |
| OS::Trove::Instance |
| bar |
| test |
| alice-resource-type |
+------