Steps to reproduce:
1) In Project A create a network X with a subnet. Uplink the subnet to a router, ensure internet connectivity etc.
2) As an administrator edit network X to mark it as "shared".
3) As a non-privileged user sign in to a Project B, create a new Murano environment there and select network X as a default network of this environment.
4) Add any application which deploys regular VM into the environment.
5) Deploy the environment.
Expected result:
Environment is successfully deployed, app spawns a VM which is connected to the network X.
Observed result:
Environment deployment fails with the following error:
[EnvironmentError]: Unexpected stack state CREATE_FAILED: Resource CREATE failed: Forbidden: resources.port-3d1418fec05a43ac8de1be370da4c51c-nvzsjivxojk0p2: Policy doesn't allow (rule:create_port and rule:create_port:fixed_ips) to be performed.
The error is originated from Heat stack, so the problem may be reproduced by just submitting a simple heat template, containing an OS::Nova::Server resource and an OS::Neutron::Port resource pointing to appropriate existing network.
The problem occurs if the OS::Neutron::Port resource definition has the "fixed_ips" block, without it the stack gets properly created.
It seems like Neutron enforces a policy which does not allow to create ports with a "fixed-ip" setting (the one which binds a port to a particular subnet of a network) in networks which are not owned by a current project. Obviously it may be reconfigured, but the default policy (https:/