Advanced Services need to be able to list all networks and create/update/delete ports on other tenants's networks.

[Susanne Balle]

Today the Advanced Services e.g. DBaaS, DNSaaS, etc. need to be able to create/delete and update ports on a tenant's network. Today they can do this by being a Global Neutron Admin. We need to create a policy/role/etc. that will allow a tenant to be admin for a resource.

We need this feature to allow our Advanced services to share a "Neutron Provider Network" that allow them to forward logs down to the Centralized logging system.

"shared" on a Network will allow all tenant to access the network. The keystone hierarchical tenants will not be ready any time soon.

By implementing this feature, we are defining a new user role (advsvc), which will allow for the equivalent of admin rights when defined for specific resources. This is an easy way to add this functionality into the policy framework in Neutron and allow granular control of access to resources with this new role.

Chatted with Mark and Kyle and I am now filling this bug.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/101281

[Kyle Mestery (mestery)]

Moving medium priority bug out of Juno-RC1.

[Kyle Mestery (mestery)]

Per my own confusion, moving back to Juno-RC1.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/101281
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d4f00659eb18c6a5df2ce6d35202b0a4a9409f70
Submitter: Jenkins
Branch: master

commit d4f00659eb18c6a5df2ce6d35202b0a4a9409f70
Author: Kyle Mestery <email address hidden>
Date: Wed Jun 18 11:04:52 2014 +0000

    Add advsvc role to neutron policy file

    Add in a default "advsvc" user and the logic in the Neutron policy
    infrastructure which will allow this user to create/get/update/delete
    ports on other tenants networks, as well as view other tenants
    networks. This is for the use case of letting advanced services have
    a user to put ports on other tenants networks. By default, we do not
    define any roles for the policy "context_is_advsvc", but rely on
    operators to specify the likely value of "role advsvc".

    DocImpact

    Closes-Bug: #1331836

    Change-Id: I94cb3383eb1fed793934719603f888dbbdbbd85a
    Co-Authored-By: Susanne Balle <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/131561

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kyle Mestery (<email address hidden>) on branch: stable/juno
Review: https://review.openstack.org/131561