Neutron does not work by default without a keystone admin user

[Kevin Benton]

The default neutron policy.json 'context_is_admin' only matches on 'role:admin' and the account that neutron is configured with must match 'context_is_admin' for neutron to function correctly. This means that without modifying policy.json, a deployer cannot use a non-admin account for neutron.

The policy.json keywords have no way to match the username of the neutron keystone credentials. This means that policy.json has to be modified for every deployment that doesn't use an admin user to match the keystone user neutron is configured with.

This seems like an unnecessary burden to leave to deployers to achieve a secure deployment.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/108598

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kevin Benton (<email address hidden>) on branch: master
Review: https://review.openstack.org/108598
Reason: This code is bad and I should feel bad.

[Kevin Benton (kevinbenton)]

I had an approach to have a special username matching keyword for policy.json to address this. It was wildly unpopular.

The general consensus was to add a role in the deployment and match based on that.

[Brant Knudson (blk-u)]

neutron policy.json should be able to use role:service for the operations that nova needs to do... are there other operations that should not be admin-only?

Also, a different role could be used for other operations, then the user wouldn't have admin auth on keystone, too.

[Brant Knudson (blk-u)]

There appears to be a similar issue for ceilometer -- it needs admin role when it should not.

[gordon chung (chungg)]

tbh, i'm not sure how this relates to ceilometer. (i realise the delay, i've been casually looking at this every so often and scratching my head)

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]