[RFE] Domain-defined RBAC
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
New
|
Wishlist
|
Unassigned |
Bug Description
Hi,
I want to make an external network visible at a keystone domain-wide scope; I try this:
openstack network rbac create --target-
CommandError: No project with a name or ID of '*' exists.
Because it use this call to retrieve project:
http://
RBAC specifications only use domain during rbac creation, domain isn't store in db:
MariaDB [neutron]> desc networkrbacs;
+------
| Field | Type | Null | Key | Default | Extra |
+------
| id | varchar(36) | NO | PRI | NULL | |
| object_id | varchar(36) | NO | MUL | NULL | |
| project_id | varchar(255) | YES | MUL | NULL | |
| target_tenant | varchar(255) | NO | | NULL | |
| action | varchar(255) | NO | MUL | NULL | |
+------
Two questions:
1 Is it possible to create an rbac for all projects using CLI ?
2 Is it planned to use target-
Thanks,
Changed in neutron: | |
status: | New → Invalid |
status: | Invalid → Incomplete |
Changed in neutron: | |
status: | Invalid → New |
Changed in neutron: | |
importance: | Undecided → Wishlist |
tags: | added: rfe |
Changed in neutron: | |
assignee: | Kevin Benton (kevinbenton) → nobody |
status: | New → Confirmed |
summary: |
- Domain-defined RBAC + [RFE] Domain-defined RBAC |
Changed in neutron: | |
status: | Confirmed → Triaged |
Changed in neutron: | |
status: | Triaged → In Progress |
tags: |
added: rfe-approved removed: rfe |
Changed in neutron: | |
status: | In Progress → Triaged |
Changed in neutron: | |
assignee: | kourosh vivan (kourosh-vivan) → Aurelien Joga (aurelienjoga) |
Changed in neutron: | |
assignee: | Aurelien Joga (aurelienjoga) → kourosh vivan (kourosh-vivan) |
@Kourosh,
Isn't this the same as setting the network's attribute 'shared' as True. Please see the section titled "How the ‘shared’ flag relates to these entries" in this on-line document: http:// docs.openstack. org/draft/ networking- guide/config- rbac.html