[rfe] Add RBAC support for address scopes

[Igor Malinovskiy]

Currently, RBAC for address scopes is missing in Neutron but it will valuable feature for cloud administrators.

This feature is required to add RBAC support for SNP. AS can be assigned to SNP and an administrator should be able to share SNP to the target project only if the target project has access to appropriate AS.

Adds "address_scopes" as a supported RBAC type:

Neutron-lib:
https://review.opendev.org/#/c/707407/

Neutron:
https://review.opendev.org/#/c/709122/

Tempest tests:
TBD

Client:
https://review.opendev.org/#/c/709124/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/707407

[Akihiro Motoki (amotoki)]

It looks straight-forward and makes sense to me. It is related to bug 1862032 which proposes RBAC for subnet pools.
Address pools need to be configured properly before creating subnet pools, so I think these two are tightly coupled and worth discussing together.

[Akihiro Motoki (amotoki)]

I am changing this to rfe-triaged as I think we can discuss it along with bug 1862032 "RBAC for subnet pools"

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/709122

[Slawek Kaplonski (slaweq)]

On the drivers meeting we decided to approve this RFE together with https://bugs.launchpad.net/neutron/+bug/1862032
We will likely see proposed spec which will describe in more details relationship between those 2 RFEs before going with implementation of it.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/707407
Committed: https://git.openstack.org/cgit/openstack/neutron-lib/commit/?id=1dfa07ccfd81d21e5e03fdfbd5cdf871f9a17d01
Submitter: Zuul
Branch: master

commit 1dfa07ccfd81d21e5e03fdfbd5cdf871f9a17d01
Author: Igor Malinovskiy <email address hidden>
Date: Wed Feb 12 17:21:18 2020 +0200

    Introduce rbac-address-scope api extension

    This extension makes it possible to add address scope to RBAC policies.

    Change-Id: I9c77a53cf8d91d27ce1aaebfa12c31f2ae823006
    Partial-Bug: #1862968

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/711610

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/712633

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/712633
Committed: https://git.openstack.org/cgit/openstack/neutron-tempest-plugin/commit/?id=a33bd6ee1feb7e23a9333ebba3a88e886bed1b78
Submitter: Zuul
Branch: master

commit a33bd6ee1feb7e23a9333ebba3a88e886bed1b78
Author: Igor Malinovskiy <email address hidden>
Date: Thu Mar 12 11:59:27 2020 +0200

    Disable negative subnetpool test

    Temporary disable negative test that forbids assigning
    shared address scope to subnet pool for tenant users.

    Change-Id: I13dd36b3364b7a0f3241efa6ba5f8c3b2246f167
    Partial-Bug: #1862968

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/709122
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=eb6104c0ac61216234ea958f2fd322e70b8e4bec
Submitter: Zuul
Branch: master

commit eb6104c0ac61216234ea958f2fd322e70b8e4bec
Author: Igor Malinovskiy <email address hidden>
Date: Mon Feb 17 15:01:28 2020 +0200

    Allow sharing of address scopes via RBAC mechanism

    Neutron-lib api ref: https://review.opendev.org/#/c/707407/
    Client: https://review.opendev.org/#/c/709124/
    Tempest tests: https://review.opendev.org/#/c/711610/

    Change-Id: I74bedae4de4eb25e5427ecb129543885a020a0a8
    Depends-On: https://review.opendev.org/712633
    Partial-Bug: #1862968
    Closes-Bug: #1697925

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/711610
Committed: https://git.openstack.org/cgit/openstack/neutron-tempest-plugin/commit/?id=b80f1d0be3b0d3365fc01d0774a9e3357b339630
Submitter: Zuul
Branch: master

commit b80f1d0be3b0d3365fc01d0774a9e3357b339630
Author: Igor Malinovskiy <email address hidden>
Date: Fri Mar 6 13:39:52 2020 +0200

    Add tempest api tests for address scopes RBAC

    Change-Id: I0a625019ab7495a71125edbd37d9005a4675b86b
    Partial-Bug: #1862968
    Depends-On: https://review.opendev.org/709122

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/720248

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/720248
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=8d85b356293d2a5f702523dfc0d21039abdd84fc
Submitter: Zuul
Branch: master

commit 8d85b356293d2a5f702523dfc0d21039abdd84fc
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Apr 15 17:29:04 2020 +0000

    Add "rbac-address-scope" to OVN supported extensions

    Change-Id: I938f9bca3e0477819a07cdb600facd2ebbae40be
    Related-Bug: #1862968