Neutron's RBAC system supports security group sharing but it's impossible to use with changed policies. When RBAC for security groups was added [1] field "shared" was not added to the database. As result, we cannot use this flag for policy checks and SG sharing will work only with default [2] policy, and it is impossible to configure the policies like:
"shared_security_groups": "field:security_groups:shared=True",
"get_security_group": "rule:admin or rule:shared_security_groups",
How to reproduce:
1. change policies and add check for 'shared' field as mentioned above;
2. create new SG with admin permissions;
3. share the SG to another project;
4. try to get this SG by ID with project owner permissions;
Such policies work perfectly for other RBAC objects like networks, subnet pools etc.
[1] https://review.opendev.org/c/openstack/neutron/+/635311
[2] https://github.com/openstack/neutron/blob/master/neutron/conf/policies/security_group.py#L66
Hello:
I think that was replied in IRC by Slawek. The field "shared" can be used with your custom policies, but SGs objects do not have this field.
For security groups you need to use RBAC. In any case, the "shared" field has been dropped from some DB objects and is still waiting to be removed from others [1][2], in favor of RBACs.
Regards.
[1]https:/
[2]https:/