Comment 1 for bug 1284718
Revision history for this message
| Salvatore Orlando (salvatore-orlando) wrote Re: interface-attach to shared external network a) works and b) results in undeletable instances | #1 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
0e1f616
(Get the code!)
This happens because "shared" networks access rights allow any tenant to create ports, thus overriding the settings for "external" networks where only admins can create ports, but any tenant can create floating IPs.
A potential use case for this would be a deployment where the same publicly connected network can be used to deploy internet facing appliances, such as load balancers, as well as floating IPs allowing access to instances running on private networks.
Whether this scenario makes sense or not, it is debatable. A new constraint might be added to prevent external networks to be made shared as well.
I think the condition in which a tenant can create ports on external networks can be avoided by simply removing the shared attribute for the network. If that's confirmed this is not a security issue.
Even in the case when a network is explicitly made external and shared, I am still not sure I see a security issue of which people choosing this strategy should be aware.
However, the reported issue where a port created with interface-attach can be removed only in admin context looks like a bug and needs to be triaged.