Reviewed: https://review.opendev.org/507446 Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=c9242f9a889f4d69653de4d21bec6060f549ee7b Submitter: Zuul Branch: master
commit c9242f9a889f4d69653de4d21bec6060f549ee7b Author: andrewbogott <[email protected]> Date: Thu Dec 26 23:34:31 2019 -0600 Allow RBAC on Neutron quotas This patch adds the support to allow role based access control on quota of resources. Change-Id: I6544d4a0794944abb3e1c2ff89134bf313cf35e8 Closes-Bug: #1671448 ** Changed in: neutron Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1671448 Title: [RFE] Neutron quota api should be configurable via policy.json Status in neutron: Fix Released Bug description: Neutron does not have rbac rule support for quota in neutron policy.json >> https://github.com/openstack/neutron/blob/master/etc/policy.json . The rbac validations are programmatically hardcoded in the neutron quota api flow >> https://github.com/openstack/neutron/blob/master/neutron/pecan_wsgi/controllers/quota.py . For this reason, we currently do not have a mechanism to configure this in neutron policy.json. All REST api CRUD calls should have role based access control in place and OpenStack uses oslo_policy and policy.json files for this. There are rbac rules that are defined in the policy.json (one for each REST api CRUD operation) that can be used to configure the roles that can access the REST api. The neutron quota REST api however does not have this in place. For eg. cinder policy.json has the below rules that can be used to configure RBAC on cinder quotas: "volume_extension:quotas:show": "", "volume_extension:quotas:update": "rule:admin_api", "volume_extension:quotas:delete": "rule:admin_api", https://github.com/openstack/cinder/blob/master/etc/cinder/policy.json#L44 To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1671448/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
