65b9dc622f
This updates the default RBAC rules for multiple resources to allow for a seamless integration with Octavia without having to give Octavia system scope admin in the entire cloud. The current use of the service role in the RBAC rules allows for pretty much all of the permissions that Octavia needs today except for a few. It needs get_subnet to be able to retrieve a subnet and check the details, this is low impact as we already allow get_network. It also needs get_network_ip_availability because it supports to automatically select a subnet (if none is given) on a network based on the amount of available IP addresses. The default Amphora compute driver for Octavia uses a keepalived and HAProxy implementation that uses unicast VRRP for the VIP address, this VIP address is added as an allowed address pair on the ports for the amphora compute instances so the VIP port itself is not bound. Octavia also depends on being able to populate the ``device_id`` field on a port which means it also needs this patch [1] together with this one. [1] https://review.opendev.org/c/openstack/neutron/+/947003 Closes-Bug: #2105502 Change-Id: I089999cece698af1a3b54d1341d9004d4108ae44
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
---
|
|
features:
|
|
- |
|
|
Updated RBAC rules so that they allow the ``service`` role to pass the
|
|
following policies by default:
|
|
|
|
- ``get_subnet``
|
|
|
|
- ``get_network_ip_availability``
|
|
|
|
- ``create_port:allowed_address_pairs``
|
|
|
|
- ``create_port:allowed_address_pairs:mac_address``
|
|
|
|
- ``create_port:allowed_address_pairs:ip_address``
|
|
|
|
- ``update_port:allowed_address_pairs``
|
|
|
|
- ``update_port:allowed_address_pairs:mac_address``
|
|
|
|
- ``update_port:allowed_address_pairs:ip_address``
|
|
|
|
This allows for integration with the Octavia project using the
|
|
``service`` role instead of the ``admin`` role for integration
|
|
with Neutron.
|
|
upgrade:
|
|
- |
|
|
Default RBAC policies for ``get_subnet``, ``get_network_ip_availability``,
|
|
``create_port:allowed_address_pairs``, ``create_port:allowed_address_pairs:mac_address``,
|
|
``create_port:allowed_address_pairs:ip_address``, ``update_port:allowed_address_pairs``,
|
|
``update_port:allowed_address_pairs:mac_address`` and
|
|
``update_port:allowed_address_pairs:ip_address`` have been updated to allow the
|
|
``service`` role.
|