openstack/openstack-manuals
Code Issues Proposed changes

Clarify heat roles

Browse Source 
Building on an earlier patch, I further clarified the purpose
of the heat_stack_owner and heat_stack_user roles.

Change-Id: I67804d2e7bfbd53e8f453adc251a102c6f0e39ff
Closes-Bug: #1401668
backport: juno
This commit is contained in:
Matthew Kassawara 2014-12-22 15:31:49 -06:00
parent 14903f4e5e
commit 01a4e4060b
1 changed files with 23 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
doc/install-guide/section_heat-install.xml
View File

@ -72,20 +72,29 @@
</note> </note>
</step> </step>
<step> <step>
<para>Create the <literal>heat_stack_user</literal> and <para>Create the <literal>heat_stack_owner</literal> role:</para>
<literal>heat_stack_owner</literal> roles:</para> <screen><prompt>$</prompt> <userinput>keystone role-create --name heat_stack_owner</userinput></screen>
<screen><prompt>$</prompt> <userinput>keystone role-create --name heat_stack_user</userinput> </step>
<prompt>$</prompt> <userinput>keystone role-create --name heat_stack_owner</userinput></screen> <step>
<para>By default, users created by Orchestration use the <para>Add the <literal>heat_stack_owner</literal> role to the
<literal>heat_stack_user</literal> role.</para> <literal>demo</literal> tenant and user:</para>
<para>The <literal>heat_stack_user</literal> role is for users <screen><prompt>$</prompt> <userinput>keystone user-role-add --user demo --tenant demo --role heat_stack_owner</userinput></screen>
created by heat, and is restricted to specific API actions. <note>
The <literal>heat_stack_owner</literal> role is assigned to <para>You must add the <literal>heat_stack_owner</literal>
users who create heat stacks.</para> role to users that manage stacks.</para>
<warning><para>Because the <literal>heat_stack_owner</literal> </note>
role has limited operational access to heat, you must never </step>
assign this role to a user with a <literal>heat_stack_user</literal> <step>
role.</para></warning> <para>Create the <literal>heat_stack_user</literal> role:</para>
<screen><prompt>$</prompt> <userinput>keystone role-create --name heat_stack_user</userinput></screen>
<note>
<para>The Orchestration service automatically assigns the
<literal>heat_stack_user</literal> role to users that it
creates during stack deployment. By default, this role
restricts <glossterm>API</glossterm> operations. To avoid
conflicts, do not add this role to users with the
<literal>heat_stack_owner</literal> role.</para>
</note>
</step> </step>
<step> <step>
<para>Create the <literal>heat</literal> and <para>Create the <literal>heat</literal> and