yahoo-eng-team team mailing list archive

[OpenStack Infra <1547985@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.openstack.org/282295
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=49b4dd3478d782aee4260033825aa6b47eaf644a
Submitter: Jenkins
Branch:    master

commit 49b4dd3478d782aee4260033825aa6b47eaf644a
Author: Kevin Benton <kevin@xxxxxxxxxx>
Date:   Fri Feb 19 03:34:27 2016 -0800

    Use network RBAC feature for external access
    
    This allows access to external networks to be controlled via the
    RBAC framework added during Liberty with a new 'access_as_external'
    action.
    
    A migration adds all current external networks to the RBAC policies
    table with a wildcard indicating that all tenants can access the network
    as RBAC.
    
    Unlike the conversion of shared networks to RBAC, the external table
    is left in the DB to avoid invasive changes throughout the codebase
    to calculate the flag relative to the caller. So the current 'external'
    flag is used throughout the code base as it previously was for wiring
    up floating IPs, router gateway ports, etc. Then the RBAC entries are
    only referenced when determining what networks to show the tenants.
    
    API Behavior:
     * Marking a network as 'external' will automatically create a wildcard
       entry that allows that network to be accessed by all tenants.
     * An external network may have all of its RBAC entries deleted and then
       only an admin will be able to attach to it.
     * An RBAC 'access_as_external' entry cannot be deleted if it is required
       for a tenant that currently has a router attached to that network.
     * Creating an 'access_as_external' RBAC entry will automatically convert
       the network into an external network. (This is to enable a workflow
       where a private external network is never visible to everyone.)
     * The default policy.json will prevent a non-admin from creating wildcard
       'access_as_external' RBAC entries to align with the current default policy
       we have on setting the 'external' field on the network to prevent poluting
       everyone else's network lists.
     * The default policy.json will allow a tenant to create an
       'access_as_external' RBAC entry to allow specific tenants
       (including itself) the ability to use its network as an external network.
    
    Closes-Bug: #1547985
    DocImpact: External networks can now have access restricted to small subsets
               of tenants
    APIImpact: 'access_as_external' will be allowed as an action in the RBAC
               API for networks
    Change-Id: I4d8ee78a9763c58884e4fd3d7b40133da659cd61


** Changed in: neutron
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1547985

Title:
  Control external network access with RBAC

Status in neutron:
  Fix Released

Bug description:
  There is currently no way to restrict the tenants that have access to
  an external network in Neutron. So there is currently no workflow to
  have a special set of floating IPs that only certain tenants can
  access. In order to support this, access to external networks should
  be controlled via the RBAC framework that was introduced to limit
  access to shared networks.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1547985/+subscriptions