yahoo-eng-team team mailing list archive

[Pushkar Umaranikar <pushkar.umaranikar@xxxxxxxxx>]

Public bug reported:

When other services like Nova talks to the Neutron REST API, it uses an
admin token, in some scenarios like setting the port binding on a port.
In these cases, the admin token is used to ensure only Nova has access
to the binding API, not the end user.

With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which
currently uses admin token.

In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user.
https://review.openstack.org/#/c/410394/

We can make use new role added by keystoneauth.

"service_roles": "service:nova"

The above role can be used in policy to define level of access for an
action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations.

For example, if we want to perform "binding port to host id" operation
with service token authentication, we will pass service token along with
auth token to communicate with Neutron. In this case, Neutron policy
should also allow performing this operation with "service_roles".

Spec in Nova:
https://review.openstack.org/#/c/439890/

** Affects: neutron
     Importance: Undecided
         Status: New


** Tags: rfe

** Tags added: rfe

** Description changed:

  When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is
  used to ensure only Nova has access to the binding API, not the end user.
  
  With the introduction of service token, we can use service token instead of
  admin token to perform metadata API services related operations which
  currently uses admin token.
  
  In Ocata, Nova started sending a service token along with the user token, so Neutron already
  knows it is Nova sending a request on behalf of the user.
  https://review.openstack.org/#/c/410394/
  
  We can make use new role added by keystoneauth.
  
  "service_roles": "service:nova"
  
  The above role can be used in policy to define level of access for an
  action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations.
  
- For example, if we want to perform "binding port to host id" operation with
- service token authentication, we will pass service token along with auth token
- to communicate with Neutron. In this case, Neutron policy should also allow
- performing this operation with "service_roles".
+ For example, if we want to perform "binding port to host id" operation
+ with service token authentication, we will pass service token along with
+ auth token to communicate with Neutron. In this case, Neutron policy
+ should also allow performing this operation with "service_roles".
  
  Spec in Nova:
  https://review.openstack.org/#/c/439890/

** Description changed:

- When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is
- used to ensure only Nova has access to the binding API, not the end user.
+ When other services like Nova talks to the Neutron REST API, it uses an
+ admin token, in some scenarios like setting the port binding on a port.
+ In these cases, the admin token is used to ensure only Nova has access
+ to the binding API, not the end user.
  
- With the introduction of service token, we can use service token instead of
- admin token to perform metadata API services related operations which
+ With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which
  currently uses admin token.
  
- In Ocata, Nova started sending a service token along with the user token, so Neutron already
- knows it is Nova sending a request on behalf of the user.
+ In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user.
  https://review.openstack.org/#/c/410394/
  
  We can make use new role added by keystoneauth.
  
  "service_roles": "service:nova"
  
  The above role can be used in policy to define level of access for an
  action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations.
  
  For example, if we want to perform "binding port to host id" operation
  with service token authentication, we will pass service token along with
  auth token to communicate with Neutron. In this case, Neutron policy
  should also allow performing this operation with "service_roles".
  
  Spec in Nova:
  https://review.openstack.org/#/c/439890/

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1674349

Title:
  [RFE] Introduce a new rule with service user role in Neutron policy

Status in neutron:
  New

Bug description:
  When other services like Nova talks to the Neutron REST API, it uses
  an admin token, in some scenarios like setting the port binding on a
  port. In these cases, the admin token is used to ensure only Nova has
  access to the binding API, not the end user.

  With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which
  currently uses admin token.

  In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user.
  https://review.openstack.org/#/c/410394/

  We can make use new role added by keystoneauth.

  "service_roles": "service:nova"

  The above role can be used in policy to define level of access for an
  action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations.

  For example, if we want to perform "binding port to host id" operation
  with service token authentication, we will pass service token along
  with auth token to communicate with Neutron. In this case, Neutron
  policy should also allow performing this operation with
  "service_roles".

  Spec in Nova:
  https://review.openstack.org/#/c/439890/

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1674349/+subscriptions