yahoo-eng-team team mailing list archive

[Rodolfo Alonso <1674349@xxxxxxxxxxxxxxxxxx>]

** Changed in: neutron
       Status: In Progress => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1674349

Title:
  [RFE] Introduce a new rule with service user role in Neutron policy

Status in neutron:
  Invalid

Bug description:
  When other services like Nova talks to the Neutron REST API, it uses
  an admin token, in some scenarios like setting the port binding on a
  port. In these cases, the admin token is used to ensure only Nova has
  access to the binding API, not the end user.

  With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which
  currently uses admin token.

  In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user.
  https://review.openstack.org/#/c/410394/

  We can make use new role added by keystoneauth.

  "service_roles": "service:<service name>"

  The above role can be used in policy to define level of access for an
  action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations.

  For example, if we want to perform "binding port to host id" operation
  with service token authentication, we will pass service token along
  with auth token to communicate with Neutron. In this case, Neutron
  policy should also allow performing this operation with
  "service_roles".

  Spec in Nova:
  https://review.openstack.org/#/c/439890/

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1674349/+subscriptions