Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: OpenStack: Dev

EC2 api and tenants

 

 

OpenStack dev RSS feed   Index | Next | Previous | View Threaded


mitchell.broome at gmail

Aug 2, 2012, 1:23 PM

Post #1 of 4 (361 views)
Permalink
EC2 api and tenants

I'm using essex 2012.1 and I'm running into an issue with tenant
separation using the ec2 api. I end up having to give a user the
'admin' role in keytone to create instances within a tenant. I can
live with that but the problem is, now that the user has 'admin', they
also see all of the instances including ones from other tenants via a
describe_instances().

If I only give them the 'Member' role, they can only see the instances
within thier default tenant but they can't create instances. Also, if
they only have 'Member', I'm able to create instances via horizon
manually.

I'm assuming I'm missing some combination of roles I need to setup to
allow a users to create instances in thier default tenant but not see
other instances in other tenants.

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack [at] lists
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp


vishvananda at gmail

Aug 2, 2012, 3:46 PM

Post #2 of 4 (351 views)
Permalink
Re: EC2 api and tenants [In reply to]

Which version of the code are you using? This could potentially be a bug.
Can you give some more information on what goes wrong with creating an instance?
Do you get a traceback anywhere?

Vish

On Aug 2, 2012, at 1:23 PM, Mitchell Broome <mitchell.broome [at] gmail> wrote:

> I'm using essex 2012.1 and I'm running into an issue with tenant
> separation using the ec2 api. I end up having to give a user the
> 'admin' role in keytone to create instances within a tenant. I can
> live with that but the problem is, now that the user has 'admin', they
> also see all of the instances including ones from other tenants via a
> describe_instances().
>
> If I only give them the 'Member' role, they can only see the instances
> within thier default tenant but they can't create instances. Also, if
> they only have 'Member', I'm able to create instances via horizon
> manually.
>
> I'm assuming I'm missing some combination of roles I need to setup to
> allow a users to create instances in thier default tenant but not see
> other instances in other tenants.
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to : openstack [at] lists
> Unsubscribe : https://launchpad.net/~openstack
> More help : https://help.launchpad.net/ListHelp


_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack [at] lists
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp


rlane at wikimedia

Aug 2, 2012, 3:51 PM

Post #3 of 4 (349 views)
Permalink
Re: EC2 api and tenants [In reply to]

On Thu, Aug 2, 2012 at 1:23 PM, Mitchell Broome
<mitchell.broome [at] gmail> wrote:
> I'm using essex 2012.1 and I'm running into an issue with tenant
> separation using the ec2 api. I end up having to give a user the
> 'admin' role in keytone to create instances within a tenant. I can
> live with that but the problem is, now that the user has 'admin', they
> also see all of the instances including ones from other tenants via a
> describe_instances().
>
> If I only give them the 'Member' role, they can only see the instances
> within thier default tenant but they can't create instances. Also, if
> they only have 'Member', I'm able to create instances via horizon
> manually.
>
> I'm assuming I'm missing some combination of roles I need to setup to
> allow a users to create instances in thier default tenant but not see
> other instances in other tenants.
>

So far, from what I can tell, you need to add custom roles (or
continue using sysadmin and netadmin), and add these roles to the
proper actions in policy.json.

- Ryan

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack [at] lists
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp


mitchell.broome at gmail

Aug 3, 2012, 5:32 AM

Post #4 of 4 (357 views)
Permalink
Re: EC2 api and tenants [In reply to]

Ryan,

This looks like what the problem was. I'm running 2012.1 from the
epel packages on centos 6.2. The ec2 layer doesn't look like it
follows policy.json by default. It still has roles for netadmin,
sysadmin and projectmanager hard coded in nova/api/ec2/__init__.py.
Right now, I'm just making use of netadmin and sysadmin rather than
creating new rules in policy.json.



On Thu, Aug 2, 2012 at 6:51 PM, Ryan Lane <rlane [at] wikimedia> wrote:
> On Thu, Aug 2, 2012 at 1:23 PM, Mitchell Broome
> <mitchell.broome [at] gmail> wrote:
>> I'm using essex 2012.1 and I'm running into an issue with tenant
>> separation using the ec2 api. I end up having to give a user the
>> 'admin' role in keytone to create instances within a tenant. I can
>> live with that but the problem is, now that the user has 'admin', they
>> also see all of the instances including ones from other tenants via a
>> describe_instances().
>>
>> If I only give them the 'Member' role, they can only see the instances
>> within thier default tenant but they can't create instances. Also, if
>> they only have 'Member', I'm able to create instances via horizon
>> manually.
>>
>> I'm assuming I'm missing some combination of roles I need to setup to
>> allow a users to create instances in thier default tenant but not see
>> other instances in other tenants.
>>
>
> So far, from what I can tell, you need to add custom roles (or
> continue using sysadmin and netadmin), and add these roles to the
> proper actions in policy.json.
>
> - Ryan

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack [at] lists
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp

OpenStack dev RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.