Mailing List Archive

EC2 api and tenants
I'm using essex 2012.1 and I'm running into an issue with tenant
separation using the ec2 api. I end up having to give a user the
'admin' role in keytone to create instances within a tenant. I can
live with that but the problem is, now that the user has 'admin', they
also see all of the instances including ones from other tenants via a
describe_instances().

If I only give them the 'Member' role, they can only see the instances
within thier default tenant but they can't create instances. Also, if
they only have 'Member', I'm able to create instances via horizon
manually.

I'm assuming I'm missing some combination of roles I need to setup to
allow a users to create instances in thier default tenant but not see
other instances in other tenants.

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack@lists.launchpad.net
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp
Re: EC2 api and tenants [ In reply to ]
Which version of the code are you using? This could potentially be a bug.
Can you give some more information on what goes wrong with creating an instance?
Do you get a traceback anywhere?

Vish

On Aug 2, 2012, at 1:23 PM, Mitchell Broome <mitchell.broome@gmail.com> wrote:

> I'm using essex 2012.1 and I'm running into an issue with tenant
> separation using the ec2 api. I end up having to give a user the
> 'admin' role in keytone to create instances within a tenant. I can
> live with that but the problem is, now that the user has 'admin', they
> also see all of the instances including ones from other tenants via a
> describe_instances().
>
> If I only give them the 'Member' role, they can only see the instances
> within thier default tenant but they can't create instances. Also, if
> they only have 'Member', I'm able to create instances via horizon
> manually.
>
> I'm assuming I'm missing some combination of roles I need to setup to
> allow a users to create instances in thier default tenant but not see
> other instances in other tenants.
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to : openstack@lists.launchpad.net
> Unsubscribe : https://launchpad.net/~openstack
> More help : https://help.launchpad.net/ListHelp


_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack@lists.launchpad.net
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp
Re: EC2 api and tenants [ In reply to ]
On Thu, Aug 2, 2012 at 1:23 PM, Mitchell Broome
<mitchell.broome@gmail.com> wrote:
> I'm using essex 2012.1 and I'm running into an issue with tenant
> separation using the ec2 api. I end up having to give a user the
> 'admin' role in keytone to create instances within a tenant. I can
> live with that but the problem is, now that the user has 'admin', they
> also see all of the instances including ones from other tenants via a
> describe_instances().
>
> If I only give them the 'Member' role, they can only see the instances
> within thier default tenant but they can't create instances. Also, if
> they only have 'Member', I'm able to create instances via horizon
> manually.
>
> I'm assuming I'm missing some combination of roles I need to setup to
> allow a users to create instances in thier default tenant but not see
> other instances in other tenants.
>

So far, from what I can tell, you need to add custom roles (or
continue using sysadmin and netadmin), and add these roles to the
proper actions in policy.json.

- Ryan

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack@lists.launchpad.net
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp
Re: EC2 api and tenants [ In reply to ]
Ryan,

This looks like what the problem was. I'm running 2012.1 from the
epel packages on centos 6.2. The ec2 layer doesn't look like it
follows policy.json by default. It still has roles for netadmin,
sysadmin and projectmanager hard coded in nova/api/ec2/__init__.py.
Right now, I'm just making use of netadmin and sysadmin rather than
creating new rules in policy.json.



On Thu, Aug 2, 2012 at 6:51 PM, Ryan Lane <rlane@wikimedia.org> wrote:
> On Thu, Aug 2, 2012 at 1:23 PM, Mitchell Broome
> <mitchell.broome@gmail.com> wrote:
>> I'm using essex 2012.1 and I'm running into an issue with tenant
>> separation using the ec2 api. I end up having to give a user the
>> 'admin' role in keytone to create instances within a tenant. I can
>> live with that but the problem is, now that the user has 'admin', they
>> also see all of the instances including ones from other tenants via a
>> describe_instances().
>>
>> If I only give them the 'Member' role, they can only see the instances
>> within thier default tenant but they can't create instances. Also, if
>> they only have 'Member', I'm able to create instances via horizon
>> manually.
>>
>> I'm assuming I'm missing some combination of roles I need to setup to
>> allow a users to create instances in thier default tenant but not see
>> other instances in other tenants.
>>
>
> So far, from what I can tell, you need to add custom roles (or
> continue using sysadmin and netadmin), and add these roles to the
> proper actions in policy.json.
>
> - Ryan

_______________________________________________
Mailing list: https://launchpad.net/~openstack
Post to : openstack@lists.launchpad.net
Unsubscribe : https://launchpad.net/~openstack
More help : https://help.launchpad.net/ListHelp