ロールベースアクセス制御 (RBAC)¶

ロールベースアクセス制御 (RBAC) ポリシーフレームワークにより、オペレーターとユーザーのどちらもがリソースへのアクセスを特定のプロジェクトに対して許可できるようになりました。

特定のプロジェクトとのネットワークの共有¶

共有するネットワークを作成します。

$ openstack network create secret_network
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2017-01-25T20:16:40Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | f55961b9-3eb8-42eb-ac96-b97038b568de |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | None                                 |
| mtu                       | 1450                                 |
| name                      | secret_network                       |
| port_security_enabled     | True                                 |
| project_id                | 61b7eba037fd41f29cfba757c010faff     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 9                                    |
| qos_policy_id             | None                                 |
| revision_number           | 3                                    |
| router:external           | Internal                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| updated_at                | 2017-01-25T20:16:40Z                 |
+---------------------------+--------------------------------------+

Create the policy entry using the openstack network rbac create command (in this example, the ID of the project we want to share with is b87b2fc13e0248a4a031d38e06dc191d):

$ openstack network rbac create --target-project \
b87b2fc13e0248a4a031d38e06dc191d --action access_as_shared \
--type network f55961b9-3eb8-42eb-ac96-b97038b568de
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_shared                     |
| id                | f93efdbf-f1e0-41d2-b093-8328959d469e |
| name              | None                                 |
| object_id         | f55961b9-3eb8-42eb-ac96-b97038b568de |
| object_type       | network                              |
| project_id        | 61b7eba037fd41f29cfba757c010faff     |
| target_project_id | b87b2fc13e0248a4a031d38e06dc191d     |
+-------------------+--------------------------------------+

The target-project parameter specifies the project that requires access to the network. The action parameter specifies what the project is allowed to do. The type parameter says that the target object is a network. The final parameter is the ID of the network we are granting access to.

Project b87b2fc13e0248a4a031d38e06dc191d will now be able to see the network when running openstack network list and openstack network show and will also be able to create ports on that network. No other users (other than admins and the owner) will be able to see the network.

To remove access for that project, delete the policy that allows it using the openstack network rbac delete command:

$ openstack network rbac delete f93efdbf-f1e0-41d2-b093-8328959d469e

そのプロジェクトのポートが対象のネットワークにある場合は、そのポートが削除されるまでポリシーを削除することはできません。

$ openstack network rbac delete f93efdbf-f1e0-41d2-b093-8328959d469e
RBAC policy on object f93efdbf-f1e0-41d2-b093-8328959d469e
cannot be removed because other objects depend on it.

この手順を繰り返して、任意の数のプロジェクトとネットワークを共有できます。

特定のプロジェクトとの QoS ポリシーの共有¶

共有する QoS ポリシーを作成します。

$ openstack network qos policy create secret_policy
+-------------+--------------------------------------+
| Field       | Value                                |
+-------------+--------------------------------------+
| description |                                      |
| id          | 1f730d69-1c45-4ade-a8f2-89070ac4f046 |
| name        | secret_policy                        |
| project_id  | 61b7eba037fd41f29cfba757c010faff     |
| rules       | []                                   |
| shared      | False                                |
+-------------+--------------------------------------+

Create the RBAC policy entry using the openstack network rbac create command (in this example, the ID of the project we want to share with is be98b82f8fdf46b696e9e01cebc33fd9):

$ openstack network rbac create --target-project \
be98b82f8fdf46b696e9e01cebc33fd9 --action access_as_shared \
--type qos_policy 1f730d69-1c45-4ade-a8f2-89070ac4f046
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_shared                     |
| id                | 8828e38d-a0df-4c78-963b-e5f215d3d550 |
| name              | None                                 |
| object_id         | 1f730d69-1c45-4ade-a8f2-89070ac4f046 |
| object_type       | qos_policy                           |
| project_id        | 61b7eba037fd41f29cfba757c010faff     |
| target_project_id | be98b82f8fdf46b696e9e01cebc33fd9     |
+-------------------+--------------------------------------+

The target-project parameter specifies the project that requires access to the QoS policy. The action parameter specifies what the project is allowed to do. The type parameter says that the target object is a QoS policy. The final parameter is the ID of the QoS policy we are granting access to.

Project be98b82f8fdf46b696e9e01cebc33fd9 will now be able to see the QoS policy when running openstack network qos policy list and openstack network qos policy show and will also be able to bind it to its ports or networks. No other users (other than admins and the owner) will be able to see the QoS policy.

To remove access for that project, delete the RBAC policy that allows it using the openstack network rbac delete command:

$ openstack network rbac delete 8828e38d-a0df-4c78-963b-e5f215d3d550

このプロジェクトにその QoS ポリシーが適用されたネットワークのポートがある場合は、その QoS ポリシーが使われなくなるまで RBAC ポリシーの削除は行われません。

$ openstack network rbac delete 8828e38d-a0df-4c78-963b-e5f215d3d550
RBAC policy on object 8828e38d-a0df-4c78-963b-e5f215d3d550
cannot be removed because other objects depend on it.

この手順を繰り返して、任意の数のプロジェクトと QoS ポリシーを共有できます。

‘shared’ フラグとポリシーエントリーの関係¶

他の箇所に説明があるように、 neutron ではオブジェクト (network, qos-policy) をすべてのプロジェクトと共有する方法が提供されています。これを行うには、オブジェクトの shared フラグを使います。

$ openstack network create global_network --share
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2017-01-25T20:32:06Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | 84a7e627-573b-49da-af66-c9a65244f3ce |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | None                                 |
| mtu                       | 1450                                 |
| name                      | global_network                       |
| port_security_enabled     | True                                 |
| project_id                | 61b7eba037fd41f29cfba757c010faff     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 7                                    |
| qos_policy_id             | None                                 |
| revision_number           | 3                                    |
| router:external           | Internal                             |
| segments                  | None                                 |
| shared                    | True                                 |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| updated_at                | 2017-01-25T20:32:07Z                 |
+---------------------------+--------------------------------------+

This is the equivalent of creating a policy on the network that permits every project to perform the action access_as_shared on that network. Neutron treats them as the same thing, so the policy entry for that network should be visible using the openstack network rbac list command:

$ openstack network rbac list
+-------------------------------+-------------+--------------------------------+
| ID                            | Object Type | Object ID                      |
+-------------------------------+-------------+--------------------------------+
| 58a5ee31-2ad6-467d-           | qos_policy  | 1f730d69-1c45-4ade-            |
| 8bb8-8c2ae3dd1382             |             | a8f2-89070ac4f046              |
| 27efbd79-f384-4d89-9dfc-      | network     | 84a7e627-573b-49da-            |
| 6c4a606ceec6                  |             | af66-c9a65244f3ce              |
+-------------------------------+-------------+--------------------------------+

neutron rbac-show を使うと、詳細を確認できます。

$ openstack network rbac show 27efbd79-f384-4d89-9dfc-6c4a606ceec6
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_shared                     |
| id                | 27efbd79-f384-4d89-9dfc-6c4a606ceec6 |
| name              | None                                 |
| object_id         | 84a7e627-573b-49da-af66-c9a65244f3ce |
| object_type       | network                              |
| project_id        | 61b7eba037fd41f29cfba757c010faff     |
| target_project_id | *                                    |
+-------------------+--------------------------------------+

The output shows that the entry allows the action access_as_shared on object 84a7e627-573b-49da-af66-c9a65244f3ce of type network to target_tenant *, which is a wildcard that represents all projects.

現時点では、 shared フラグは単にネットワークの RBAC ポリシーにマッピングされているだけです。ネットワークの shared フラグを True に設定すると、ワイルドカードの RBAC エントリーが作成されます。フラグを False に設定すると、ワイルドカードエントリーは削除されます。

When you run openstack network list or openstack network show, the shared flag is calculated by the server based on the calling project and the RBAC entries for each network. For QoS objects use openstack network qos policy list or openstack network qos policy show respectively. If there is a wildcard entry, the shared flag is always set to True. If there are only entries that share with specific projects, only the projects the object is shared to will see the flag as True and the rest will see the flag as False.

ネットワークの外部ネットワークとしての使用の許可¶

あるネットワークの外部ネットワークとしての利用を、すべてのプロジェクトではなく特定のプロジェクトに対してだけ許可するには、 access_as_external アクションを使用します。

外部ネットワークとして利用できるようにするネットワークを作成します。

$ openstack network create secret_external_network
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2017-01-25T20:36:59Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | 802d4e9e-4649-43e6-9ee2-8d052a880cfb |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | None                                 |
| mtu                       | 1450                                 |
| name                      | secret_external_network              |
| port_security_enabled     | True                                 |
| project_id                | 61b7eba037fd41f29cfba757c010faff     |
| proider:network_type      | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 21                                   |
| qos_policy_id             | None                                 |
| revision_number           | 3                                    |
| router:external           | Internal                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| updated_at                | 2017-01-25T20:36:59Z                 |
+---------------------------+--------------------------------------+

Create a policy entry using the openstack network rbac create command (in this example, the ID of the project we want to share with is 838030a7bf3c4d04b4b054c0f0b2b17c):

$ openstack network rbac create --target-project \
838030a7bf3c4d04b4b054c0f0b2b17c --action access_as_external \
--type network 802d4e9e-4649-43e6-9ee2-8d052a880cfb
+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| action            | access_as_external                   |
| id                | afdd5b8d-b6f5-4a15-9817-5231434057be |
| name              | None                                 |
| object_id         | 802d4e9e-4649-43e6-9ee2-8d052a880cfb |
| object_type       | network                              |
| project_id        | 61b7eba037fd41f29cfba757c010faff     |
| target_project_id | 838030a7bf3c4d04b4b054c0f0b2b17c     |
+-------------------+--------------------------------------+

The target-project parameter specifies the project that requires access to the network. The action parameter specifies what the project is allowed to do. The type parameter indicates that the target object is a network. The final parameter is the ID of the network we are granting external access to.

Now project 838030a7bf3c4d04b4b054c0f0b2b17c is able to see the network when running openstack network list and openstack network show and can attach router gateway ports to that network. No other users (other than admins and the owner) are able to see the network.

To remove access for that project, delete the policy that allows it using the openstack network rbac delete command:

$ openstack network rbac delete afdd5b8d-b6f5-4a15-9817-5231434057be

そのプロジェクトのルーターのゲートウェイポートが対象のネットワークにある場合は、そのポートが削除されるまでポリシーを削除することはできません。

$ openstack network rbac delete afdd5b8d-b6f5-4a15-9817-5231434057be
RBAC policy on object afdd5b8d-b6f5-4a15-9817-5231434057be
cannot be removed because other objects depend on it.

この手順を繰り返して、任意の数のプロジェクトに対して、あるネットワークを外部ネットワークとして利用可能にできます。

ネットワーク作成時に external (外部ネットワーク) フラグが指定された場合は、全員にアクセスを許可するワイルドカードの RBAC ポリシーが作成され、本機能が追加される前の動作は保持されます。

$ openstack network create global_external_network --external
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2017-01-25T20:41:44Z                 |
| description               |                                      |
| dns_domain                | None                                 |
| id                        | 72a257a2-a56e-4ac7-880f-94a4233abec6 |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | None                                 |
| mtu                       | 1450                                 |
| name                      | global_external_network              |
| port_security_enabled     | True                                 |
| project_id                | 61b7eba037fd41f29cfba757c010faff     |
| provider:network_type     | vxlan                                |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 69                                   |
| qos_policy_id             | None                                 |
| revision_number           | 4                                    |
| router:external           | External                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| updated_at                | 2017-01-25T20:41:44Z                 |
+---------------------------+--------------------------------------+

In the output above the standard router:external attribute is External as expected. Now a wildcard policy is visible in the RBAC policy listings:

$ openstack network rbac list --long -c ID -c Action
+--------------------------------------+--------------------+
| ID                                   | Action             |
+--------------------------------------+--------------------+
| b694e541-bdca-480d-94ec-eda59ab7d71a | access_as_external |
+--------------------------------------+--------------------+

他の access_as_external RBAC ポリシーと同じく、このポリシーも、同じ制約の元、変更したり削除したりできます。