Public bug reported: When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is used to ensure only Nova has access to the binding API, not the end user.
With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which currently uses admin token. In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user. https://review.openstack.org/#/c/410394/ We can make use new role added by keystoneauth. "service_roles": "service:nova" The above role can be used in policy to define level of access for an action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations. For example, if we want to perform "binding port to host id" operation with service token authentication, we will pass service token along with auth token to communicate with Neutron. In this case, Neutron policy should also allow performing this operation with "service_roles". Spec in Nova: https://review.openstack.org/#/c/439890/ ** Affects: neutron Importance: Undecided Status: New ** Tags: rfe ** Tags added: rfe ** Description changed: When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is used to ensure only Nova has access to the binding API, not the end user. With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which currently uses admin token. In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user. https://review.openstack.org/#/c/410394/ We can make use new role added by keystoneauth. "service_roles": "service:nova" The above role can be used in policy to define level of access for an action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations. - For example, if we want to perform "binding port to host id" operation with - service token authentication, we will pass service token along with auth token - to communicate with Neutron. In this case, Neutron policy should also allow - performing this operation with "service_roles". + For example, if we want to perform "binding port to host id" operation + with service token authentication, we will pass service token along with + auth token to communicate with Neutron. In this case, Neutron policy + should also allow performing this operation with "service_roles". Spec in Nova: https://review.openstack.org/#/c/439890/ ** Description changed: - When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is - used to ensure only Nova has access to the binding API, not the end user. + When other services like Nova talks to the Neutron REST API, it uses an + admin token, in some scenarios like setting the port binding on a port. + In these cases, the admin token is used to ensure only Nova has access + to the binding API, not the end user. - With the introduction of service token, we can use service token instead of - admin token to perform metadata API services related operations which + With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which currently uses admin token. - In Ocata, Nova started sending a service token along with the user token, so Neutron already - knows it is Nova sending a request on behalf of the user. + In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user. https://review.openstack.org/#/c/410394/ We can make use new role added by keystoneauth. "service_roles": "service:nova" The above role can be used in policy to define level of access for an action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations. For example, if we want to perform "binding port to host id" operation with service token authentication, we will pass service token along with auth token to communicate with Neutron. In this case, Neutron policy should also allow performing this operation with "service_roles". Spec in Nova: https://review.openstack.org/#/c/439890/ -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1674349 Title: [RFE] Introduce a new rule with service user role in Neutron policy Status in neutron: New Bug description: When other services like Nova talks to the Neutron REST API, it uses an admin token, in some scenarios like setting the port binding on a port. In these cases, the admin token is used to ensure only Nova has access to the binding API, not the end user. With the introduction of service token, we can use service token instead of admin token to perform metadata API services related operations which currently uses admin token. In Ocata, Nova started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user. https://review.openstack.org/#/c/410394/ We can make use new role added by keystoneauth. "service_roles": "service:nova" The above role can be used in policy to define level of access for an action when service token is used along with user context. This allows to perform any actions for which we have added service role in policy configurations. For example, if we want to perform "binding port to host id" operation with service token authentication, we will pass service token along with auth token to communicate with Neutron. In this case, Neutron policy should also allow performing this operation with "service_roles". Spec in Nova: https://review.openstack.org/#/c/439890/ To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1674349/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
