The Role-Based Access Control (RBAC) policy framework enables both operators and users to grant access to resources for specific projects or tenants. Prior to RBAC, Neutron applied an all-or-nothing approach to the sharing of networks across projects. If a network was marked as shared, it was shared with all projects. Access control policies built using the Neutron RBAC API allow operators and users to share certain network resources with one or more projects using a more granular approach.
As of the Pike release of OpenStack, access that can be granted using access control policies includes the following:
- Regular port creation permissions on networks
- Attaching router gateways to networks
- Binding Quality of Service (QoS) policy permissions to networks or ports
In this chapter, we will focus on the concept and implementation of role-based access control...