On 28/05/2025 12:05, sluge@mail.ru wrote:
Hi everyone, I'm currently writing a custom nova's policy for my new role myrole. The current task is to create a role for a user with member role already assigned to see servers from other project. For example, I got a token for my user in project1, but want to see servers on project2, where my user has a member and myrole roles also. I added to nova's policy.json line: "os_compute_api:servers:show": "rule:project_reader_or_admin or role:myrole" I already assigned to my user roles member and myrole in the project1 and project2. But I always got a 404 error when I want to show servers from project2. I get 404 even when I use "os_compute_api:servers:show": "" i.e. always true.
server are a project scoped resouces and unless set the project id when creaqting the token to project2 i would expect a request with project ones project to fial. you may be able to pass --all-projects to allow a token issues for a diffent proejct to funciton but nova is not really designed for this type of cross project query.
It only works if I use token of admin user or my user has admin role in project2. It looks like some operations are available for admins only?
there are some limited places where we still enforce the porject at the db level. custom policy is not really intended to make this type of change work. non admins are quried to use a token that is issues for the project that the reousce is owned by if you have added teh user to both projects with your custom role you shoudl be able ot change the project to project 2 in your cloud.yaml or when usign openack token issue to make it functional without admin.