Hello,
I've been working on updating policy rules in heat according to the latest guideline for SRBAC implementation.
Based on the recent direction change[1], now only project users are allowed to create project-based resources like instances or networks. I'm updating policy rules in heat so that only project users can manage project resources in Heat like stacks or resources.
[1] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rba...
However this change reveals one potential issue with system resources.
In heat there are some resource types like OS::Nova::Flavor or OS::Keystone::User which is allowed for only system users. (I'll call these resources as "system resources" here)
Because heat uses user credentials to create resources in backend services, if we require project scope for stack/resource management then we are no longer able to create these system resources as part of stack. (*1)
There are some options I can think of at this moment.
1. Deprecate and remove all resources which require system scope Pros - This is most easy solution to be implemented Cons - This one has the biggest user impact
2. Use service credential for resource creation Pros: - This might have smallest user impact Cons: - This requires a relatively big change in heat's architecture, which I've not yet evaluated. - We need to determine the project scope role to be allowed to do system operation.
3. Implement additional project-role in each service to allow creation via stack creation. Pros: - This would avoid user impact. Cons: - requires work in multiple components. - We need to determine the project scope role to be allowed to do system operation.
I'm not quite sure which one would be the best. If I can ask for some feedback about these options (or any other new options) from heat's perspective and rbac's perspective then it would be nice.
(*1) As of now, nova and neutron no longer allow creating system users to create project resources, so system users are no longer able to create stacks with project resources like instances or networks with default "new" policies.
Thank you, Takashi