Open Stack

 ---- On Thu, 15 Dec 2022 01:52:43 -0800  Jérôme BECOT  wrote --- 
 > Hello,
 > 
 > I should miss something, and I need some help. I've updated some rules 
 > that I placed in the /etc/nova/policy.yaml file. I use all defaults for 
 > the olso policies (ie scope is not enabled).
 > 
 > When I generate the fulle policy with oslopolicy-policy-generator, the 
 > rules are applied in the generated output. If I test the policy with 
 > oslopolicy-checker under the user's token, the results matches the 
 > permissions, but Nova API continue to refuse the operation
 > 
 > Policy check for os_compute_api:os-flavor-manage:create failed with 
 > credentials

Problem:
-----------
We have two problem here.

First is 'oslopolicy-policy-generator' tool and its usage. This has come up
many times when deployers use this tool with the expectation that generated
the file will work the same as the default way which is not the case. Generated
file by this tool makes you move to the new defaults (remove old defaults and
so does the old token might stop working).

Generating the policy.yaml by oslopolicy-policy-generator tool actually enable the new
defaults even if you have disabled them in the configuration file (via enforce_new_defaults=false).
This tool generates the policy.yaml file by merging the overridden rules and defaults rules
(if no overridden rule then it takes the default one). The newly generated policy.yaml
does not contain the old deprecated rules in logical OR to new defaults (they are added
in logical OR via policy-in-code when there is no policy.yaml). This means only new defaults
will be enforced and depending on the difference between old and new defaults your existing
user token might stop working as you are indirectly moving to the new defaults.

I think I should clarify it in tool help messages or documents so that it is used in the right way.

The second problem we have with the Nova new defaults in Ussuri-Xena is that rules new defaults
contain the special string "system_scope:all" due to this disabling the scope via enforce_scope=false
does not actually disable the scope checks. This is why you are getting errors. This has been
fixed in the yoga release when we redesigned the new RBAC for Openstack.

Recommendation on OpenStack policy:
----------------------------------------------
* Due to the problem where scope checks cannot be disabled (until you override the rule to remove the
"system_scope:all" from rule check_str), we do not recommend enabling the new defaults and use
defaults where old defaults are present and keep your deployment working. 

* Keep the overridden rules only in policy.yaml file and let oslo_policy to take the defaults from
what is there in the code. This way things will work fine.

 
Workaround for Nova policy for Ussuri-Xena:
-----------------------------------------------------
If you enable the new defaults which is the case when you generate the file by 'oslopolicy-policy-generator'
the tool then you can do:

Option 1: Comment out all the rules in the file except overridden rules.

Option 2: Override the below base rules to remove the problematic "system_scope:all" string:
    "system_admin_api": "'role:admin"
    "system_reader_api": "'role:reader"
Please let me know if option 2 works fine for you.


-gmann

 > 
 > I'm using the openstack cli to make the request (openstack flavor create)
 > 
 > Thanks for your help
 > 
 > J
 > 
 > 
 >