<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Hi,</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Dnia środa, 21 czerwca 2023 20:11:56 CEST Ghanshyam Mann pisze:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Hello Everyone,</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Most of you know we had the RBAC discussion at the Vancouver summit on Tuesday.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> - https://etherpad.opendev.org/p/rbac-operator-feedback-vancouver2023</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> This forum session started providing the current progress for RBAC work which you can</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> find in Etherpad</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> - https://etherpad.opendev.org/p/rbac-operator-feedback-vancouver2023#L46</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> After the progress updates, we started the feedback from operators. I am writing the summary</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> and feel free to add anything I missed to capture here:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Admin Access:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ===========</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * Keep current Admin (legacy admin means admin in any project) untouched.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * There is a need for second-level support along with the current admin, and this can be done with the project manager</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * Public Cloud use case:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ----------------------------</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ** Currently defined RBAC goal does not solve the public cloud use case of having a domain admin manage the specific</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> domain's user/project/role.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ** If the domain admin can assign an admin role to any user under their domain, then that user gets admin</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> access across all the projects on the service side (even projects are in different domains as the service side does not have</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> domain boundaries)</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ** We do not have any better solution for now, but one idea is to have the Domain manager allow managing the user/project/</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> role in their domain except 'Admin' role assignment. Current legacy admin (admin across all domains) can handle the 'Admin'</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> role assignment. I mean, domain manager behaves as domain-level admin and legacy admin as a global admin.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Feel free to write other solutions if you have?</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Member Access:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ============</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * Project Member is a good fix and useful to enforce 'member' roles actually </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> Reader Access:</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> ============</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * Project Reader is one of the most useful roles in this change.</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> * There is an ask for a global reader, which was nothing but a system reader in past. This can</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> be useful for performing the audit of the complete cloud. One idea is to do this with a special role</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> _role in Keystone. I will write the spec for it, and we can talk about it there.</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Will this impact existing phases in <a href="https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html">https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html</a> somehow or will this global reader role be considered as next "phase" after project-manager (phase 3) will be done?</p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> -gmann</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">> </p>
<br /><br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">-- </p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Slawek Kaplonski</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Principal Software Engineer</p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Red Hat</p>
</body>
</html>