Open Stack

Hi all,

I'm running a Juno testbed with Neutron, ml2 and ovs. We have use
cases where we would like to create a shared vlan network and directly
attach a VM on this network. This is not hard to do, and I've
described how I did at this page:
http://www.s3it.uzh.ch/blog/openstack-neutron-vlan/

However, there are a few issues with this implementation:

1) *any* tenant can attach VM directly to this network. I would like
   to be able to only allow specific tenants to do it. Can I update
   the policy.json rule "network:attach_external_network" with
   something like:

       "network:attach_external_network": "project_name:'Project1' or
project_name:'Project2'"

   will it work?

2) *any* external/shared network will share the same permissions,
   while I would like to have a few "special" vlan networks as
   described before, and a "standard" external network to be used for
   floating IPs.

   Ideally, I would like to update the previous policy rule with something
   like:

       "admin_api or (network_name: 'vlan842' and project_name:'project1')"

   but I don't know which "variables" can be used inside the
   policy.json file.

3) I don't know if this is a bug or was caused by my changes, but
   after the change I've made in `network:attach_external_network` an
   unprivileged user on a demo tenant can also see a tenant network
   (not external) created by admin *without* `--shared` on the `admin`
   tenant. The user cannot, however, see the details of the network,
   nor attach any interface to it (either router or VM interface).

Is there a way to do it? What variables can be used in the policy.json
file, apart from the standard "project_id" and "user_id"?

Thank you in advance for your precious help

Cheers,
Antonio

-- 
antonio.s.messina at gmail.com
antonio.messina at uzh.ch                     +41 (0)44 635 42 22
S3IT: Service and Support for Science IT   http://www.s3it.uzh.ch/
University of Zurich
Winterthurerstrasse 190
CH-8057 Zurich Switzerland