Chapter 5. Managing roles
Chapter 5. Managing roles Red Hat OpenStack Services on OpenShift (RHOSO) uses secure role-based access control (SRBAC) to manage access to its resources. Roles define which actions users can perform. By default, there are three predefined roles: A reader role for viewing permissions on specificed projects. A member role for creating and managing resources within specified projects. An administrative role to enable non-admin users to administer the environment. You can also create custom roles specific to your environment. 5.1. Understanding OpenStack admin role When you assign a user the role of admin in an OpenStack project, this user has permissions to view, change, create, or delete any resource on any project. This user can create shared resources that are accessible across projects, such as publicly available glance images, or provider networks. Additionally, a user with the admin role can create or delete users and manage roles. The project to which you assign a user the admin role is the default project in which openstack commands are executed. For example, if an admin user in a project named development runs the following command, a network called internal-network is created in the development project: The admin user can create an internal-network in any project by using the --project parameter: 5.2. Viewing roles with the CLI As an administrator, you can view the details of existing roles. Procedure List the available predefined roles: View details for a specified role: Note To get detailed information on the permissions associated with each role, you must audit its access to each API call. 5.3. Assigning roles in Red Hat OpenStack Services on OpenShift With SRBAC on Red Hat OpenStack Services on OpenShift (RHOSO), you can assign users to the role of admin, member, or reader within either the project or system scope. Procedure Use syntax similar to the following to provide a user a role with a project scope: Example command Use syntax similar to the following to provide a user a role with a system scope: Example command Replace <role> with either reader, member, or admin.
openstack network create internal-network openstack network create internal-network --project testing openstack role list openstack role show admin openstack role add --user user1 --user-domain Default --project demo --project-domain Default <role> openstack role add --user user1 --user-domain Default --system all <role>