openstack privileges documented #4214

iamemilio · 2020-09-24T19:33:04Z

Document the bare minimum permissions needed to install a cluster on openstack.

Fedosin · 2020-09-24T19:40:40Z

docs/user/openstack/privileges.md

@@ -0,0 +1,51 @@
+# Required Privileges
+
+In order to install an OpenShift cluster on OpenStack successfully, the user provided to the installer needs certian privileges. The easiest way to achieve this level of permission and ensure success is to install with a user who has administrative privileges.


EDIT: Just bringing a bit of context since the file was correctly updated (not sure if it was brought here before).

I don't think that a Keystone user has to get admin Keystone role into its Keystone project.
Example given, I'm currently a regular user of Red Hat's internal OpenStack Cloud (PSI), and I only have the member role into my Keystone project and I can deploy OpenShift just fine. I would create the necessary resources (VMs, volumes, networks, FIPs, etc) without permission error.

If I understand your wording here is that it would be required to obtain admin role in the project but I don't think that would be 1) necessary and 2) secure for the cloud admins to give admin power to their users.

Fedosin · 2020-09-24T19:41:31Z

docs/user/openstack/privileges.md

+| Resource | Permissions |
+|    ---   |     ---     |
+| Instance |     All     |
+| Availibility Zone |     Read     |


Availability

Fedosin · 2020-09-24T19:41:52Z

docs/user/openstack/privileges.md

+
+## Bring Your Own Networks
+
+Using the [bring your own networks feature](https://github.com/openshift/installer/blob/master/docs/user/openstack/customization.md#custom-subnets) will allow you use already prepared networking infrastrucutre. This would mean that an installation using this feature for all nodes will no longer require any permissions for Networks, Subnets, and Routers.


infrastructure

Fedosin · 2020-09-24T19:42:09Z

docs/user/openstack/privileges.md

+
+## Floating IP Free Installs
+
+By leaving the `externalNetwork`, `ingressFloatingIP`, and `appsFloatingIP` fields empty, you can run the installer without creating, deleting, or modifiying any floating IPs. Running the installer this way does not require you to have any Floating IP Privileges.


tombarron · 2020-09-24T20:00:05Z

docs/user/openstack/privileges.md

@@ -0,0 +1,51 @@
+# Required Privileges
+
+In order to install an OpenShift cluster on OpenStack successfully, the user provided to the installer needs certian privileges. The easiest way to achieve this level of permission and ensure success is to install with a user who has administrative privileges.


That's a bit like saying the easiest way to run a program on a *nix system is to run as root. Since ShiftOnStack deployments are intended to be usable by regular users without any special privileges I'd advocate for a document that notes default user privileges as such and any needed departures from these. Each departure represents a service ticket the user must open to the OSP administrator (think "help" ticket to PSI) rather than self-service IAAS that OSP is supposed to provide regular users.

Do you know where I can find better documentation about what permissions a default openstack user has @tombarron ? I have been having a hard time finding that information

I agree, we should recommend not to use administrative privileges!

I can't tell you all the default permissions for OpenStack because there are so many different OpenStack components but in general when an OpenStack user is created it is added to a Keystone "project" and the user has permission to create, list, show, update, and delete OpenStack resources in the context of that project -- Nova VMs, Neutron networks and routers, floating IPs, glance images, cinder volumes, manila shares, and so on.
These are the ordinary permissions that a user gets on PSI without asking for extras. IIRC, the only extra permission needed (that would require a ticket to the PSI admins) was the Swift operator role and that is no longer required either?

Perhaps the best way to capture the normal user default permissions is in terms of the "member" role as explained here [1] and here [2]. An ordinary user with the "member" role rather than "admin" role should be able to install an OCP cluster on OpenStack in the context of their own keystone project. That way there can be hundreds of independent, unrelated OCP clusters belonging to different regular users. OpenStack is a "private cloud" version of Infrastructure As A Service -- more like AWS or GCP than virtualization platforms like RHEV and vSphere where a regular user without additional privileges cannot create VMs or other required resources.

[1] https://docs.openstack.org/keystone/latest/admin/service-api-protection.html
[2] https://wiki.openstack.org/wiki/User_Management

Thanks for all the info, its very helpful. I will restructure this section to steer customers away from using admin users and to define what permissions the member level account will need more clearly.

Well thank you for understanding, and for this work!

yeah! I agree! It is better to explain the priviledge for OpenStack in the OpenStack way, so saying "member" role rather than "all" is way more accurate

luis5tb · 2020-09-25T06:48:52Z

docs/user/openstack/privileges.md

+
+| Resource | Permissions |
+|    ---   |     ---     |
+| Network           | All |


probably all permissions is not what you need here either, for instance, you just need to be able to create a network and a router and then connect them to the external/provider network, but you don't need to permissions to create the external network

Would calling this "Private Network" be more clear?

iamemilio · 2020-10-01T18:53:11Z

@tombarron Does this look better?

iamemilio · 2020-10-01T18:53:32Z

@Fedosin Do we need any permissions that I didn't include here for Manilla?

tombarron

Just a couple nits.

I wonder if there"s a way to say that even though you are enumerating these privileges, a regular user with the default member role in a keystone project will normally have all these privileges (in the context of their project)

tombarron · 2020-10-01T19:14:31Z

docs/user/openstack/privileges.md

+
+## Bring Your Own Networks
+
+Using the [bring your own networks feature](https://github.com/openshift/installer/blob/master/docs/user/openstack/customization.md#custom-subnets) will allow you use already prepared networking infrastructure. This would mean that an installation using this feature will only need permissions to read Private Networks, Subnets, and Routers. The user will still need to be able to create ports on these intrefaces though. 


s/intrefaces/interfaces/

tombarron · 2020-10-01T19:14:57Z

docs/user/openstack/privileges.md

@@ -0,0 +1,49 @@
+# Required Privileges
+
+In order to succesfully deploy an OpenShift cluster on OpenStack, the user passed to the installer will need a particular set of permissions in a given project. This document will guide you through what permissions the installer's user need based on the type of install it runs.


the installer's user needs

iamemilio · 2020-10-02T18:26:34Z

ACK, I will make those changes and follow up. Thanks!

iamemilio · 2020-10-05T19:41:11Z

@tombarron LMK what you think

tombarron

Thanks, Emilio. LGTM but I've noted one spelling nit if you want to fix it.

tombarron · 2020-10-05T22:55:52Z

docs/user/openstack/privileges.md

@@ -0,0 +1,49 @@
+# Required Privileges
+
+In order to succesfully deploy an OpenShift cluster on OpenStack, the user passed to the installer needs a particular set of permissions in a given project. We believe that the average user with a member role in a project will already have most, if not all, of the privelages enumerated here. However, due to how much variance there is in how OpenStack clusters are deployed and managed, we designed this document as a guide for the basic permissions needed for an install based on your use case.


s/privilages/privileges/

luis5tb · 2020-10-06T06:34:27Z

docs/user/openstack/privileges.md

+
+## Default Install Privileges
+
+To install a basic, externally routable, IPI OpenShift cluster using only whats offered in the installer prompts, your user needs this minimum subset of permissions.


I still think the below priviledges are wrong, you don't need all the permissions for ports, router, subnets,... just the "default" ones in most of the cases. You for instance don't need permissions to modify/delete ports in you subnet whose device onwer is router_interface or things like that. So the next information is misleading

iamemilio · 2020-10-06T13:52:22Z

/hold

Going to pivot to using the tripleo default member user template for more accurate representation of permissions.

iamemilio · 2020-10-07T13:49:34Z

/hold cancel

talked to some open stack folks, and they didn't think it was reasonable to enumerate the permissions, and advocated for just recommending creating a user with the member role.

tombarron

I like that this makes a key advantage of running on OSP evident: a regular user can provision the infra needed for the installer, vs VMWare or RHEV etc. where you need to be a power user.

openshift-ci-robot · 2020-10-07T16:49:24Z

@iamemilio: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-metal-ipi	`279e5fe`	link	`/test e2e-metal-ipi`
ci/prow/e2e-aws-workers-rhel7	`279e5fe`	link	`/test e2e-aws-workers-rhel7`
ci/prow/e2e-crc	`279e5fe`	link	`/test e2e-crc`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Fedosin · 2020-10-08T14:25:55Z

docs/user/openstack/README.md

@@ -71,6 +72,8 @@ You may need to increase the security group related quotas from their default va
 openstack quota set --secgroups 8 --secgroup-rules 100 <project>`
 ```

+Once you configure the quota for your tenant, please ensure that the user for the installer has the proper [privileges](privileges.md).


"for your project" for consistency.

Fedosin · 2020-10-08T14:27:08Z

docs/user/openstack/privileges.md

+
+## Bring Your Own Networks
+
+Using the [bring your own networks feature](https://github.com/openshift/installer/blob/master/docs/user/openstack/customization.md#custom-subnets) will allow you use already prepared networking infrastructure. As long as you are not using Kuryr, using this feature enables the user to not need permission to create/delete networks, subnets, routers, and router interfaces. However it will still need to be able to read them, tag them, and create/read/modify/delete ports on a given network and subnet. Note that if you are using Kuryr, you will still need the full set of permissions of the *member* role.


"will allow you to use already"

Fedosin · 2020-10-08T14:29:19Z

docs/user/openstack/privileges.md

+
+## Bring Your Own Networks
+
+Using the [bring your own networks feature](https://github.com/openshift/installer/blob/master/docs/user/openstack/customization.md#custom-subnets) will allow you use already prepared networking infrastructure. As long as you are not using Kuryr, using this feature enables the user to not need permission to create/delete networks, subnets, routers, and router interfaces. However it will still need to be able to read them, tag them, and create/read/modify/delete ports on a given network and subnet. Note that if you are using Kuryr, you will still need the full set of permissions of the *member* role.


However, it will still

Fedosin · 2020-10-08T14:40:49Z

/hold
/lgtm
/approve

openshift-ci-robot · 2020-10-08T14:41:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Fedosin, tombarron

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~docs/user/openstack/OWNERS~~ [Fedosin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

iamemilio · 2020-10-08T14:50:14Z

/hold cancel

Passed codegen, doc changes should not need to pass e2e tests

openshift-ci-robot requested review from Fedosin and pierreprinetti September 24, 2020 19:33

Fedosin suggested changes Sep 24, 2020

View reviewed changes

tombarron reviewed Sep 24, 2020

View reviewed changes

luis5tb reviewed Sep 25, 2020

View reviewed changes

iamemilio force-pushed the permissions_docs_openstack branch from 877b2a6 to 7d159bc Compare September 25, 2020 20:21

tombarron approved these changes Oct 1, 2020

View reviewed changes

iamemilio force-pushed the permissions_docs_openstack branch from 7d159bc to 10227ea Compare October 5, 2020 19:37

tombarron approved these changes Oct 5, 2020

View reviewed changes

iamemilio force-pushed the permissions_docs_openstack branch from 10227ea to c00a964 Compare October 5, 2020 23:06

luis5tb reviewed Oct 6, 2020

View reviewed changes

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 6, 2020

iamemilio force-pushed the permissions_docs_openstack branch from c00a964 to fa06c6e Compare October 7, 2020 13:48

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 7, 2020

iamemilio force-pushed the permissions_docs_openstack branch 3 times, most recently from 87d6cf7 to 279e5fe Compare October 7, 2020 14:11

tombarron approved these changes Oct 7, 2020

View reviewed changes

Fedosin suggested changes Oct 8, 2020

View reviewed changes

openstack privileges documented

ce23427

iamemilio force-pushed the permissions_docs_openstack branch from 279e5fe to ce23427 Compare October 8, 2020 14:38

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 8, 2020

openshift-ci-robot assigned Fedosin Oct 8, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 8, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 8, 2020

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 8, 2020

openshift-merge-robot merged commit e30be37 into openshift:master Oct 8, 2020

		@@ -0,0 +1,51 @@
		# Required Privileges

		In order to install an OpenShift cluster on OpenStack successfully, the user provided to the installer needs certian privileges. The easiest way to achieve this level of permission and ensure success is to install with a user who has administrative privileges.


		## Bring Your Own Networks

		Using the [bring your own networks feature](https://github.com/openshift/installer/blob/master/docs/user/openstack/customization.md#custom-subnets) will allow you use already prepared networking infrastrucutre. This would mean that an installation using this feature for all nodes will no longer require any permissions for Networks, Subnets, and Routers.


		## Floating IP Free Installs

		By leaving the `externalNetwork`, `ingressFloatingIP`, and `appsFloatingIP` fields empty, you can run the installer without creating, deleting, or modifiying any floating IPs. Running the installer this way does not require you to have any Floating IP Privileges.

		@@ -0,0 +1,49 @@
		# Required Privileges

		In order to succesfully deploy an OpenShift cluster on OpenStack, the user passed to the installer will need a particular set of permissions in a given project. This document will guide you through what permissions the installer's user need based on the type of install it runs.


		## Default Install Privileges

		To install a basic, externally routable, IPI OpenShift cluster using only whats offered in the installer prompts, your user needs this minimum subset of permissions.

openstack privileges documented #4214

openstack privileges documented #4214

Conversation

iamemilio commented Sep 24, 2020

Choose a reason for hiding this comment

EmilienM Oct 7, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

luis5tb Sep 25, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iamemilio commented Oct 1, 2020

iamemilio commented Oct 1, 2020

tombarron left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iamemilio commented Oct 2, 2020

iamemilio commented Oct 5, 2020

tombarron left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iamemilio commented Oct 6, 2020

iamemilio commented Oct 7, 2020

tombarron left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Oct 7, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Fedosin commented Oct 8, 2020

openshift-ci-robot commented Oct 8, 2020

iamemilio commented Oct 8, 2020

EmilienM Oct 7, 2020 •

edited

luis5tb Sep 25, 2020 •

edited