Bug 1374379

Summary:	explicit required permissions for OSP cloud provider's amqp user
Product:	Red Hat CloudForms Management Engine	Reporter:	Colin Arnott <carnott>
Component:	Documentation	Assignee:	Red Hat CloudForms Documentation <cloudforms-docs>
Status:	CLOSED WONTFIX	QA Contact:	Red Hat CloudForms Documentation <cloudforms-docs>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	5.6.0	CC:	adahms, benglish, fsimonce, hhudgeon, jhardy, mfeifer, obarenbo, tzumainn
Target Milestone:	GA
Target Release:	5.7.0
Hardware:	x86_64
OS:	Linux
Whiteboard:	doc
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-04 04:40:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Colin Arnott 2016-09-08 14:08:20 UTC

Document URL:
https://access.redhat.com/documentation/en/red-hat-cloudforms/4.1/managing-providers/#adding_openstack_providers

Section Number and Name: 
3.1.1.8 Adding OpenStack Providers: events

Describe the issue: 
The OSP cloud provider supports amqp, but currently requires privileged access, my security standards prevent me from giving cart blanch access to my OSP overcloud environment. Can you please enumerate the permissions required by CFME so that I can use least privilege when creating the amqp user for CFME in my OSP overcloud environment.

Suggestions for improvement: 
Add a section indicating required roles for the ceilometer user in the OSP provider.

Additional information:

Comment 2 Tzu-Mainn Chen 2016-09-20 15:46:31 UTC

Hi!  Are we talking about AMQP access or ceilometer access?  The latter should be 'automatic' if you follow the setup steps.  The former... well, we added ceilometer support because the OSP folks explicitly told us not to depend upon AMQP for OSP8 and above.  They don't have any supported configuration which allows CloudForms to use AMQP and get the information it needs.

Comment 4 Andrew Dahms 2018-04-04 04:40:40 UTC

Thank you for raising this bug.

After further discussion with the program team, we have been given the advice not to document specific permissions for service accounts at this time based on the following article -

http://cloudformsblog.redhat.com/2017/08/16/security-management-operations/

As such, I will be closing this bug for now, but we can re-investigate this request again in the future if required.