Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1325673

Summary:	[RFE] [Neutron] Role-based Access Control (RBAC) support for QoS policies
Product:	Red Hat OpenStack	Reporter:	Nir Yechiel <nyechiel>
Component:	openstack-neutron	Assignee:	lpeer <lpeer>
Status:	CLOSED ERRATA	QA Contact:	Toni Freger <tfreger>
Severity:	low	Docs Contact:
Priority:	low
Version:	8.0 (Liberty)	CC:	amuller, chrisw, jjoyce, mlopes, nlevinki, nyechiel, oblaut, srevivo
Target Milestone:	ga	Keywords:	FutureFeature, OtherQA, TestOnly, Triaged, ZStream
Target Release:	9.0 (Mitaka)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-neutron-8.1.0-3.el7ost	Doc Type:	Enhancement
Doc Text:	This update adds Role-based Access Control (RBAC) for QoS policies. As a result, you can now apply QoS policies to certain projects. For example, you can now create a QoS policy that allows for lower-priority network traffic, and have it only apply to certain projects.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-24 12:53:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1339880

Description Nir Yechiel 2016-04-10 14:43:14 UTC

Description of problem:

The cloud admin needs to have the ability to share Neutron QoS policies between subsets of tenants instead of the all-or-nothing choice he has now.

For example, there is no way for a cloud admin to define a "platinum" policy (e.g. guaranteed BW, low latency) and making it possible only for certain tenants (the ones who actually paid for it) applying it to their ports/networks.

In a similar context, a cloud administrator may want to apply a pre-created default policy (e.g. rate limit) for newly created networks/VM's .

This feature will add more more flexibility for network management workflows and provide the admin with support for real use cases encountered in enterprise/private-cloud deployments.

Comment 2 Nir Yechiel 2016-04-10 14:49:38 UTC

Code was merged in upstream Mitaka-3. See https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/rbac-qos-policies.html

    This patch implements a new database model required for the
    qos-policy RBAC support. In addition it migrates the current qos-policy
    'shared' attribute to leverage the new 'qospolicyrbacs' table.

    'shared' is no longer a property of the QosPolicy DB model. Its status
    is based on the tenant ID of the API caller. From an API perspective the
    logic remains the same - tenants will see qos-policies as 'shared=True'
    in case the qos-policy is shared with them). However, internal callers
    (e.g. plugins, drivers, services) must not check for the 'shared'
    attribute on qos-policy db objects any more.

Comment 4 Assaf Muller 2016-06-04 20:39:31 UTC

@Martin, can you please fill in doctext? Thank you.

Comment 5 Martin Lopes 2016-06-14 04:25:52 UTC

Added doctext.

Comment 12 errata-xmlrpc 2016-08-24 12:53:26 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-1761.html