Description of problem:
Ironic is not multi-tenant out of the box. If you use Ironic to manage 100% of infrastructure that instance of Ironic would see all hardware with root privileges. If you expose that to the overcloud at root level, the fear is that tenants may have exposure to hardware. Additionally, the scheduler within an overcloud may not know which machines are for tenant usage only. We need to support one instance of Ironic within the undercloud for OSP component host deployment AND then a separate instance or Ironic that is exposed to Nova and services within the overcloud.
The problem can be summed up as follows:
- No traffic isolation
- Compute instances would have access to the provisioning plane
- All nodes are in a single L2 domain
- No tenant isolation
The actual feature has landed upstream in Newton, so it will be usable with some level of manual configuration. I'm not sure we'll have documentation and potential TripleO bits in time though.
Support for neutron networking plugin and provisioning networks landed in https://review.openstack.org/#/c/452837/. Now we're ready to test this feature. A suitable ML2 plugin (not covered by this RFE) is required to actually use this feature.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2018:2086