Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 14. Configure RBAC

Role-based Access Control (RBAC) policies in OpenStack Networking allows granular control over shared neutron networks. Previously, networks were shared either with all tenants, or not at all. OpenStack Networking now uses a RBAC table to control sharing of neutron networks between tenants, allowing an administrator to control which tenants are granted permission to attach instances to a network.
As a result, cloud administrators can remove the ability for some tenants to create networks, and can instead allow them to attach to pre-existing networks that correspond to their project.

14.1. Create a new RBAC policy
링크 복사

This example procedure demonstrates how to use a RBAC policy to grant a tenant access to a shared network.

  1. View the list of available networks: 

    # neutron net-list
+--------------------------------------+-------------+------------------------------------------------------+
| id                                   | name        | subnets                                              |
+--------------------------------------+-------------+------------------------------------------------------+
| 7a7974fe-3b34-4538-b413-d22b985f26e1 | public      | 7de0811f-86ed-4e1b-bc3c-fd2459d0db9d                 |
| 6e437ff0-d20f-4483-b627-c3749399bdca | web-servers | fa273245-1eff-4830-b40c-57eaeac9b904 192.168.10.0/24 |
| 1a744cc9-c2b2-4cfc-b06d-a10af5dc8334 | private     | 5196d774-6bd2-4f5d-9c24-a4d1c8987f10 10.0.0.0/24     |
+--------------------------------------+-------------+------------------------------------------------------+
    Copy to Clipboard Toggle word wrap

  2. View the list of tenants: 

    # keystone tenant-list
+----------------------------------+-------------+---------+
|                id                |     name    | enabled |
+----------------------------------+-------------+---------+
| 4be7697a4258449a9677adb0fbb71e21 |    admin    |   True  |
| 09ac16ac50634b08a689c1526a34bb82 |     demo    |   True  |
| c717f263785d4679b16a122516247deb | engineering |   True  |
| e8549caaf5bf4bd9b5618622e7c21c97 |   services  |   True  |
+----------------------------------+-------------+---------+
    Copy to Clipboard Toggle word wrap

  3. Create a RBAC for the web-servers network that grants access to the engineering tenant (c717f263785d4679b16a122516247deb): 

    # neutron rbac-create 6e437ff0-d20f-4483-b627-c3749399bdca --type network --target-tenant c717f263785d4679b16a122516247deb --action access_as_shared
Created a new rbac_policy:
+---------------+--------------------------------------+
| Field         | Value                                |
+---------------+--------------------------------------+
| action        | access_as_shared                     |
| id            | 425cdd5c-c080-4045-a896-31d446551de7 |
| object_id     | 6e437ff0-d20f-4483-b627-c3749399bdca |
| object_type   | network                              |
| target_tenant | c717f263785d4679b16a122516247deb     |
| tenant_id     | 4be7697a4258449a9677adb0fbb71e21     |
+---------------+--------------------------------------+
    Copy to Clipboard Toggle word wrap

As a result, users in the Engineering tenant are able to connect instances to the web-servers network.

14.2. Review your configured RBAC policies
링크 복사

  1. Use the rbac-list option to retrieve the ID of your existing RBAC policies: 

    # neutron rbac-list
+--------------------------------------+--------------------------------------+
| id                                   | object_id                            |
+--------------------------------------+--------------------------------------+
| 425cdd5c-c080-4045-a896-31d446551de7 | 6e437ff0-d20f-4483-b627-c3749399bdca |
+--------------------------------------+--------------------------------------+
    Copy to Clipboard Toggle word wrap

  2. Use rbac-show to view the details of the specific RBAC entry: 

    # neutron rbac-show 425cdd5c-c080-4045-a896-31d446551de7
+---------------+--------------------------------------+
| Field         | Value                                |
+---------------+--------------------------------------+
| action        | access_as_shared                     |
| id            | 425cdd5c-c080-4045-a896-31d446551de7 |
| object_id     | 6e437ff0-d20f-4483-b627-c3749399bdca |
| object_type   | network                              |
| target_tenant | c717f263785d4679b16a122516247deb     |
| tenant_id     | 4be7697a4258449a9677adb0fbb71e21     |
+---------------+--------------------------------------+
    Copy to Clipboard Toggle word wrap

14.3. Delete a RBAC policy
링크 복사

  1. Use the rbac-list option to retrieve the ID of your existing RBACs: 

    # neutron rbac-list
+--------------------------------------+--------------------------------------+
| id                                   | object_id                            |
+--------------------------------------+--------------------------------------+
| 425cdd5c-c080-4045-a896-31d446551de7 | 6e437ff0-d20f-4483-b627-c3749399bdca |
+--------------------------------------+--------------------------------------+
    Copy to Clipboard Toggle word wrap

  2. Use rbac-delete to delete the RBAC, based on it’s ID value: 

    # neutron rbac-delete 425cdd5c-c080-4045-a896-31d446551de7
Deleted rbac_policy: 425cdd5c-c080-4045-a896-31d446551de7
    Copy to Clipboard Toggle word wrap
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat