8.4. 为外部网络授予 RBAC 策略访问权限

流程

1. 从您的工作站访问 OpenStackClient pod 的远程 shell：

   $ oc rsh -n openstack openstackclient

2. 使用- action access_as_external 选项创建一个新的 RBAC 策略：

   $ openstack network rbac create --type network --target-project c717f263785d4679b16a122516247deb --action access_as_external web-servers

   输出示例

   创建新的 rbac_policy：

   +----------------+--------------------------------------+
   | Field          | Value                                |
   +----------------+--------------------------------------+
   | action         | access_as_external                   |
   | id             | ddef112a-c092-4ac1-8914-c714a3d3ba08 |
   | object_id      | 6e437ff0-d20f-4483-b627-c3749399bdca |
   | object_type    | network                              |
   | target_project | c717f263785d4679b16a122516247deb     |
   | project_id     | c717f263785d4679b16a122516247deb     |
   +----------------+--------------------------------------+

   因此，engineering 项目中的用户可以查看网络或连接实例：

   $ openstack network list

   +--------------------------------------+-------------+------------------------------------------------------+
   | id                                   | name        | subnets                                              |
   +--------------------------------------+-------------+------------------------------------------------------+
   | 6e437ff0-d20f-4483-b627-c3749399bdca | web-servers | fa273245-1eff-4830-b40c-57eaeac9b904 192.168.10.0/24 |
   +--------------------------------------+-------------+------------------------------------------------------+

3. 退出 openstackclient pod:

   $ exit