Lets say you are an administrator of an OpenStack cloud. This means you are pretty much all powerful in the deployment. Now, you need to perform some operation, but you don’t want to give it full admin privileges? Why? well, do you work as root on your Linux box? I hope note. Here’s how to set up a self trust for a reduced set of roles on your token.
“We need a read only role.”
It seems like such a simple requirement. Users have been requesting a read-only role for several years now. Why is it so tough to implement? Because it calls for modifying access control policy across multiple, disjoint services deployed at innumerable distinct locations.
“We need help in modifying policy to implement our own read only role.”
This one is a little bit more attainable. We should be able to provide better tools to help people customize their policy. What should that look like?
We gathered some information at the last summit, and I am going to try and distill it to a requirements document here.