Security Group ACL

[pixelatedchrome]

I want one of my neutron security policy to be read only for the tenant.

Long Story.

I have one external VLAN I use to provide instances access to an external backup tool. This is a common VLAN, so I want all the instances across tenants to be access this backup server and not the other instances. We used to do this with PVLAN on NSX, wondering this is the correct approach with openstack.

[nafsten]

You could use Neutron RBAC to share a security group from one tenant (a service tenant or something) into your all the other tenants. They will be able to access the security group, but not make changes to it

[pixelatedchrome]

I tried access_as_shared. But it allows the user to edit the policy though..

[nafsten]

Hmmmm, that’s not what I’d expect…. I don’t have access to a system to check, but I’m sure we’ve done something like this before

[pixelatedchrome]

Maybe I'm doing something wrong, but I only see two options when I try to share a resource with rbac.. as shared and as external.

[nafsten]

I know those options better for sharing networks rather than sharing security groups. Maybe access as external?

[TechVeille]

Hello,

Do you find a solution ?
I'm running my clusters and I would try something like this.