OpenStack

Pulumi Official
Package maintained by Pulumi
v3.9.0 published on Thursday, Aug 4, 2022 by Pulumi

RbacPolicyV2

The RBAC policy resource contains functionality for working with Neutron RBAC Policies. Role-Based Access Control (RBAC) policy framework enables both operators and users to grant access to resources for specific projects.

Sharing an object with a specific project is accomplished by creating a policy entry that permits the target project the access_as_shared action on that object.

To make a network available as an external network for specific projects rather than all projects, use the access_as_external action. If a network is marked as external during creation, it now implicitly creates a wildcard RBAC policy granting everyone access to preserve previous behavior before this feature was added.

Example Usage

using Pulumi;
using OpenStack = Pulumi.OpenStack;

class MyStack : Stack
{
    public MyStack()
    {
        var network1 = new OpenStack.Networking.Network("network1", new OpenStack.Networking.NetworkArgs
        {
            AdminStateUp = true,
        });
        var rbacPolicy1 = new OpenStack.Networking.RbacPolicyV2("rbacPolicy1", new OpenStack.Networking.RbacPolicyV2Args
        {
            Action = "access_as_shared",
            ObjectId = network1.Id,
            ObjectType = "network",
            TargetTenant = "20415a973c9e45d3917f078950644697",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-openstack/sdk/v3/go/openstack/networking"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		network1, err := networking.NewNetwork(ctx, "network1", &networking.NetworkArgs{
			AdminStateUp: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = networking.NewRbacPolicyV2(ctx, "rbacPolicy1", &networking.RbacPolicyV2Args{
			Action:       pulumi.String("access_as_shared"),
			ObjectId:     network1.ID(),
			ObjectType:   pulumi.String("network"),
			TargetTenant: pulumi.String("20415a973c9e45d3917f078950644697"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.openstack.networking.Network;
import com.pulumi.openstack.networking.NetworkArgs;
import com.pulumi.openstack.networking.RbacPolicyV2;
import com.pulumi.openstack.networking.RbacPolicyV2Args;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var network1 = new Network("network1", NetworkArgs.builder()        
            .adminStateUp("true")
            .build());

        var rbacPolicy1 = new RbacPolicyV2("rbacPolicy1", RbacPolicyV2Args.builder()        
            .action("access_as_shared")
            .objectId(network1.id())
            .objectType("network")
            .targetTenant("20415a973c9e45d3917f078950644697")
            .build());

    }
}
import pulumi
import pulumi_openstack as openstack

network1 = openstack.networking.Network("network1", admin_state_up=True)
rbac_policy1 = openstack.networking.RbacPolicyV2("rbacPolicy1",
    action="access_as_shared",
    object_id=network1.id,
    object_type="network",
    target_tenant="20415a973c9e45d3917f078950644697")
import * as pulumi from "@pulumi/pulumi";
import * as openstack from "@pulumi/openstack";

const network1 = new openstack.networking.Network("network_1", {
    adminStateUp: true,
});
const rbacPolicy1 = new openstack.networking.RbacPolicyV2("rbac_policy_1", {
    action: "access_as_shared",
    objectId: network1.id,
    objectType: "network",
    targetTenant: "20415a973c9e45d3917f078950644697",
});
resources:
  network1:
    type: openstack:networking:Network
    properties:
      adminStateUp: true
  rbacPolicy1:
    type: openstack:networking:RbacPolicyV2
    properties:
      action: access_as_shared
      objectId: ${network1.id}
      objectType: network
      targetTenant: 20415a973c9e45d3917f078950644697

Create a RbacPolicyV2 Resource

new RbacPolicyV2(name: string, args: RbacPolicyV2Args, opts?: CustomResourceOptions);
@overload
def RbacPolicyV2(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 action: Optional[str] = None,
                 object_id: Optional[str] = None,
                 object_type: Optional[str] = None,
                 region: Optional[str] = None,
                 target_tenant: Optional[str] = None)
@overload
def RbacPolicyV2(resource_name: str,
                 args: RbacPolicyV2Args,
                 opts: Optional[ResourceOptions] = None)
func NewRbacPolicyV2(ctx *Context, name string, args RbacPolicyV2Args, opts ...ResourceOption) (*RbacPolicyV2, error)
public RbacPolicyV2(string name, RbacPolicyV2Args args, CustomResourceOptions? opts = null)
public RbacPolicyV2(String name, RbacPolicyV2Args args)
public RbacPolicyV2(String name, RbacPolicyV2Args args, CustomResourceOptions options)
type: openstack:networking:RbacPolicyV2
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string
The unique name of the resource.
args RbacPolicyV2Args
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args RbacPolicyV2Args
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args RbacPolicyV2Args
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args RbacPolicyV2Args
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args RbacPolicyV2Args
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

RbacPolicyV2 Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The RbacPolicyV2 resource accepts the following input properties:

Action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

ObjectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

ObjectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

TargetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

Region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

Action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

ObjectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

ObjectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

TargetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

Region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

action String

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId String

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType String

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

targetTenant String

The ID of the tenant to which the RBAC policy will be enforced.

region String

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

targetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

action str

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

object_id str

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

object_type str

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

target_tenant str

The ID of the tenant to which the RBAC policy will be enforced.

region str

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

action String

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId String

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType String

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

targetTenant String

The ID of the tenant to which the RBAC policy will be enforced.

region String

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

Outputs

All input properties are implicitly available as output properties. Additionally, the RbacPolicyV2 resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

ProjectId string
Id string

The provider-assigned unique ID for this managed resource.

ProjectId string
id String

The provider-assigned unique ID for this managed resource.

projectId String
id string

The provider-assigned unique ID for this managed resource.

projectId string
id str

The provider-assigned unique ID for this managed resource.

project_id str
id String

The provider-assigned unique ID for this managed resource.

projectId String

Look up an Existing RbacPolicyV2 Resource

Get an existing RbacPolicyV2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: RbacPolicyV2State, opts?: CustomResourceOptions): RbacPolicyV2
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[str] = None,
        object_id: Optional[str] = None,
        object_type: Optional[str] = None,
        project_id: Optional[str] = None,
        region: Optional[str] = None,
        target_tenant: Optional[str] = None) -> RbacPolicyV2
func GetRbacPolicyV2(ctx *Context, name string, id IDInput, state *RbacPolicyV2State, opts ...ResourceOption) (*RbacPolicyV2, error)
public static RbacPolicyV2 Get(string name, Input<string> id, RbacPolicyV2State? state, CustomResourceOptions? opts = null)
public static RbacPolicyV2 get(String name, Output<String> id, RbacPolicyV2State state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

ObjectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

ObjectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

ProjectId string
Region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

TargetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

Action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

ObjectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

ObjectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

ProjectId string
Region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

TargetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

action String

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId String

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType String

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

projectId String
region String

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

targetTenant String

The ID of the tenant to which the RBAC policy will be enforced.

action string

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId string

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType string

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

projectId string
region string

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

targetTenant string

The ID of the tenant to which the RBAC policy will be enforced.

action str

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

object_id str

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

object_type str

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

project_id str
region str

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

target_tenant str

The ID of the tenant to which the RBAC policy will be enforced.

action String

Action for the RBAC policy. Can either be access_as_external or access_as_shared.

objectId String

The ID of the object_type resource. An object_type of network returns a network ID and an object_type of qos_policy returns a QoS ID.

objectType String

The type of the object that the RBAC policy affects. Can be one of the following: address_scope, address_group, network, qos_policy, security_group or subnetpool.

projectId String
region String

The region in which to obtain the V2 networking client. A networking client is needed to configure a routing entry on a subnet. If omitted, the region argument of the provider is used. Changing this creates a new routing entry.

targetTenant String

The ID of the tenant to which the RBAC policy will be enforced.

Import

RBAC policies can be imported using the id, e.g.

 $ pulumi import openstack:networking/rbacPolicyV2:RbacPolicyV2 rbac_policy_1 eae26a3e-1c33-4cc1-9c31-0cd729c438a1

Package Details

Repository
https://github.com/pulumi/pulumi-openstack
License
Apache-2.0
Notes

This Pulumi package is based on the openstack Terraform Provider.