CCCNA17 Dynamic Roles in CloudStack
0 likes•81 views
The document discusses the transition from static to dynamic roles in CloudStack, enabling easier management and customization of user permissions in cloud environments. It details the limitations of static role-based access control and outlines the benefits of a dynamic role-based access control system, including a database migration and a new user interface. The dynamic system allows for custom roles and rules without requiring a management restart, enhancing operational efficiency.
![C l i c k t o e d i t
The Cloud Specialists
ShapeBlue.com @ShapeBlue
Upgrade: Running the migration tool
[root@host]# python migrate-dynamicroles.py -u cloud -p cloud -h
localhost -p 3306 -f /etc/cloudstack/management/commands.properties
Apache CloudStack Role Permission Migration Tool
(c) Apache CloudStack Authors and the ASF, under the Apache License, Version
2.0
Running this migration tool will remove any default-role permissions from
cloud.role_permissions. Do you want to continue? [y/N]y
The commands.properties file has been deprecated and moved at:
/etc/cloudstack/management/commands.properties.deprecated
Static role permissions from commands.properties have been migrated into the
db
Dynamic role based API checker has been enabled!](https://image.slidesharecdn.com/cccna17csdynamicrolesincloudstack-170517134247/85/CCCNA17-Dynamic-Roles-in-CloudStack-26-320.jpg)
CCCNA17 Dynamic Roles in CloudStack
- 2. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue About Me • Break Stuff @ ShapeBlue • Background: • More than 10 years in Software Development and Testing • Specialize in: • Test Management • Automated Testing • Testing Frameworks • Joined ShapeBlue and CloudStack last year
- 3. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue “ShapeBlue are expert builders of public & private clouds. They are the leading global CloudStack services company.” About ShapeBlue
- 4. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue ShapeBlue customers
- 5. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue ShapeBlue customers
- 6. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue ShapeBlue customers
- 7. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Dynamic Roles in CloudStack
- 8. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Static Roles in CloudStack • List of pre-defined roles • All roles permissions are kept in a single file commands.properties • Each change requires a management server restart • How do we add a custom role with new set of permissions
- 9. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Dynamic Roles Quiz Time
- 10. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Hint: it’s related to permissions Q1: What are these numbers and what’s their purpose: 1, 2, 4, 8 Answer: These numbers represent the static roles 1 = ADMIN 2 = RESOURCE_DOMAIN_ADMIN 4 = DOMAIN_ADMIN 8 = USER
- 11. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue commands.properties
- 12. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Hint: related to permissions Q2: What are the 7s and 15s? Answer: all users until that number can execute the command
- 13. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Q3: What does this number represent: 790 Answer: That’s about the number of lines commands.properties has in 4.9. Hint: related to the permissions file
- 14. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Static Role-based Access Control • Pre-defined roles • All permissions kept in a commands.properties file • Changes are difficult to maintain • Management server restart is required after change • Hard to add a new role with custom permissions
- 15. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Add Read-only Admin • Root Admin • Read-only permission
- 16. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Let’s re-thing roles management • New way of managing roles • Add/Change roles made easy • Apply changes without management restart
- 17. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Here’s what we did • Move all permissions to the DB • Create a dynamic role based account checker (RBAC) • New UI interface • Handle migrations
- 18. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Dynamic ApiChecker
- 19. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue How to use it: Adding role Use case: Root Admin wants to create a root admin read-only account, who is not allowed to see Global Settings. • Create a custom role • Add an “allow rule” to all list APIs • Assign the role to the read-only account • Add ”deny rule” to all configuration APIs
- 20. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue How to use it: Adding role
- 21. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue How to use it: Good practices • When adding custom rules, user is allowed to select multiple APIs using “*” • It’s a good practice to move deny rules on top of the list when allowing multiple APIs at once. • Rules can be shifted in the list in set the order of the list
- 22. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue How to use it: Denied API • What happens in UI when user hits a denied API? • User is displayed with the following error
- 23. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Dynamic Role-based Access Control • Pre-defined roles are available • Moves all permissions into the DB • Adds UI interface to add a new role • Custom set of rules per API for a role • Does not require management restart
- 24. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Live demo • One must read slide title first
- 25. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Availability and Upgrade • Dynamic RBAC is available and enabled by default on all new installations post 4.9 • Users upgrading to >4.9.x will have the feature disabled post upgrade • Migration tool is available to do the migration and enable Dynamic RBAC
- 26. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Upgrade: Running the migration tool [root@host]# python migrate-dynamicroles.py -u cloud -p cloud -h localhost -p 3306 -f /etc/cloudstack/management/commands.properties Apache CloudStack Role Permission Migration Tool (c) Apache CloudStack Authors and the ASF, under the Apache License, Version 2.0 Running this migration tool will remove any default-role permissions from cloud.role_permissions. Do you want to continue? [y/N]y The commands.properties file has been deprecated and moved at: /etc/cloudstack/management/commands.properties.deprecated Static role permissions from commands.properties have been migrated into the db Dynamic role based API checker has been enabled!
- 27. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Migrating Roles • After enabling Dynamic RBAC root admin role permissions looks like this:
- 28. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Migrating Roles • While other roles have explicit rules created based on the settings in commands.properties file.
- 29. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue Questions?
- 30. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue By the way…. Next CloudStack event: Cloudstack Collaboration Conference at ApacheCon North America May 16-18, 2017 InterContinental Miami MIAMI, FLORIDA United States http://events.linuxfoundation.org/events/apachecon-north- america/attend/register-
- 31. C l i c k t o e d i t The Cloud Specialists ShapeBlue.com @ShapeBlue More information • Slide deck: http://www.slideshare.net/shapeblue • Blog: http://shapeblue.com/blog • Email: [email protected] • Web: http://shapeblue.com