1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
require 'fog/openstack'
require 'pp'
#
# Creates a private network and shares it with another project via RBAC policy
#
# Needs to be in an environment where keystone v3 is available
#
# You will need to source OpenStack credentials since the script
# reads the following envionment variables:
#
# OS_AUTH_URL
# OS_PASSWORD
# OS_USERNAME
# OS_USER_DOMAIN_NAME
# OS_PROJECT_NAME
# OS_REGION_NAME
#
# optionally disable SSL verification
# SSL_VERIFY=false
auth_options = {
:openstack_auth_url => "#{ENV['OS_AUTH_URL']}/auth/tokens",
:openstack_api_key => ENV['OS_PASSWORD'],
:openstack_username => ENV['OS_USERNAME'],
:openstack_domain_name => ENV['OS_USER_DOMAIN_NAME'],
:openstack_project_name => ENV['OS_PROJECT_NAME'],
:openstack_region => ENV['OS_REGION_NAME'],
:connection_options => {:ssl_verify_peer => ENV['SSL_VERIFY'] != 'false'}
}
identity_service = Fog::OpenStack::Identity::V3.new(auth_options)
network_service = Fog::OpenStack::Network.new(auth_options)
own_project = identity_service.projects.select { |p| p.name == ENV['OS_PROJECT_NAME'] }.first
other_project = identity_service.projects.select { |p| p.name != ENV['OS_PROJECT_NAME'] }.first
puts "Create network in #{own_project.name}"
foonet = network_service.networks.create(:name => 'foo-net23', :tenant_id => own_project.id)
puts "Share network with #{other_project.name}"
rbac = network_service.rbac_policies.create(
:object_type => 'network',
:object_id => foonet.id,
:tenant_id => own_project.id,
:target_tenant => other_project.id,
:action => 'access_as_shared'
)
puts "Get RBAC policy"
rbac = network_service.rbac_policies.find_by_id(rbac.id)
pp rbac
puts "Change share to own project"
rbac.target_tenant = own_project.id
rbac.save
puts "Get network and see that it is now shared"
foonet = network_service.networks.get(foonet.id)
pp foonet
puts "Remove the share via RBAC"
rbac.destroy
puts "Get network and see that it is no longer shared"
foonet.reload
pp foonet
foonet.destroy
|
