Red Hat OpenStack Administration I: Core Operations for Domain Operators
In this chapter, you learned:
Domains allow an external identity store to be integrated with OpenStack, while keeping the users and groups it contains separate from any other identity source.
Projects restrict access to a set of resources, such as volumes, networks, and instances. They are commonly used to group resources for a specific application. Projects can be nested to create a hierarchy, allowing roles to be assigned at the top level and inherited by child projects.
Three default user roles are provided with OpenStack; admin, member, and reader. The reader role is new, and implemented by many but not all OpenStack components The reader role is used for application credentials.
There are three authorization scopes that you will use when assigning roles to users. The system scope applies to the OpenStack platform itself. The domain scope applies at the domain level, allowing the creation of projects within a domain. The project scope is used to allow permissions and resource access at the project level.
Quotas allow administrators to restrict the quantity of resources a project may consume. They do not currently operate in a hierarchical method, so administrators must manage quotas for hierarchical projects independently.
