Hierarchical Projects

Registered by Thiago Paiva Brito


As of Kilo-1 release, keystone introduced a hierarchical structure of projects.
Aiming to improve user experience on this new organization, it is proposed to
support it on horizon, the OpenStack dashboard.


Real-world organizational structures tend to be hierarchical. As an example,
suppose an organization that have tens of departments hierarchically organized,
in which each sub department is a part of the parent department.

The best representation of this departmental hierarchy is in the form of a
tree, as they originally are structured, and not in a flat representation.

Aiming to enable such representation on OpenStack, the concept of hierarchical
projects was introduced by keystone, the OpenStack Identity service.

In order to improve user experience on hierarchical projects, it is proposed to
add support for such concept on horizon, the OpenStack dashboard.


The following features will be added on horizon:

a) Addition of Parent Project

Addition of parent project information when creating a project, allowing users
to build their project hierarchy. In addition, this information will be shown
when listing projects in admin mode.

b) Show Project Hierarchy

Show project hierarchy on projects panel, enabling users to view the existing
project hierarchy.

c) Use Project in Hierarchy

List project hierarchy on project selector dropdown, making it possible for
users to select the project in the hierarchy they want to use.


Wireframes, Mocks, Videos and UI Markup

For the features that need to represent projects structure, it is proposed to
represent them as horizon currently does, but inserting the parent names for
each project, separated by a slash. See [1] as an example for feature c) Use
Project in Hierarchy.

a. Addition of Parent Project

Addition of a drop-down list on Create Project screen [2]. This list will
contain all the projects the user has access to, organized hierarchicaly.

When editing the project, the parent cannot be updated [3], since it is a
constraint adopted by keystone because it would be complex to edit the
hierarchy due to token revocations and quota checkings.

b. Show Project Hierarchy

The projects will be organized in an expandable tree view, honoring the project
hierarchy, according to the projects the user has access to, as shown in [4].

c. Use Project in Hierarchy

The select project drop-down list will be similar to the one proposed to be
added on the Create Project screen for selecting the parent project.


There is no non-obvious effect that needs to be considered in tests.

Outside Dependencies

The proposed features involve retrieval of the project hierarchy in which the
user has access to, the needed support on keystone service is already merged
and will be stable for Kilo release.

In addition, it will be required the following ongoing patch on

“Implements subtree_as_ids and parents_as_ids” [6], which enable the query of
projects IDs up and down the hierarchy as a structured dictionary.

In order to retrieve the project hierarchy, horizon will use the known
authorized projects for that user and the above operation, which provides the
full hierarchy structure in the form of ids.

Requirements Update Required

Update python-keystoneclient requirement version.

Doc Impact

Horizon documentation will be updated in order to expose to the user the new
features that will be introduced.


[1] https://openstack.invisionapp.com/share/NT1KVIH4S#/screens/45149147
[2] http://invis.io/TE25TPE74
[3] http://invis.io/2H25TPQT6
[4] http://invis.io/KF25TOIZD
[5] https://openstack.invisionapp.com/share/NT1KVIH4S#/screens/44948197
[6] https://review.openstack.org/#/c/150078

Blueprint information

Thiago Paiva Brito
Needs approval
Thiago Paiva Brito
Series goal:
Milestone target:
Started by
David Lyle
Completed by
Rob Cresswell

Related branches



Gerrit topic: https://review.openstack.org/#q,topic:bp/hierarchical-projects,n,z

Addressed by: https://review.openstack.org/119385
    Hierarchy of Projects on Horizon's Interface

Addressed by: https://review.openstack.org/119469
    Create Project with Parent

[amotoki - Oct 3, 2014] This blueprint depends on keystone. Could you share the blueprint link of keystone so that Horizon team can track the progress in keystone? Hopefully it is nice if you set blueprint dependency.

Addressed by: https://review.openstack.org/166956
    User Primary Project Choices as Hierarchical Names

[kenji-ishii - Feb 1, 2016] related blueprint in keystone
    blueprint: https://blueprints.launchpad.net/keystone/+spec/hierarchical-multitenancy
    review : https://review.openstack.org/#/q/status:Merged+topic:bp/hierarchical-multitenancy

    blueprint : https://blueprints.launchpad.net/keystone/+spec/hierarchical-multitenancy-improvements
    review : https://review.openstack.org/#/q/topic:bp/hierarchical-multitenancy-improvements

Gerrit topic: https://review.openstack.org/#q,topic:bp/hierarchical-project,n,z

[robcresswell] Discussion in the Horizon Drivers meeting on 2016-05-04 indicated quota issues; have these been resolved?

[kenji-ishii - May 13, 2016]
As the discussion(*) said, about quota, components have a bp(see below), but progress is not good very well. On the other hand, only Cinder has implemented Nested Quota.
(*) http://eavesdrop.openstack.org/meetings/horizondrivers/2016/horizondrivers.2016-05-04-20.01.log.txt


I have a question. In IRC log, existing quota was said it's flawed, what problem do they have?
The problem is just that other components are not still addressed about nested quota?
If so, I'm sorry that I don't still understand why quota has to be addressed first to realize hierarchical project.

In my opinion, if we implement only hierarchical project, user management will be improved especially for enterprise. Nested quota is needed, I agree with it. but as a first step, to add a feature to create hierarchical project is not bad.
So, at the moment in my patch, Adding only the feature to create hierarchical project and see the parent project by adding a column in project list (As the discussion said, considering GUI is premature). What do you think? Thank you for discussion in meeting.

(add Jun. 27. 2016)
Or as a another opinion, we start the cinder's nested quota in Horizon. Cinder already implement it. So as a reference for nested quota, we can start working.

[robcresswell 2016-07-01] So from the discussion in IRC it seems that hierarchical projects is intertwined with quota support for the hierarchy; and therefore quotas would need to be improved and fixed within Horizon before we could implement hierarchical projects. This would probably be best discussed in the weekly meeting, with a wider audience.

[robcresswell 2017-02-21]
Moved to wishlist https://blueprints.launchpad.net/horizon/+spec/wishlist


Work Items

Dependency tree

* Blueprints in grey have been implemented.

This blueprint contains Public information 
Everyone can see this information.