Hierarchical Multitenancy

Registered by Dolph Mathews

This blueprint encompases migration to "hierarchical ownership" as described by https://wiki.openstack.org/wiki/HierarchicalMultitenancy

Implementation Impact:

- In SQL, the project.domain_id column is is renamed to 'parent_project_id'
- Contents of the domain table must be migrated to the project table, and the domain table dropped
- /v3/domains is exposed as SELECT * FROM project WHERE parent_project_id IS NULL;

- Manager methods for projects (list_projects, etc) rewrite all project ID's as "openstack.<self.parent_project_id>.<self.id>"

This is not necessary. However, get_project_by_name should accept the equivalent of basename and full path. If a short name is used, the name should be relative to something reasonable, perhaps the users default project.

- Role assignments to project='openstack' are persisted with a null target (instead of project_id='openstack')

API Impact:

- Everything about domains is deprecated (?)
- GET /v3/projects might return projects with a "children" attribute, containing a list of children (reflecting the entire tree)

Blueprint information

Morgan Fainberg
Dolph Mathews
Raildo Mascena de Sousa Filho
Series goal:
Accepted for kilo
Milestone target:
milestone icon 2015.1.0
Started by
Dolph Mathews
Completed by
Morgan Fainberg

Related branches



This will need a spec: https://github.com/openstack/keystone-specs

Keystone-spec: https://review.openstack.org/#/c/101017 (merged)
Gerrit topic: https://review.openstack.org/#q,topic:bp/hierarchical-multitenancy,n,z

Addressed by: https://review.openstack.org/103850 (abandoned)
    Hierarchical Multitenacy

Addressed by: https://review.openstack.org/108841 (abandoned)
    Hierarchical Projects

Addressed by: https://review.openstack.org/111840 (abandoned)
    Add parent_project_id field

Addressed by: https://review.openstack.org/111841 (abandoned)
    Base methods to handle hierarchical projects

Addressed by: https://review.openstack.org/111842 (abandoned)
    Create, update and delete hierarchical projects

Gerrit topic: https://review.openstack.org/#q,topic:(detached,n,z

Addressed by: https://review.openstack.org/115411(merged)
    Fix rst issues in hierarchical multitenancy

Addressed by: https://review.openstack.org/116921(abandoned)
    Inherited roles to projects

Addressed by: https://review.openstack.org/116682 (abandoned)
    Improve list role assignments filters performance

Addressed by: https://review.openstack.org/117784 (merged)
    Add parent_project_id field

Addressed by: https://review.openstack.org/117785 (merged)
    Base methods to handle hierarchical projects

Addressed by: https://review.openstack.org/117786 (abandoned)
    Create, update and delete hierarchical projects

Addressed by: https://review.openstack.org/117787 (abandoned)
    Inherited roles to projects

Addressed by: https://review.openstack.org/130103 (merged)
    API documentation for Hierarchical Multitenancy

Addressed by: https://review.openstack.org/130277 (merged)
    API documentation for Inherited Roles to Projects

Addressed by: https://review.openstack.org/137370 (abandoned)
    Adds correct checks in LDAP backend tests

Addressed by: https://review.openstack.org/137782
    Fixes HEAD return code for OS-INHERIT extension

Addressed by: https://review.openstack.org/138186 (merged)
    Merge remote-tracking branch 'remotes/origin/feature/hierarchical-multitenancy' into HEAD

Addressed by: https://review.openstack.org/138548 (abandoned)
    Add parent_id field to projects

Addressed by: https://review.openstack.org/138549 (abandoned)
    Base methods to handle hierarchical projects

Addressed by: https://review.openstack.org/138550 (merged)
    Create, update and delete hierarchical projects

Addressed by: https://review.openstack.org/138551 (merged)
    Adds correct checks in LDAP backend tests

Addressed by: https://review.openstack.org/138552 (merged)
    Inherited role assignments to projects

Addressed by: https://review.openstack.org/140705 (merged)
    Fix inherited user role test docstring

Addressed by: https://review.openstack.org/387129
    [api-ref] Fix couple of issues on OS-INHERIT API


Work Items

Dependency tree

* Blueprints in grey have been implemented.