Chapter 8. Managing projects As an OpenStack administrator, you can create and manage projects. A project is a pool of shared virtual resources, to which you can assign OpenStack users and groups. You can configure the quota of shared virtual resources in each project. You can create multiple projects that will not interfere with each other's permissions and resources. Users can be associated with more than one project. Each user must have a role assigned for each project to which they are assigned. 8.1. Creating a project Create a project, add members to the project and set resource limits for the project. Log in to the Dashboard as a user with administrative privileges. Select Identity > Projects . Click Create Project . On the Project Information tab, enter a name and description for the project. The Enabled check box is selected by default. On the Project Members tab, add members to the project from the All Users list. On the Quotas tab, specify resource limits for the project. Click Create Project . 8.2. Editing a project You can edit a project to change its name or description, enable or temporarily disable it, or update the members in the project. Log in to the Dashboard as a user with administrative privileges. Select Identity > Projects . In the project Actions column, click the arrow, and click Edit Project . In the Edit Project window, you can update a project to change its name or description, and enable or temporarily disable the project. On the Project Members tab, add members to the project, or remove them as needed. Click Save . Note The Enabled check box is selected by default. To temporarily disable the project, clear the Enabled check box. To enable a disabled project, select the Enabled check box. 8.3. Deleting a project Log in to the Dashboard as a user with administrative privileges. Select Identity > Projects . Select the project that you want to delete. Click Delete Projects . The Confirm Delete Projects window is displayed. Click Delete Projects to confirm the action. The project is deleted and any user pairing is disassociated. 8.4. Updating project quotas Quotas are operational limits that you set for each project to optimize cloud resources. You can set quotas to prevent project resources from being exhausted without notification. You can enforce quotas at both the project and the project-user level. Log in to the Dashboard as a user with administrative privileges. Select Identity > Projects . In the project Actions column, click the arrow, and click Modify Quotas . In the Quota tab, modify project quotas as needed. Click Save . Note At present, nested quotas are not yet supported. As such, you must manage quotas individually against projects and subprojects. 8.5. Changing the active project Set a project as the active project so that you can use the dashboard to interact with objects in the project. To set a project as the active project, you must be a member of the project. It is also necessary for the user to be a member of more than one project to have the Set as Active Project option be enabled. You cannot set a disabled project as active, unless it is re-enabled. Log in to the Dashboard as a user with administrative privileges. Select Identity > Projects . In the project Actions column, click the arrow, and click Set as Active Project . Alternatively, as a non-admin user, in the project Actions column, click Set as Active Project which becomes the default action in the column. 8.6. Project hierarchies You can nest projects using multitenancy in the Identity service (keystone). Multitenancy allows subprojects to inherit role assignments from a parent project. 8.6.1. Creating hierarchical projects and sub-projects You can implement Hierarchical Multitenancy (HMT) using keystone domains and projects. First create a new domain and then create a project within that domain. You can then add subprojects to that project. You can also promote a user to administrator of a subproject by adding the user to the admin role for that subproject. Note The HMT structure used by keystone is not currently represented in the dashboard. Procedure Create a new keystone domain called corp : Example command Example output Create the parent project ( private-cloud ) within the corp domain: Example command Example output Create a subproject ( dev ) within the private-cloud parent project, while also specifying the corp domain: Example command Example output Create another subproject called qa : Example command Example output Note You can use the Identity API to view the project hierarchy. For more information, see https://developer.openstack.org/api-ref/identity/v3/index.html?expanded=show-project-details-detail 8.6.2. Configuring access to hierarchical projects By default, a newly-created project has no assigned roles. When you assign role permissions to the parent project, you can include the --inherited flag to instruct the subprojects to inherit the assigned permissions from the parent project. For example, a user with admin role access to the parent project also has admin access to the subprojects. Granting access to users View the existing permissions assigned to a project: View the existing roles: Example command Example output Grant the user account user1 access to the private-cloud project: Re-run this command using the --inherited flag. As a result, user1 also has access to the private-cloud subprojects, which have inherited the role assignment: Review the result of the permissions update: Example command Example output The user1 user has inherited access to the qa and dev projects. In addition, because the --inherited flag was applied to the parent project, user1 also receives access to any subprojects that are created later. Removing access from users Explicit and inherited permissions must be separately removed. Remove a user from an explicitly assigned role: Review the result of the change. Notice that the inherited permissions are still present: Example command Example output Remove the inherited permissions: Review the result of the change. The inherited permissions have been removed, and the resulting output is now empty: 8.6.3. Reseller project overview With the Reseller project, the goal is to have a hierarchy of domains; these domains will eventually allow you to consider reselling portions of the cloud, with a subdomain representing a fully-enabled cloud. This work has been split into phases, with phase 1 described below: Phase 1 of reseller Reseller (phase 1) is an extension of Hierarchical Multitenancy (HMT), described here: Creating hierarchical projects and sub-projects . Previously, keystone domains were originally intended to be containers that stored users and projects, with their own table in the database back-end. As a result, domains are now no longer stored in their own table, and have been merged into the project table: A domain is now a type of project, distinguished by the is_domain flag. A domain represents a top-level project in the project hierarchy: domains are roots in the project hierarchy APIs have been updated to create and retrieve domains using the projects subpath: Create a new domain by creating a project with the is_domain flag set to true List projects that are domains: get projects including the is_domain query parameter. 8.7. Project security management Security groups are sets of IP filter rules that can be assigned to project instances, and which define networking access to the instance. Security groups are project specific; project members can edit the default rules for their security group and add new rule sets. All projects have a default security group that is applied to any instance that has no other defined security group. Unless you change the default values, this security group denies all incoming traffic and allows only outgoing traffic from your instance. You can apply a security group directly to an instance during instance creation, or to a port on the running instance. Note You cannot apply a role-based access control (RBAC)-shared security group directly to an instance during instance creation. To apply an RBAC-shared security group to an instance you must first create the port, apply the shared security group to that port, and then assign that port to the instance. See Adding a security group to a port in Creating and managing instances . Do not delete the default security group without creating groups that allow required egress. For example, if your instances use DHCP and metadata, your instance requires security group rules that allow egress to the DHCP server and metadata agent. 8.7.1. Creating a security group Create a security group so that you can configure security rules. For example, you can enable ICMP traffic, or disable HTTP requests. Procedure In the dashboard, select Project > Compute > Access & Security . On the Security Groups tab, click Create Security Group . Enter a name and description for the group, and click Create Security Group . 8.7.2. Adding a security group rule By default, rules for a new group only provide outgoing access. You must add new rules to provide additional access. Procedure In the dashboard, select Project > Compute > Access & Security . On the Security Groups tab, click Manage Rules for the security group that you want to edit. Click Add Rule to add a new rule. Specify the rule values, and click Add . The following rule fields are required: Rule Rule type. If you specify a rule template (for example, SSH ), its fields are automatically filled in: TCP: Typically used to exchange data between systems, and for end-user communication. UDP: Typically used to exchange data between systems, particularly at the application level. ICMP: Typically used by network devices, such as routers, to send error or monitoring messages. Direction Ingress (inbound) or Egress (outbound). Open Port For TCP or UDP rules, the Port or Port Range (single port or range of ports) to open: For a range of ports, enter port values in the From Port and To Port fields. For a single port, enter the port value in the Port field. Type The type for ICMP rules; must be in the range -1:255 . Code The code for ICMP rules; must be in the range -1:255 . Remote The traffic source for this rule: CIDR (Classless Inter-Domain Routing): IP address block, which limits access to IPs within the block. Enter the CIDR in the Source field. Security Group: Source group that enables any instance in the group to access any other group instance. 8.7.3. Deleting a security group rule Delete security group rules that you no longer require. Procedure In the dashboard, select Project > Compute > Access & Security . On the Security Groups tab, click Manage Rules for the security group. Select the security group rule, and click Delete Rule . Click Delete Rule again. Note You cannot undo the delete action. 8.7.4. Deleting a security group Delete security groups that you no longer require. Procedure In the dashboard, select Project > Compute > Access & Security . On the Security Groups tab, select the group, and click Delete Security Groups . Click Delete Security Groups . Note You cannot undo the delete action.

Commands:
openstack domain create corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | name | corp | | options | {} | | tags | [] | +-------------+----------------------------------+
openstack project create private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | e86f182e16e24441b71c7296585c2e21 | | is_domain | False | | name | private-cloud | | options | {} | | parent_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | tags | [] | +-------------+----------------------------------+
openstack project create dev --parent private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | 71f05cdd5b8a45d4b1a928bfe7c2e20d | | is_domain | False | | name | dev | | options | {} | | parent_id | e86f182e16e24441b71c7296585c2e21 | | tags | [] | +-------------+----------------------------------+
openstack project create qa --parent private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | 03801ad929b84c8fb091bf3248e6db68 | | is_domain | False | | name | qa | | options | {} | | parent_id | e86f182e16e24441b71c7296585c2e21 | | tags | [] | +-------------+----------------------------------+
openstack role assignment list --project private-cloud
openstack role list
+----------------------------------+-----------------+ | ID | Name | +----------------------------------+-----------------+ | 01d92614cd224a589bdf3b171afc5488 | admin | | 034e4620ed3d45969dfe8992af001514 | member | | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin | | cfea5760d9c948e7b362abc1d06e557f | reader | | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator | | ef3d3f510a474d6c860b4098ad658a29 | service | +----------------------------------+-----------------+
openstack role add --user user1 --user-domain corp --project private-cloud member
openstack role add --user user1 --user-domain corp --project private-cloud member --inherited
openstack role assignment list --effective --user user1 --user-domain corp
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | c50d5cf4fe2e4929b98af5abdec3fd64 | | False | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | 11fccd8369824baa9fc87cf01023fd87 | | True | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | b4f1d6f59ddf413fa040f062a0234871 | | True | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
openstack role remove --user user1 --project private-cloud member
openstack role assignment list --effective --user user1 --user-domain corp
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | 11fccd8369824baa9fc87cf01023fd87 | | True | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | b4f1d6f59ddf413fa040f062a0234871 | | True | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
openstack role remove --user user1 --project private-cloud member --inherited
openstack role assignment list --effective --user user1 --user-domain corp