Skip to content

RBAC Networks

Role-Based Access Control (RBAC) allows you to share a network from one project with another project. This is useful when multiple projects need access to the same network infrastructure.

Prerequisites

  • OpenStack client >= 5.4.0 (check with openstack --version).
  • Application Credentials (cloud.yaml) for the source project (see Tools).
  • The target project ID you want to share the network with.

Share a Network via RBAC

Use a user from the source project (the project that owns the network) to create the RBAC policy for the target project:

openstack network rbac create \
    --target-project <target_project_id> \
    --action access_as_shared \
    --type network <source_network_name_or_id>

After creating the RBAC policy, the network appears in the target project's network list and can be used by instances in that project.

Note

The target project receives access_as_shared permission — it can use the network but cannot modify or delete it.

Verify the RBAC Policy

# List all RBAC policies
openstack network rbac list

# Show details of a specific RBAC policy
openstack network rbac show <rbac_policy_id>

For further information, see the OpenStack Neutron RBAC documentation.