openstack/designate
Code Issues Proposed changes

Add "admin" role to the designate user created by devstack plugin

Browse Source 
Service user with name "designate" had only "service" role up to now but
it seems that with oslo.policy 4.4.0 where "enforce_new_defaults" is set
to True by default, this breaks integration between Neutron and
Designate as e.g. Neutron's creation of the recordset fails with
Forbidden exception as this seems to be allowed only for admin user or
shared or primary zone.

This patch adds also "admin" role for this "designate" service user to
workaround that issue, at least until Designate will support "service"
role usage with Secure RBAC policies.

Closes-Bug: #2078518
Change-Id: I477cc96519e7396a614f92d109867222207ec388
This commit is contained in:
Slawek Kaplonski 2024-09-03 10:49:04 +02:00
parent cfa330c0fd
commit 4388f00d26
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
devstack/plugin.sh
View File

@ -188,7 +188,7 @@ function create_designate_accounts {
local designate_api_url
if is_service_enabled designate-api; then
create_service_user "designate"
create_service_user "designate" "admin"
designate_api_url="$DESIGNATE_SERVICE_PROTOCOL://$DESIGNATE_SERVICE_HOST/dns"