Merge "Add enforce_scope setting support for Glance" into stable/wallaby
This commit is contained in:
commit
dfa05b86e9
12
lib/glance
12
lib/glance
@ -85,6 +85,12 @@ GLANCE_TASKS_DIR=${GLANCE_MULTISTORE_FILE_IMAGE_DIR:=$DATA_DIR/os_glance_tasks_s
|
|||||||
|
|
||||||
GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
|
GLANCE_USE_IMPORT_WORKFLOW=$(trueorfalse False GLANCE_USE_IMPORT_WORKFLOW)
|
||||||
|
|
||||||
|
# Flag to set the oslo_policy.enforce_scope. This is used to switch
|
||||||
|
# the Image API policies to start checking the scope of token. By Default,
|
||||||
|
# this flag is False.
|
||||||
|
# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
|
||||||
|
GLANCE_ENFORCE_SCOPE=$(trueorfalse False GLANCE_ENFORCE_SCOPE)
|
||||||
|
|
||||||
GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
|
GLANCE_CONF_DIR=${GLANCE_CONF_DIR:-/etc/glance}
|
||||||
GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
|
GLANCE_METADEF_DIR=$GLANCE_CONF_DIR/metadefs
|
||||||
GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
|
GLANCE_API_CONF=$GLANCE_CONF_DIR/glance-api.conf
|
||||||
@ -373,6 +379,12 @@ function configure_glance {
|
|||||||
iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
|
iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
|
||||||
iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
|
iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
if [[ "$GLANCE_ENFORCE_SCOPE" == True ]] ; then
|
||||||
|
iniset $GLANCE_API_CONF oslo_policy enforce_scope true
|
||||||
|
iniset $GLANCE_API_CONF oslo_policy enforce_new_defaults true
|
||||||
|
iniset $GLANCE_API_CONF DEFAULT enforce_secure_rbac true
|
||||||
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
# create_glance_accounts() - Set up common required glance accounts
|
# create_glance_accounts() - Set up common required glance accounts
|
||||||
|
@ -612,6 +612,8 @@ function configure_tempest {
|
|||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
|
||||||
|
iniset $TEMPEST_CONFIG enforce_scope glance "$GLANCE_ENFORCE_SCOPE"
|
||||||
|
|
||||||
if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
|
if [ "$VIRT_DRIVER" = "libvirt" ] && [ "$LIBVIRT_TYPE" = "lxc" ]; then
|
||||||
# libvirt-lxc does not support boot from volume or attaching volumes
|
# libvirt-lxc does not support boot from volume or attaching volumes
|
||||||
# so basically anything with cinder is out of the question.
|
# so basically anything with cinder is out of the question.
|
||||||
|
Loading…
Reference in New Issue
Block a user