ironic-inspector/releasenotes/notes/role-service-for-openstack-rbac-changes-7ca8533f76e504d5.yaml
Sharpz7 98a226b9c6 [codespell] Fixing Spelling Mistakes
This is the first in a series of commits to add support for codespell. This is continuning the process completed in ironic-python-agent.

Future Commits will add a Tox Target, CI support and potentially a git-blame-ignore-revs file if their are lots of spelling mistakes that could clutter git blame.

Change-Id: Icb4e66359c3e79618c916b35793ea7b5f79b030d
2024-01-25 21:22:07 +00:00

15 lines
750 B
YAML

---
fixes:
- |
Fixes the Role Based Access Control state and capabilities to align with
OpenStack Community RBAC goals which includes support for a ``service``
role by default to enable inter-service communication to be configured
without an ``admin`` username. In large part, these changes were missed
as the Inspector service is considered an "admin-only" service.
Also in alignment with overall community position changes, where the
``admin`` role is sufficient without an explicit ``system`` scope. To
help ensure a high level of security, explicit testing was also added
for the ``manager`` role, which is unavailable as that role is reserved
for administrative functions inside of a tenant's project.