ironic/releasenotes/notes/system-scoped-authentication-28e3651de250bea8.yaml
Sharpz7 949387bd80 [codespell] Fixing Spelling Mistakes
This is the first in a series of commits to add support for codespell. This is continuning the process completed in ironic-python-agent.

Future Commits will add a Tox Target, CI support and potentially a git-blame-ignore-revs file if their are lots of spelling mistakes that could clutter git blame.

Change-Id: Id328ff64c352e85b58181e9d9e35973a8706ab7a
2024-02-12 19:58:56 +00:00

33 lines
1.6 KiB
YAML

---
features:
- |
The Baremetal API, provided by the ``ironic-api`` process, now supports use of
``system`` scoped ``keystone`` authentication for the following endpoints:
nodes, ports, portgroups, chassis, drivers, driver vendor passthru,
volume targets, volume connectors, conductors, allocations, events,
deploy templates
upgrade:
- |
Deprecated policy rules are not expressed via a default policy file
generation from the source code. The generated default policy file
indicates the new default policies with notes on the deprecation
to which ``oslo.policy`` falls back to, until the
``[oslo_policy]enforce_scope`` and ``[oslo_policy]enforce_new_defaults``
have been set to ``True``.
Please see the `Victoria policy configuration <https://docs.openstack.org/ironic/victoria/configuration/policy.html>`_
documentation to reference prior policy configuration.
- |
Operators are encouraged to move to ``system`` scope based authentication
by setting ``[oslo_policy]enforce_scope`` and
``[oslo_policy]enforce_new_defaults``. This requires a migration from
using an ``admin project`` with the ``baremetal_admin`` and
``baremetal_observer``. System wide administrators using ``system``
scoped ``admin`` and ``reader`` accounts supersede the deprecated
model.
deprecations:
- |
Use of an ``admin project`` with ironic is deprecated. With this the
custom roles, ``baremetal_admin`` and ``baremetal_observer`` are also
deprecated. Please migrate to using a ``system`` scoped account with the
``admin`` and ``reader`` roles, respectively.