openstack/kolla-ansible
Code Issues Proposed changes

Ironic: enable elevated access for project scoped service role

Browse Source 
Ironic recently started to enforce new policies and scope [1].
And Ironic is one of the sole openstack project which need
system scope for some admin related api calls [2].
However Ironic also started to allow project-scope behaviour
for service role with setting
``rbac_service_role_elevated_access``[3] [4]. This change enables
this setting to get similar behaviour of service role as other
openstack projects.

[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (L261)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] 8ec5606622/releasenotes/notes/service-project-service-role-fix-e4d1a8c23856926a.yaml

Related-Bug: #2051837

Change-Id: If8d7cf1663145d0398a2e936486e2b316d4df5e0
This commit is contained in:
Bartosz Bezak 2024-02-06 14:38:21 +01:00
parent 07bbf1707f
commit 121aa3d258
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/ironic/templates/ironic.conf.j2
View File

@ -18,6 +18,8 @@ my_ip = {{ api_interface_address }}
notification_level = info
{% endif %}
rbac_service_role_elevated_access = True
[oslo_messaging_notifications]
transport_url = {{ notify_transport_url }}
{% if ironic_enabled_notification_topics or enable_ironic_prometheus_exporter | bool %}

12
releasenotes/notes/ironic-rbac-elevated-6804dab4061ab236.yaml Normal file
View File

@ -0,0 +1,12 @@
---
features:
- |
Enable elevated access for project scoped service role
in Ironic. Ironic recently started to enforce new policies
and scope. And Ironic is one of the sole openstack project
which need system scope for some admin related api calls.
However Ironic also started to allow project-scope behaviour
for service role with setting
``rbac_service_role_elevated_access``. This change enables
this setting to get similar behaviour of service role as other
openstack projects.