6e835ae758
Ironic enabled secure RBAC with system scoped enforcement [1].
Some API calls, for instance 'baremetal:driver:get' needs system
scope role by design [2], even with elevated access project scope
service role [3].
[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] 8ec5606622/ironic/common/policy.py (L1349-L1357)
[3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007
Related-Bug: #2051837
Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
---
|
|
- name: Creating clouds.yaml file on the deploy node
|
|
hosts: localhost
|
|
tasks:
|
|
- name: Create /etc/openstack directory
|
|
become: true
|
|
file:
|
|
state: directory
|
|
dest: "/etc/openstack"
|
|
owner: "{{ ansible_facts.user_uid }}"
|
|
group: "{{ ansible_facts.user_gid }}"
|
|
mode: 0700
|
|
|
|
- name: Template out clouds.yaml
|
|
become: true
|
|
template:
|
|
src: "roles/common/templates/clouds.yaml.j2"
|
|
dest: "{{ node_config }}/clouds.yaml"
|
|
owner: "{{ ansible_facts.user_uid }}"
|
|
group: "{{ ansible_facts.user_gid }}"
|
|
mode: 0600
|
|
|
|
- name: Creating admin openrc file on the deploy node
|
|
hosts: localhost
|
|
tasks:
|
|
- name: Template out admin-openrc.sh
|
|
become: true
|
|
template:
|
|
src: "roles/common/templates/admin-openrc.sh.j2"
|
|
dest: "{{ node_config }}/admin-openrc.sh"
|
|
owner: "{{ ansible_facts.user_uid }}"
|
|
group: "{{ ansible_facts.user_gid }}"
|
|
mode: 0600
|
|
|
|
- name: Template out admin-openrc-system.sh
|
|
become: true
|
|
template:
|
|
src: "roles/common/templates/admin-openrc-system.sh.j2"
|
|
dest: "{{ node_config }}/admin-openrc-system.sh"
|
|
owner: "{{ ansible_facts.user_uid }}"
|
|
group: "{{ ansible_facts.user_gid }}"
|
|
mode: 0600
|
|
|
|
- name: Template out public-openrc.sh
|
|
become: true
|
|
template:
|
|
src: "roles/common/templates/public-openrc.sh.j2"
|
|
dest: "{{ node_config }}/public-openrc.sh"
|
|
owner: "{{ ansible_facts.user_uid }}"
|
|
group: "{{ ansible_facts.user_gid }}"
|
|
mode: 0600
|
|
|
|
- import_role:
|
|
name: octavia
|
|
tasks_from: openrc.yml
|
|
when: enable_octavia | bool
|