600e912400
Add the service role to ironic service users. Ironic recently enforced
new policy validation as part of the RBAC efforts. [1][2]
Service user support was also added to Ironic. [3]
Admin role needs to stay as not all services added service role support. [4][5]
[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] e2a47de10a/goals/selected/consistent-and-secure-rbac.rst (phase-2)
[3] https://review.opendev.org/c/openstack/ironic/+/907148
[4] https://review.opendev.org/q/topic:bp%252Fpolicy-service-role-default
[5] https://review.opendev.org/q/topic:%22New-Location-Apis%22
Related-Bug: #2051837
Change-Id: I048402c2247188cf57f35437f557f84ac25d4ff2
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
---
|
|
- name: Wait for Ironic nodes not to wait
|
|
become: true
|
|
command: >
|
|
{{ kolla_container_engine }} exec kolla_toolbox openstack
|
|
--os-interface {{ openstack_interface }}
|
|
--os-auth-url {{ openstack_auth.auth_url }}
|
|
--os-username {{ openstack_auth.username }}
|
|
--os-password {{ openstack_auth.password }}
|
|
--os-identity-api-version 3
|
|
--os-user-domain-name {{ openstack_auth.user_domain_name }}
|
|
--os-system-scope "all"
|
|
--os-region-name {{ openstack_region_name }}
|
|
{% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %}
|
|
baremetal node list --format json --column "Provisioning State"
|
|
register: ironic_nodes
|
|
changed_when: false
|
|
retries: 10
|
|
delay: 30
|
|
until:
|
|
- ironic_nodes is success
|
|
- (ironic_nodes.stdout |
|
|
from_json |
|
|
map(attribute='Provisioning State') |
|
|
select('search', '\\bwait\\b') |
|
|
length) == 0
|
|
run_once: true
|
|
when: not ironic_upgrade_skip_wait_check | bool
|
|
|
|
- include_tasks: rolling_upgrade.yml
|
|
when: ironic_enable_rolling_upgrade | bool
|
|
|
|
- include_tasks: legacy_upgrade.yml
|
|
when: not ironic_enable_rolling_upgrade | bool
|
|
|
|
# TODO(bbezak): Remove this task in the Dalmatian cycle.
|
|
- import_role:
|
|
name: service-ks-register
|
|
vars:
|
|
service_ks_register_auth: "{{ openstack_ironic_auth }}"
|
|
service_ks_register_user_roles: "{{ ironic_ks_user_roles }}"
|