283fa242ca
As per the RBAC new direction in Zed cycle, we have dropped the system scope from API policies and all the policies are hardcoded to project scoped so that any user accessing APIs using system scope will get 403 error. It is dropped from all the OpenStack services except for the Ironic service which will have system scope and to support ironic only deployment, we are keeping system as well as project scope in Keystone. Complete discussion and direction can be found in the below gerrit change and TC goal direction: - https://review.opendev.org/c/openstack/governance/+/847418 - https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept As phase-2 of RBAC goal, services will start enabling the new defaults and project scope by default. For example: Nova did in - https://review.opendev.org/c/openstack/nova/+/866218 Kolla who start accessing the services using system scope token - https://review.opendev.org/c/openstack/kolla-ansible/+/692179 This commit partially revert the above change except keeping system scope usage for Keystone and Ironic. Rest all services are changed to use the project scope token. And enable the scope and new defaults for Nova which was disabled by https://review.opendev.org/c/openstack/kolla-ansible/+/870804 Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d
33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
---
|
|
- name: Creating admin project, user, role, service, and endpoint
|
|
become: true
|
|
command: >
|
|
{{ kolla_container_engine }} exec keystone kolla_keystone_bootstrap
|
|
{{ openstack_auth.username }} {{ openstack_auth.password }} {{ openstack_auth.project_name }}
|
|
admin {{ keystone_internal_url }} {{ keystone_public_url }} {{ item }}
|
|
register: keystone_bootstrap
|
|
changed_when: (keystone_bootstrap.stdout | from_json).changed
|
|
failed_when: (keystone_bootstrap.stdout | from_json).failed
|
|
run_once: True
|
|
with_items: "{{ multiple_regions_names }}"
|
|
|
|
- import_role:
|
|
name: service-ks-register
|
|
vars:
|
|
service_ks_register_auth: "{{ openstack_keystone_auth }}"
|
|
service_ks_register_services: "{{ keystone_ks_services }}"
|
|
run_once: True
|
|
|
|
- name: Creating default user role
|
|
become: true
|
|
kolla_toolbox:
|
|
container_engine: "{{ kolla_container_engine }}"
|
|
module_name: "os_keystone_role"
|
|
module_args:
|
|
name: "{{ keystone_default_user_role }}"
|
|
auth: "{{ openstack_keystone_auth }}"
|
|
endpoint_type: "{{ openstack_interface }}"
|
|
cacert: "{{ openstack_cacert }}"
|
|
region_name: "{{ openstack_region_name }}"
|
|
run_once: True
|