1f53bfcc79
We should use a service account to make requests to external vendordata services. This something which we got wrong in the newton cycle, and discussed how to resolve at the ocata summit. It is intended that this fix be backported to newton as well. There is a sample external vendordata server which has been tested with this implementat at: https://github.com/mikalstill/vendordata Change-Id: I7d29ecc00f99724731d120ff94b4bf3210f3a64e Co-Authored-By: Stephen Finucane <sfinucan@redhat.com>
15 lines
767 B
YAML
15 lines
767 B
YAML
---
|
|
fixes:
|
|
- |
|
|
The nova metadata service will now pass a nove service token to the
|
|
external vendordata server. These options can be configured using various
|
|
Keystone-related options available in the ``vendordata_dynamic_auth``
|
|
group. A new service token has been created for this purpose. Previously,
|
|
the requesting user's keystone token was passed through to the external
|
|
vendordata server if available, otherwise no token is passed. This resolves
|
|
issues with scenarios such as cloud-init's use of the metadata server on
|
|
first boot to determine configuration information. Refer to the blueprints
|
|
at
|
|
http://specs.openstack.org/openstack/nova-specs/specs/ocata/approved/vendordata-reboot-ocata.html
|
|
for more information.
|