Support service tokens

Implement support for service_tokens. For that we convert
role_name to be a list along with renaming corresponding variable.

Additionally service_type is defined now for keystone_authtoken which
enables to validate tokens with restricted access rules

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
Change-Id: Id451d06bcc40c94e9ef021dd7e3c1d14703e73cc

defaults/main.yml

@@ -179,7 +179,12 @@ zun_service_project_name: "service"
 zun_service_project_domain_id: default
 zun_service_user_domain_id: default
 zun_service_user_name: "zun"
-zun_service_role_name: "admin"
+zun_service_role_names:
+  - admin
+  - service
+zun_service_token_roles:
+  - service
+zun_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
 
 ## Zun Auth for kuryr
 zun_kuryr_service_username: kuryr

tasks/main.yml

@@ -123,10 +123,10 @@
     _service_users:
       - name: "{{ zun_service_user_name }}"
         password: "{{ zun_service_password }}"
-        role: "{{ zun_service_role_name }}"
+        role: "{{ zun_service_role_names }}"
       - name: "{{ zun_kuryr_service_username }}"
         password: "{{ zun_kuryr_service_password }}"
-        role: "{{ zun_service_role_name }}"
+        role: "{{ zun_service_role_names }}"
     _service_endpoints:
       - service: "{{ zun_service_name }}"
         interface: "public"

templates/zun.conf.j2

@@ -64,12 +64,15 @@ memcached_servers = {{ zun_memcached_servers }}
 token_cache_time = 300
 memcache_security_strategy = ENCRYPT
 memcache_secret_key = {{ memcached_encryption_key }}
-service_token_roles_required = true
 auth_type = {{ zun_keystone_auth_plugin }}
 username = {{ zun_service_user_name }}
 user_domain_id = {{ zun_service_user_domain_id }}
 password = {{ zun_service_password }}
 
+service_token_roles_required = {{ zun_service_token_roles_required | bool }}
+service_token_roles = {{ zun_service_token_roles | join(',') }}
+service_type = {{ zun_service_type }}
+
 [network]
 driver = kuryr
 driver_name = kuryr