From b8f86e2e0a5f605da9710a923238f4ae87c00ee5 Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Sat, 11 Oct 2025 11:45:37 +0900 Subject: [PATCH] Add service role by default This is the role created to be used by service users. At this moment several services/functionalities still need the admin role so is kept. Change-Id: I0c7849fded8cfa9a7182aae6dcd2a23bfe528677 Signed-off-by: Takashi Kajinami --- manifests/keystone/auth.pp | 4 ++-- releasenotes/notes/service-role-4780cacbab3bd65d.yaml | 5 +++++ spec/classes/barbican_keystone_auth_spec.rb | 6 +++--- 3 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 releasenotes/notes/service-role-4780cacbab3bd65d.yaml diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp index b0fe971a..098501bf 100644 --- a/manifests/keystone/auth.pp +++ b/manifests/keystone/auth.pp @@ -21,7 +21,7 @@ # # [*roles*] # (Optional) List of roles assigned to barbican user. -# Defaults to ['admin'] +# Defaults to ['admin', 'service'] # # [*system_scope*] # (Optional) Scope for system operations. @@ -83,7 +83,7 @@ class barbican::keystone::auth ( String[1] $auth_name = 'barbican', String[1] $email = 'barbican@localhost', String[1] $tenant = 'services', - Array[String[1]] $roles = ['admin'], + Array[String[1]] $roles = ['admin', 'service'], String[1] $system_scope = 'all', Array[String[1]] $system_roles = [], Boolean $configure_endpoint = true, diff --git a/releasenotes/notes/service-role-4780cacbab3bd65d.yaml b/releasenotes/notes/service-role-4780cacbab3bd65d.yaml new file mode 100644 index 00000000..bd770ae8 --- /dev/null +++ b/releasenotes/notes/service-role-4780cacbab3bd65d.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + The ``barbican::keystone::auth`` class now adds the ``service`` role by + default. Set the ``roles`` parameter not to add the role. diff --git a/spec/classes/barbican_keystone_auth_spec.rb b/spec/classes/barbican_keystone_auth_spec.rb index a4321534..461ff4b3 100644 --- a/spec/classes/barbican_keystone_auth_spec.rb +++ b/spec/classes/barbican_keystone_auth_spec.rb @@ -24,7 +24,7 @@ describe 'barbican::keystone::auth' do :password => 'barbican_password', :email => 'barbican@localhost', :tenant => 'services', - :roles => ['admin'], + :roles => ['admin', 'service'], :system_scope => 'all', :system_roles => [], :public_url => 'http://127.0.0.1:9311', @@ -39,7 +39,7 @@ describe 'barbican::keystone::auth' do :auth_name => 'alt_barbican', :email => 'alt_barbican@alt_localhost', :tenant => 'alt_service', - :roles => ['admin', 'service'], + :roles => ['admin'], :system_scope => 'alt_all', :system_roles => ['admin', 'member', 'reader'], :configure_endpoint => false, @@ -68,7 +68,7 @@ describe 'barbican::keystone::auth' do :password => 'barbican_password', :email => 'alt_barbican@alt_localhost', :tenant => 'alt_service', - :roles => ['admin', 'service'], + :roles => ['admin'], :system_scope => 'alt_all', :system_roles => ['admin', 'member', 'reader'], :public_url => 'https://10.10.10.10:80',