From 2c982572c13ef934c0e4824fce642ebd613d60f8 Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Sat, 11 Oct 2025 12:09:14 +0900 Subject: [PATCH] Add service role by default This is the role created to be used by service users. At this moment several services/functionalities still need the admin role so is kept. Change-Id: If6bb4b6f9558ddb0830a896f1160cb1577fe71d8 Signed-off-by: Takashi Kajinami --- manifests/keystone/auth.pp | 4 ++-- releasenotes/notes/service-role-92fe736a9d03ab40.yaml | 5 +++++ spec/classes/zaqar_keystone_auth_spec.rb | 6 +++--- 3 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 releasenotes/notes/service-role-92fe736a9d03ab40.yaml diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp index ea2573e..618ae91 100644 --- a/manifests/keystone/auth.pp +++ b/manifests/keystone/auth.pp @@ -21,7 +21,7 @@ # # [*roles*] # (Optional) List of roles assigned to neutron user. -# Defaults to ['admin'] +# Defaults to ['admin', 'service'] # # [*system_scope*] # (Optional) Scope for system operations. @@ -86,7 +86,7 @@ class zaqar::keystone::auth ( $internal_url = 'http://127.0.0.1:8888', $region = 'RegionOne', $tenant = 'services', - $roles = ['admin'], + $roles = ['admin', 'service'], $system_scope = 'all', $system_roles = [], $configure_endpoint = true, diff --git a/releasenotes/notes/service-role-92fe736a9d03ab40.yaml b/releasenotes/notes/service-role-92fe736a9d03ab40.yaml new file mode 100644 index 0000000..0e8e024 --- /dev/null +++ b/releasenotes/notes/service-role-92fe736a9d03ab40.yaml @@ -0,0 +1,5 @@ +--- +features: + - | + The ``zaqar::keystone::auth`` class now adds the ``service`` role by + default. Set the ``roles`` parameter not to add the role. diff --git a/spec/classes/zaqar_keystone_auth_spec.rb b/spec/classes/zaqar_keystone_auth_spec.rb index 54322a4..93b9c0d 100644 --- a/spec/classes/zaqar_keystone_auth_spec.rb +++ b/spec/classes/zaqar_keystone_auth_spec.rb @@ -24,7 +24,7 @@ describe 'zaqar::keystone::auth' do :password => 'zaqar_password', :email => 'zaqar@localhost', :tenant => 'services', - :roles => ['admin'], + :roles => ['admin', 'service'], :system_scope => 'all', :system_roles => [], :public_url => 'http://127.0.0.1:8888', @@ -39,7 +39,7 @@ describe 'zaqar::keystone::auth' do :auth_name => 'alt_zaqar', :email => 'alt_zaqar@alt_localhost', :tenant => 'alt_service', - :roles => ['admin', 'service'], + :roles => ['admin'], :system_scope => 'alt_all', :system_roles => ['admin', 'member', 'reader'], :configure_endpoint => false, @@ -68,7 +68,7 @@ describe 'zaqar::keystone::auth' do :password => 'zaqar_password', :email => 'alt_zaqar@alt_localhost', :tenant => 'alt_service', - :roles => ['admin', 'service'], + :roles => ['admin'], :system_scope => 'alt_all', :system_roles => ['admin', 'member', 'reader'], :public_url => 'https://10.10.10.10:80',