Merge "Assign project-scoped service role for token validation"

2021-12-15 18:01:54 +00:00 · 2021-12-15 18:01:54 +00:00 · c5cd94e8e1
parent f3103f2cd7 3b80985e56
commit c5cd94e8e1
14 changed files with 43 additions and 0 deletions
--- a/deployment/aodh/aodh-api-container-puppet.yaml
+++ b/deployment/aodh/aodh-api-container-puppet.yaml
@ -152,6 +152,9 @@ outputs:
          users:
            aodh:
              password: {get_param: AodhPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'alarming'
      monitoring_subscription: {get_param: MonitoringSubscriptionAodhApi}
--- a/deployment/barbican/barbican-api-container-puppet.yaml
+++ b/deployment/barbican/barbican-api-container-puppet.yaml
@ -212,6 +212,9 @@ outputs:
          users:
            barbican:
              password: {get_param: BarbicanPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'key-manager'
          roles:
--- a/deployment/ceilometer/ceilometer-agent-central-container-puppet.yaml
+++ b/deployment/ceilometer/ceilometer-agent-central-container-puppet.yaml
@ -80,6 +80,7 @@ outputs:
              password: {get_param: CeilometerPassword}
              roles:
                - admin
+                - service
      config_settings:
        map_merge:
          - get_attr: [CeilometerServiceBase, role_data, config_settings]
--- a/deployment/designate/designate-api-container-puppet.yaml
+++ b/deployment/designate/designate-api-container-puppet.yaml
@ -94,6 +94,9 @@ outputs:
          users:
            designate:
              password: {get_param: DesignatePassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'dns'
      monitoring_subscription: {get_param: MonitoringSubscriptionDesignateApi}
--- a/deployment/glance/glance-api-container-puppet.yaml
+++ b/deployment/glance/glance-api-container-puppet.yaml
@ -454,6 +454,9 @@ outputs:
          users:
            glance:
              password: {get_param: GlancePassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'image'
      monitoring_subscription: {get_param: MonitoringSubscriptionGlanceApi}
--- a/deployment/gnocchi/gnocchi-api-container-puppet.yaml
+++ b/deployment/gnocchi/gnocchi-api-container-puppet.yaml
@ -178,6 +178,9 @@ outputs:
          users:
            gnocchi:
              password: {get_param: GnocchiPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'metric'
      monitoring_subscription: {get_param: MonitoringSubscriptionGnocchiApi}
--- a/deployment/heat/heat-api-cfn-container-puppet.yaml
+++ b/deployment/heat/heat-api-cfn-container-puppet.yaml
@ -108,6 +108,9 @@ outputs:
          users:
            heat-cfn:
              password: {get_param: HeatPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'cloudformation'
      monitoring_subscription: {get_param: MonitoringSubscriptionHeatApiCnf}
--- a/deployment/heat/heat-api-container-puppet.yaml
+++ b/deployment/heat/heat-api-container-puppet.yaml
@ -126,6 +126,9 @@ outputs:
          users:
            heat:
              password: {get_param: HeatPassword}
+              roles:
+                - admin
+                - service
            heat_stack_domain_admin:
              password: {get_param: HeatStackDomainAdminPassword}
              roles:
--- a/deployment/ironic/ironic-inspector-container-puppet.yaml
+++ b/deployment/ironic/ironic-inspector-container-puppet.yaml
@ -270,6 +270,9 @@ outputs:
          users:
            ironic-inspector:
              password: {get_param: IronicPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'baremetal-introspection'
      monitoring_subscription: {get_param: MonitoringSubscriptionIronicInspector}
--- a/deployment/manila/manila-api-container-puppet.yaml
+++ b/deployment/manila/manila-api-container-puppet.yaml
@ -153,6 +153,9 @@ outputs:
          users:
            manila:
              password: {get_param: ManilaPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'share'
        manilav2:
@ -163,6 +166,9 @@ outputs:
          users:
            manilav2:
              password: {get_param: ManilaPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'sharev2'
      monitoring_subscription: {get_param: MonitoringSubscriptionManilaApi}
--- a/deployment/neutron/neutron-api-container-puppet.yaml
+++ b/deployment/neutron/neutron-api-container-puppet.yaml
@ -290,6 +290,9 @@ outputs:
          users:
            neutron:
              password: {get_param: NeutronPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'network'
      monitoring_subscription: {get_param: MonitoringSubscriptionNeutronServer}
--- a/deployment/octavia/octavia-api-container-puppet.yaml
+++ b/deployment/octavia/octavia-api-container-puppet.yaml
@ -157,6 +157,9 @@ outputs:
              name: {get_param: OctaviaUserName}
              password: {get_param: OctaviaPassword}
              project: {get_param: OctaviaProjectName}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'load-balancer'
      monitoring_subscription: {get_param: MonitoringSubscriptionOctaviaApi}
--- a/deployment/placement/placement-api-container-puppet.yaml
+++ b/deployment/placement/placement-api-container-puppet.yaml
@ -141,6 +141,9 @@ outputs:
          users:
            placement:
              password: {get_param: PlacementPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'placement'
      monitoring_subscription: {get_param: MonitoringSubscriptionPlacement}
--- a/deployment/swift/swift-proxy-container-puppet.yaml
+++ b/deployment/swift/swift-proxy-container-puppet.yaml
@ -148,6 +148,9 @@ outputs:
          users:
            swift:
              password: {get_param: SwiftPassword}
+              roles:
+                - admin
+                - service
          region: {get_param: KeystoneRegion}
          service: 'object-store'
          roles: