diff options
| author | Bartosz Bezak <bartosz@stackhpc.com> | 2024-02-06 17:40:04 +0100 |
|---|---|---|
| committer | Bartosz Bezak <bartosz@stackhpc.com> | 2024-02-15 15:01:59 +0000 |
| commit | 6e835ae758f0a2e8c87ab0bc22d578168395e424 (patch) | |
| tree | be45ec7ce4a6f5c99329a07b1c40cc28ab114db4 /ansible/post-deploy.yml | |
| parent | 600e912400ab8b52ca422f007f63da9d4fcc0a69 (diff) | |
| download | kolla-ansible-6e835ae758f0a2e8c87ab0bc22d578168395e424.tar.gz kolla-ansible-6e835ae758f0a2e8c87ab0bc22d578168395e424.zip | |
Template system scoped admin-openrc and clouds.yml files
Ironic enabled secure RBAC with system scoped enforcement [1].
Some API calls, for instance 'baremetal:driver:get' needs system
scope role by design [2], even with elevated access project scope
service role [3].
[1] https://review.opendev.org/c/openstack/ironic/+/902009
[2] https://opendev.org/openstack/ironic/src/commit/8ec56066223301230ac0ed0f0c471a10d366b474/ironic/common/policy.py#L1349-L1357
[3] https://review.opendev.org/c/openstack/kolla-ansible/+/908007
Related-Bug: #2051837
Change-Id: Id6313d7dd343b82d4c9ccf7bf429d340ea0e93d1
Diffstat (limited to 'ansible/post-deploy.yml')
| -rw-r--r-- | ansible/post-deploy.yml | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/ansible/post-deploy.yml b/ansible/post-deploy.yml index 61d91d765..9b3a0b9d0 100644 --- a/ansible/post-deploy.yml +++ b/ansible/post-deploy.yml @@ -32,6 +32,15 @@ group: "{{ ansible_facts.user_gid }}" mode: 0600 + - name: Template out admin-openrc-system.sh + become: true + template: + src: "roles/common/templates/admin-openrc-system.sh.j2" + dest: "{{ node_config }}/admin-openrc-system.sh" + owner: "{{ ansible_facts.user_uid }}" + group: "{{ ansible_facts.user_gid }}" + mode: 0600 + - name: Template out public-openrc.sh become: true template: |