diff options
| author | Niklas Hagman <ubuntu@post.blinkiz.com> | 2019-11-19 15:42:46 +0100 |
|---|---|---|
| committer | headphonejames <generalfuzz@gmail.com> | 2021-09-28 09:45:06 -0700 |
| commit | 2e933dceb591c3505f35c2c1de924f3978fb81a7 (patch) | |
| tree | 922665499c6f80f0bec1f51fe87d16ef023206d5 /tools | |
| parent | 3455105321ba2e117ed3d2dbd2d5a47194cc1603 (diff) | |
| download | kolla-ansible-2e933dceb591c3505f35c2c1de924f3978fb81a7.tar.gz kolla-ansible-2e933dceb591c3505f35c2c1de924f3978fb81a7.zip | |
Transition Keystone admin user to system scope
A system-scoped token implies the user has authorization to act on the
deployment system. These tokens are useful for interacting with
resources that affect the deployment as a whole, or exposes resources
that may otherwise violate project or domain isolation.
Since Queens, the keystone-manage bootstrap command assigns the admin
role to the admin user with system scope, as well as in the admin
project. This patch transitions the Keystone admin user from
authenticating using project scoped tokens to system scoped tokens.
This is a necessary step towards being able to enable the updated oslo
policies in services that allow finer grained access to system-level
resources and APIs.
An etherpad with discussion about the transition to the new oslo
service policies is:
https://etherpad.opendev.org/p/enabling-system-scope-in-kolla-ansible
Change-Id: Ib631e2211682862296cce9ea179f2661c90fa585
Signed-off-by: Niklas Hagman <ubuntu@post.blinkiz.com>
Diffstat (limited to 'tools')
| -rwxr-xr-x | tools/init-runonce | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/tools/init-runonce b/tools/init-runonce index b4b873991..f8d7b1c17 100755 --- a/tools/init-runonce +++ b/tools/init-runonce @@ -95,7 +95,6 @@ if [[ $ENABLE_EXT_NET -eq 1 ]]; then fi # Get admin user and tenant IDs -ADMIN_USER_ID=$($KOLLA_OPENSTACK_COMMAND user list | awk '/ admin / {print $2}') ADMIN_PROJECT_ID=$($KOLLA_OPENSTACK_COMMAND project list | awk '/ admin / {print $2}') ADMIN_SEC_GROUP=$($KOLLA_OPENSTACK_COMMAND security group list --project ${ADMIN_PROJECT_ID} | awk '/ default / {print $2}') |