Remove obsolete role policies from policy.v3cloudsample.json

[Lance Bragstad]

Once support for scope types landed in the role API policies, the policies in policy.v3cloudsample.json became obsolete [0][1].

We should add formal protection for the policies with enforce_scope = True in keystone.tests.unit.protection.v3 and remove the old policies from the v3 sample policy file.

This will reduce confusion by having a true default policy for limits and registered limits.

[0] https://review.openstack.org/#/c/526171/
[1] http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json?id=fb73912d87b61c419a86c0a9415ebdcf1e186927#n91

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/622524

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/622525

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/622526

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/622527

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/622528

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/622529

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622524
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=567f305b41414f1468147e5eba903871bfbe7392
Submitter: Zuul
Branch: master

commit 567f305b41414f1468147e5eba903871bfbe7392
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 15:45:42 2018 +0000

    Update role policies for system reader

    The role policies were not taking the default roles work we did last
    release into account. This commit changes the default policies to rely
    on the ``reader`` role for getting and listing roles. Subsequent
    patches will incorporate:

     - system member test coverage
     - system admin functionality
     - domain user test coverage
     - project user test coverage

    Change-Id: I3e373c437ff0ffddba10bde59fd7f18f8be6498c
    Related-Bug: 1805402
    Related-Bug: 1806713

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622525
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=dd9d06c6379d1f9cb046ae49406330a31bb63a09
Submitter: Zuul
Branch: master

commit dd9d06c6379d1f9cb046ae49406330a31bb63a09
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 15:50:41 2018 +0000

    Add role tests for system member role

    From keystone's perspective, the ``member`` and ``reader`` roles are
    effectively the same, isolating writable role operations to the
    ``admin`` role.

    This commit adds explicit testing to make sure the ``member`` role is
    allowed to perform readable and not writable role operations.
    Subsequent patches will incorporate:

     - system admin functionality
     - domain user test coverage
     - project user test coverage

    Change-Id: I2bc3b65b6ef16adaa95e6299ac205b26797f7185
    Related-Bug: 1805402
    Related-Bug: 1806713

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622526
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=2ca4836a956b2d81728447d44efdff96e2ec39df
Submitter: Zuul
Branch: master

commit 2ca4836a956b2d81728447d44efdff96e2ec39df
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 18:07:07 2018 +0000

    Update role policies for system admin

    This change makes the policy definitions for admin role operations
    consistent with other role policies. Subsequent patches will
    incorporate:

     - domain user test coverage
     - project user test coverage

    Change-Id: I35a2af10d47e000ee6257ce16c52c7e49a62b033
    Related-Bug: 1806713
    Closes-Bug: 1805402

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622527
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=31eecfb2a42e44899ea2f72866be33cc7700db65
Submitter: Zuul
Branch: master

commit 31eecfb2a42e44899ea2f72866be33cc7700db65
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 18:16:34 2018 +0000

    Add tests for domain users interacting with roles

    This commit adds explicit tests that show how domain users
    are expected to behave with global roles. A subsequent patch
    will do the same for project users.

    Note that these changes are slightly different from the
    policy.v3cloudsample.json role policies. In policy.v3cloudsample.json,
    domain users were allowed to get and list global roles. So were
    project users. This behavior is changing because global roles are
    considered global resources of the deployment, and they should be
    managed by system users. Domain users should be able to add and remove
    domain specific roles, which will come in a subsequent series of
    patches. This approach is being taken because it is a safer default
    for a system level resource (roles) and still allows the same
    functionality for domain users through domain-specific roles.

    Change-Id: Ia1a7adf4431042ecea1b41e3c589c55112183ab5
    Partial-Bug: 1806713
    Partial-Bug: 1805400

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622528
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=512f0b4f7bb369bf4287d76a80e3bafd0cd0e0e2
Submitter: Zuul
Branch: master

commit 512f0b4f7bb369bf4287d76a80e3bafd0cd0e0e2
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 18:18:35 2018 +0000

    Add tests for project users interacting with roles

    This commit introduces test coverage that explicitly shows how
    project users are expected to behave global role resources. A
    subsequent patch will clean up the now obsolete policies in the
    policy.v3cloudsample.json policy file.

    Change-Id: Id0dc3022ab294e73aeaa87e130bea4809f8c982b
    Partial-Bug: 1806713

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/622529
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=6d756ad61247828319b184b6894fe8cabd7a5968
Submitter: Zuul
Branch: master

commit 6d756ad61247828319b184b6894fe8cabd7a5968
Author: Lance Bragstad <email address hidden>
Date: Tue Dec 4 18:23:36 2018 +0000

    Remove role policies from policy.v3cloudsample.json

    By incorporating system-scope and default roles, we've effectively
    made these policies obsolete. We can simplify what we maintain and
    provide a more consistent, unified view of default role behavior by
    removing them.

    Note that these changes are slightly different from the
    policy.v3cloudsample.json role policies, hence the removed tests. In
    policy.v3cloudsample.json, domain users were allowed to get and list
    global roles. So were project users. This behavior is changing because
    global roles are considered global resources of the deployment, and
    they should be managed by system users. Domain users should be able to
    add and remove domain specific roles, which will come in a subsequent
    series of patches. This approach is being taken because it is a safer
    default for a system level resource (global roles) and still allows
    the same functionality for domain users through domain-specific roles.

    Change-Id: Iddaa59024a1dcefd4d791b95413602865888c1ff
    Closes-Bug: 1806713

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 15.0.0.0rc1 release candidate.