User with reader role has same permissions as with member role

[Tomas Stodulka]

Default role reader doesn't meet its expectations from https://docs.openstack.org/keystone/ussuri/admin/service-api-protection.html , For example: "users with reader on a project could list instance, users with member on a project can list and create instances".

Actual results:
In my case, reader can create/delete instances or also routers, networks,...

Expected results:
 Users with reader role should only list the mentioned resources and don't touch the virtual infrastructure.

Environment:
 Centos 8.2.2004
 OpenStack release: Ussuri, deployed using kolla-ansible

Is there anything additional, that needs to be done for setup reader role? My policies of Keystone and Neutron are attached.

[Margarita Shakhova (shakhova-margarita)]

You need to provide configuration parameters, for example, in case of nova it should be [oslo_policy] enforce_new_defaults = True