Missing configuration for application access rules

[Will Szumski]

Release: Wallaby, but I think this affects master.

Steps to reproduce:

- Create an application cred with the following rules

  [
    {
        "path": "/v2.1/**",
        "method": "GET",
        "service": "compute"
    },
    {
        "path": "/**",
        "method": "GET",
        "service": "network"
    }
  ]

- Try and use the application credential to do an openstack server list
- Observe that the request is refused with status 401

Looking in the logs, I saw:

    Cannot validate request with restricted access rules. Set service_type in [keystone_authtoken] to allow access rule validation.

I believe we need to add the equivalent of:

  [keystone_authtoken]
  service_type = compute

to every service, where this particular example is for nova.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/834035

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/834035
Committed: https://opendev.org/openstack/kolla-ansible/commit/49006e56d99199b696bd762eb3167dbba42237e1
Submitter: "Zuul (22348)"
Branch: master

commit 49006e56d99199b696bd762eb3167dbba42237e1
Author: Will Szumski <email address hidden>
Date: Wed Mar 16 15:12:30 2022 +0000

    Add keystone_authtoken.service_type

    Fixes an issue where access rules failed to validate:

        Cannot validate request with restricted access rules. Set
        service_type in [keystone_authtoken] to allow access rule validation

    I've used the values from the endpoint. This was mostly a straight
    forward copy and paste, except:

    - versioned endpoints e.g cinderv3 where I stripped the version
    - monasca has multiple endpoints associated with a single service. For
      this, I concatenated logging and monitoring to be logging-monitoring.

    Closes-Bug: #1965111
    Change-Id: Ic4b3ab60abad8c3dd96cd4923a67f2a8f9d195d7

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 15.0.0.0rc1 release candidate.

[Maksim Malchuk (mmalchuk)]

should this backported till wallaby?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/886359

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/886360

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/886361

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 14.9.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible wallaby-eol release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible xena-eol release.