[RFE] Add charm option for enforce_new_defaults and enforce_scope

[Peter Jose De Sousa]

Hi,

When testing user access on openstack the users are able to create objects outside of their given access scopes. For example: Reader roles can create objects inside of projects. There is an upstream keystone issue for this: https://bugs.launchpad.net/keystone/+bug/1915193.

In that bug https://bugs.launchpad.net/keystone/+bug/1915193/comments/3 points to a enforce_new_defaults config value which is availabe in nova https://docs.openstack.org/nova/latest/configuration/sample-config.html.

Currently the nova-compute charm does not enable this configuration value, and the issue is present, please see the test run at: https://private-fileshare.canonical.com/~pjds/nova-compute-kvm-tests/results.txt the script to run these tests can be found at: https://private-fileshare.canonical.com/~pjds/nova-compute-kvm-tests/run_rbac_openstack_tests.sh

[Edit]

With some further testing, the enforce_new_defaults will not work without the enforce_scope option.

Thanks,

Peter

https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_new_defaults

[Alex Kavanagh (ajkavanagh)]

Note that this option was available from ussuri (but may have had issues associated with it). Need a discussion on which version(s) it should be made available for.

[Peter Jose De Sousa (pjds)]

from testing, the enforce_new_defaults will not work unless enforce_scope is enabled too. Updating the description.

[Nobuto Murata (nobuto)]

When I was looking into Octavia doc for something else, I found the following statement.

https://docs.openstack.org/octavia/latest/configuration/policy.html#oslo-policy-enforce-scope
> The Octavia API supports enforcing the Keystone token scopes as of the Wallaby release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/851841

[Nobuto Murata (nobuto)]

This shouldn't be considered good-first-bug IMO since it requires wider testing coverage etc instead of just modifying one charm.

[Billy Olsen (billy-olsen)]

100% agree with Nobuto that this is not a good first bug, it requires looking at the larger picture.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Muhammad Ahmad <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/851841
Reason: Abandoning due to the need for further analysis as per comments.