Designate does not allow a zone to be shared across domains and projects

[Pedro Guimarães]

Openstack: xenial-queens

I need to share a single zone across multiple projects and domains.
When working on a multi-domain scheme, domain A cannot create/delete/update zones from domain B and vice-versa.

[David Ames (thedac)]

We will need to check policy.json with users in two different domains:

Create auth_v3_token_admin.json based on https://github.com/openstack/oslo.policy/blob/master/sample_data/auth_v3_token_admin.json.

Generate the policy file from defaults in code:
oslopolicy-policy-generator --config-dir /etc/designate/ --output-file policy.json --namespace designate
Check what passes and what does not.
oslopolicy-checker --access ./auth_v3_token_admin.json --policy ./policy.json

[Alex Kavanagh (ajkavanagh)]

This is probably better done (now) with the policy.d overrides options in the designate charm. Note that they are in a 'preview' state (on designate) as the functional tests haven't been done as designate charm tests have not yet been migrated to zaza: https://bugs.launchpad.net/charm-designate/+bug/1845639