Consider making ADMIN_DOMAIN and ADMIN_PROJECT configurable instead of having hard-coded constants

[Dmitrii Shcherbakov]

Currently admin domain and project values are hard-coded in the keystone charm.

https://github.com/openstack/charm-keystone/blob/stable/18.11/hooks/keystone_utils.py#L212-L213
ADMIN_DOMAIN = 'admin_domain'
ADMIN_PROJECT = 'admin'

https://github.com/openstack/charm-keystone/blob/stable/18.11/templates/ocata/keystone.conf#L117-L119
{% if api_version == 3 -%}
[resource]
admin_project_domain_name = {{ admin_domain_name }}
admin_project_name = admin

They are used to set the following two keystone options:
https://github.com/openstack/keystone/blob/stable/queens/keystone/conf/resource.py#L59-L78
admin_project_domain_name = cfg.StrOpt(
admin_project_name = cfg.StrOpt(

It would be good to have those configurable as some 3-rd party integrated products have different expectations about these. Fixing 3-rd party products to support configurable values is the right approach but it is not always possible to do due to different non-technical reasons.

[Ryan Beisner (1chb1n)]

This bug reads like a nice-to-have feature request.

The changes required to address this are non-trivial and expose a potentially dangerous configuration option.

The effort of implementation could be quite high, especially in ensuring cloud sanity in the case that these values are changed post-deployment on a running cloud with established workloads.

If this bug has more context to drive a higher level of importance than 'wishlist,' please clarify. Thank you.

[Xav Paice (xavpaice)]

I really think this needs to be parked until https://bugs.launchpad.net/keystone/+bug/968696 is resolved.

[Dmitrii Shcherbakov (dmitriis)]

I agree, the third-party product mentioned in the issue description was Contrail with RBAC enabled.

We no longer have this problem with newer Contrail versions as far as I am aware.