With policy-in-code, policy files should be minimal (changes only) and in YAML

[Alex Kavanagh]

Since the queens release, policy-in-code has been spreading through the OpenStack API services.

What this means is that the default policies that the service uses are 'encoded' in a Python file, and don't need to be declared in a YAML policy file.

The preferred format for policy files is now YAML, and not JSON (which is currently used in the charms).

So the steps for each linked service that has a policy.json file as a template is to:

1. Check that the service does 'policy-in-code'
2. Generate a default policy.yaml file (for comparison purposes - oslo.config provides a command to do this).
3. Convert the charm's template policy json into yaml
4. remove all of the options that are default.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-keystone/+/848145

[Tianqi Xiao (txiao)]

I would like to bring some attention to this bug report since it has been inactive for a long time and still affects the current releases. For charm-keystone at least, newer releases (starting from Stein) are still rendering policy file from the policy.json template of older releases (Rocky). This generated policy file is very out of date comparing to the upstream [1].

[1]: https://docs.openstack.org/keystone/latest/configuration/samples/policy-yaml.html