Create Role button is not visible for default admin user

[Danny Cocks]

When I navigate to the Identity->Roles page as the admin user, I see a list of the roles in the cluster, but no buttons to create/modify/delete the roles.

I am using a charmed install of a Yoga cluster, and the default admin user (username: admin, domain: admin_domain, default keystone policies and default horizon policies, that is no overrides). I can create/modify/delete roles from the CLI.

I thought this might have been a subtlety of the policy rules, so I tested including some Horizon policy overrides, which open up the policies to any user (setting every policy listed in the keystone/identity folders to "@"). This didn't change anything. To verify I was setting the policies correctly, I tested "identity:create_user": "!" and the "Create User" button disappeared in Horizon.

This bug seems similar to [1] however I am using the default admin "power user" instead of adding domain roles.

[1] https://bugs.launchpad.net/horizon/+bug/1775227

[Billy Olsen (billy-olsen)]

Mistakenly marked openstack dashboard as not affected. Needs to be further analyzed. The charm is configuring the backend settings to allow for role edits, but needs further analysis.

[Rodrigo Barbieri (rodrigo-barbieri2010)]

I just tested this deploying devstack noble-dalmatian and I can see the create role button there. Deploying noble-dalmatian through the charms however doesn't show the button

[Rodrigo Barbieri (rodrigo-barbieri2010)]

I figured out what the problem is. Comparing to devstack, I can see the request to /dashboard/api/settings by pressing F12 in Firefox. This request returns various settings that the frontend uses. Among them, should be OPENSTACK_KEYSTONE_BACKEND containing the key can_edit_role. In Devstack it returns the setting and configured to true, and it works, and in charmed horizon, it doesn't return that setting, despite being configured in the /etc/openstack-dashboard/local_settings.py:

OPENSTACK_KEYSTONE_BACKEND = {
    'name': 'native',
    'can_edit_user': True,
    'can_edit_group': True,
    'can_edit_project': True,
    'can_edit_domain': True,
    'can_edit_role': True,
}

Now I just need to figure out why it is not picking that up from the config file.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946246

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946247

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946248

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2024.1
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946249

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946251

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946246
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/57ffb4384c4810077a8e241f1f77bbf1fc0b261c
Submitter: "Zuul (22348)"
Branch: master

commit 57ffb4384c4810077a8e241f1f77bbf1fc0b261c
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:10:24 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946249
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/74c21937ef3f4e4c11fc2dbaf661c5f91823a040
Submitter: "Zuul (22348)"
Branch: stable/2024.1

commit 74c21937ef3f4e4c11fc2dbaf661c5f91823a040
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:10:24 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55
    (cherry picked from commit 57ffb4384c4810077a8e241f1f77bbf1fc0b261c)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946250
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/22727f42f08c892bbf34b305259e4e8a6130bdf8
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit 22727f42f08c892bbf34b305259e4e8a6130bdf8
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:10:24 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55
    (cherry picked from commit 74c21937ef3f4e4c11fc2dbaf661c5f91823a040)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946251
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/2f52ca285b9bda33376008e05c118808175a4ead
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 2f52ca285b9bda33376008e05c118808175a4ead
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:19:03 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946247
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/35cce5d001b12ef5b2be7643b029a9a431954721
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 35cce5d001b12ef5b2be7643b029a9a431954721
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:19:03 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55
    (cherry picked from commit 2f52ca285b9bda33376008e05c118808175a4ead)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/946248
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/b467039d1035562b955a37c45f0f03a2d2080857
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit b467039d1035562b955a37c45f0f03a2d2080857
Author: Rodrigo Barbieri <email address hidden>
Date: Thu Apr 3 10:20:42 2025 -0300

    Fix missing create/delete role buttons

    The frontend create/delete role buttons on
    Identity>Roles page rely on a backend config
    OPENSTACK_KEYSTONE_BACKEND that is defined in
    the config file. However, the setting is not being
    returned to the frontend because there is another
    setting called REST_API_REQUIRED_SETTINGS that lists
    the settings that are returned to the frontend.

    This patch adds OPENSTACK_KEYSTONE_BACKEND to
    REST_API_REQUIRED_SETTINGS which was also done upstream
    on commit 9c19b07 back in 2019.

    Closes-bug: #2056377
    Change-Id: Ia8a18e66610f7149399fe1614b1e515ecf799f55

[Danny Cocks (dannycocks)]

Fantastic! Thanks Rodrigo and all!