Remove obsolete service policies from policy.v3cloudsample.json
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | OpenStack Identity (keystone) |
Medium
|
Lance Bragstad | ||
Bug Description
Once support for scope types landed in the service API policies, the policies in policy.
We should add formal protection for the policies with enforce_scope = True in keystone.
This will reduce confusion by having a true default policy for services.
[0] https:/
[1] http://
| tags: | added: policy |
| Changed in keystone: | |
| importance: | Undecided → Medium |
| status: | New → Triaged |
| OpenStack Infra (hudson-openstack) wrote : | #2 |
Related fix proposed to branch: master
Review: https:/
| OpenStack Infra (hudson-openstack) wrote : | #3 |
Related fix proposed to branch: master
Review: https:/
| OpenStack Infra (hudson-openstack) wrote : | #4 |
Related fix proposed to branch: master
Review: https:/
| OpenStack Infra (hudson-openstack) wrote : | #5 |
Related fix proposed to branch: master
Review: https:/
| Changed in keystone: | |
| assignee: | nobody → Lance Bragstad (lbragstad) |
| status: | Triaged → In Progress |
Fix proposed to branch: master
Review: https:/
Related fix proposed to branch: master
Review: https:/
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit ae926e67185e228
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 21 14:45:49 2018 +0000
Update service policies for system reader
The service policies were not taking the default roles work we did
last release into account. This commit changes the default policies
to rely on the ``reader`` role for get and list services. Subsequent
patches will incorporate:
- system member test coverage
- system admin functionality
- domain user test coverage
- project user test coverage
Change-Id: I5f4de1358de2e0
Related-Bug: 1804462
Related-Bug: 1804463
| OpenStack Infra (hudson-openstack) wrote : | #9 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 94d02c22ee07b2a
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 21 14:57:18 2018 +0000
Add service tests for system member role
From keystone-
effectively the same, isolating writeable service operations to the
``admin`` role.
This commit adds explicit testing to make sure the ``member`` role
is allowed to perform readable and not writable service operations.
Subsequent patches will incorporate:
- system admin functionality
- testing for domain users
- testing for project users
Change-Id: Ia75d792a497b2f
Related-Bug: 1804462
Related-Bug: 1804463
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit f377351ac89f674
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 21 15:15:11 2018 +0000
Update service policies for system admin
The service policies were not taking the default roles work we did
last release into account. This commit changes the default policies
to rely on the ``admin`` role to create and delete services.
Subsequent patches will incorporate:
- domain user test coverage
- project user test coverage
Change-Id: I58bbe6848c9e8e
Related-Bug: 1804462
Closes-Bug: 1804463
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 875ecfb56fe2c04
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 21 15:31:45 2018 +0000
Add tests for domain users interacting with services
This commit introduces some tests that show how domain users are
expected to behave with the services API. A subsequent patch will do
the same for project users.
Change-Id: I87d2229010cb84
Related-Bug: 1804462
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 537c6769ebe10d6
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 28 15:04:42 2018 +0000
Add tests for project users interacting with services
This commit introduces some tests that show how project users
are expected to behave with the services API. A subsequent patch
will clean up the new obsolete policies in the
policy.
Change-Id: Ib05e5bf96c992a
Related-Bug: 1804462
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit c83fcbc42aac247
Author: Lance Bragstad <email address hidden>
Date: Wed Nov 21 15:45:50 2018 +0000
Remove service policies from policy.
By incorporating system-scope and default roles, we've effectively
made these policies obsolete. We can simplify what we maintain and
provide a more consistent, unified view of default service behavior by
removing them.
Change-Id: Ifa2282481ee3fc
Closes-Bug: 1804462
| Changed in keystone: | |
| status: | In Progress → Fix Released |
| Changed in keystone: | |
| milestone: | none → stein-3 |
This issue was fixed in the openstack/keystone 15.0.0.0rc1 release candidate.
Related fix proposed to branch: master
Review: https:/