policy.v3cloudsample.json contains redundant policies

Bug #1806762 reported by Lance Bragstad on 2018-12-04
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Medium
Lance Bragstad

Bug Description

The policy.v3cloudsample.json policy file contains a bunch of redundant policies. This is because when it was created to try and solve the admin-ness problem [0], policies were not in code and didn't have defaults. This meant that we needed to define every policy in the policy.v3cloudsample.json even if it had the same value as the default policies.

Ultimately, the policy.v3cloudsample.json policy file should be removed because it is obsolete with the advent of system-scope [0] and default roles [1].

[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html
[1] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html

tags: added: policy
Changed in keystone:
status: New → Triaged
importance: Undecided → Medium

Fix proposed to branch: master
Review: https://review.openstack.org/622589

Changed in keystone:
assignee: nobody → Lance Bragstad (lbragstad)
status: Triaged → In Progress

Related fix proposed to branch: master
Review: https://review.openstack.org/623323

Related fix proposed to branch: master
Review: https://review.openstack.org/624215

Related fix proposed to branch: master
Review: https://review.openstack.org/624216

Related fix proposed to branch: master
Review: https://review.openstack.org/624217

Related fix proposed to branch: master
Review: https://review.openstack.org/624218

Related fix proposed to branch: master
Review: https://review.openstack.org/624219

Related fix proposed to branch: master
Review: https://review.openstack.org/624220

Related fix proposed to branch: master
Review: https://review.openstack.org/624222

Related fix proposed to branch: master
Review: https://review.openstack.org/625352

Related fix proposed to branch: master
Review: https://review.openstack.org/625353

Related fix proposed to branch: master
Review: https://review.openstack.org/625354

Related fix proposed to branch: master
Review: https://review.openstack.org/625355

Related fix proposed to branch: master
Review: https://review.openstack.org/625356

Related fix proposed to branch: master
Review: https://review.openstack.org/625357

Reviewed: https://review.openstack.org/624215
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=b35928d5dcd8615d11c199c68c512aaa1dca4ec9
Submitter: Zuul
Branch: master

commit b35928d5dcd8615d11c199c68c512aaa1dca4ec9
Author: Lance Bragstad <email address hidden>
Date: Mon Dec 10 18:18:42 2018 +0000

    Implement system reader role for projects

    This commit introduces the system reader role to the project API, making
    it easier for administrators to delegate subsets of responsibilities
    to the API by default.

    Subsequent patches will incorporate:

      - system member test coverage
      - system admin functionality
      - domain reader functionality
      - domain member test coverage
      - domain admin functionality
      - project user test coverage

    Change-Id: I089ada1e314688e60f9041095138bc53cd465fa0
    Related-Bug: 1805403
    Related-Bug: 1750660
    Related-Bug: 1806762

Reviewed: https://review.openstack.org/624216
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=6037ac58de0fe599df9220a068e1ef054194187a
Submitter: Zuul
Branch: master

commit 6037ac58de0fe599df9220a068e1ef054194187a
Author: Lance Bragstad <email address hidden>
Date: Mon Dec 10 18:45:25 2018 +0000

    Implement system member role project test coverage

    This commit introduces explicit test coverage for system members,
    making sure they are allowed to do readable and not writable project
    operations.

    Subsequent patches will incorporate:

      - system admin functionality
      - domain reader functionality
      - domain member test coverage
      - domain admin functionality
      - project user test coverage

    Change-Id: I69ff308ea528d54e0db8e475d047e3dbf356ed2f
    Related-Bug: 1805403
    Related-Bug: 1750660
    Related-Bug: 1806762

Reviewed: https://review.openstack.org/624217
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=718d122fe1595d59b4eab99c3a744bfe34941369
Submitter: Zuul
Branch: master

commit 718d122fe1595d59b4eab99c3a744bfe34941369
Author: Lance Bragstad <email address hidden>
Date: Mon Jan 7 20:48:11 2019 +0000

    Implement system admin role in project API

    This commit introduces the system admin role to the projects API,
    making it consistent with other system-admin policy definitions.

    Subsequent patches will build on this work to expose more
    functionality to domain users:

     - domain reader functionality
     - domain member test coverage
     - domain admin functionality
     - project user test coverage

    Change-Id: Iceed65d34a8a7cff8841000d7703b1a48e95bb24
    Closes-Bug: 1805403
    Related-Bug: 1750660
    Related-Bug: 1806762

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers