System role assignments exist after removing groups

[Lance Bragstad]

Keystone cleans up role assignments a group has on projects and domains when deleting the group. This isn't true for system role assignments. Instead, they are left after the group is deleted. I recreate the issue by doing the following with a basic devstack install:

$ openstack group create testers
$ openstack role add --group testers --system all admin
$ openstack role assignment list --names (testers will have an assignment on the system)
$ openstack group delete testers
$ openstack role assignment list --names (an empty group assignment will exist on the system)

Paste recreating the issue [0].

[0] http://paste.openstack.org/raw/671041/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/544073

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/544074

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/544100

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/544101

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/544073
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3fa997531f757a832aab209d585bb98503e72cc2
Submitter: Zuul
Branch: master

commit 3fa997531f757a832aab209d585bb98503e72cc2
Author: Lance Bragstad <email address hidden>
Date: Tue Feb 13 20:37:03 2018 +0000

    Expose bug in system assignment when deleting groups

    Project and domain role assignment are cleaned up when deleting
    groups. This commit introduces a test case that shows this isn't the
    case for system role assignments. A subsequent patch will implement
    a fix to make sure system role assignments are removed when groups
    are deleted, to be consistent with project and domain assignments.

    Change-Id: I9b452aff144fd8867cdac2f44cbcaa0d1de63a12
    Partial-Bug: 1749267

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/544074
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5a24b96d951537fb12deb7050eb2e7dd7d40fc81
Submitter: Zuul
Branch: master

commit 5a24b96d951537fb12deb7050eb2e7dd7d40fc81
Author: Lance Bragstad <email address hidden>
Date: Tue Feb 13 20:47:54 2018 +0000

    Delete system role assignments when deleting groups

    Keystone removes role assignments that groups have on projects and
    domains when deleting groups. This should apply to system role
    assignments, too.

    Change-Id: Iebedfcae0b77e350e5359b97fa87894af3f1c8ba
    Closes-Bug: 1749267

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/544100
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=89152d73ac167b71b11617bcf946c99c38956184
Submitter: Zuul
Branch: stable/queens

commit 89152d73ac167b71b11617bcf946c99c38956184
Author: Lance Bragstad <email address hidden>
Date: Tue Feb 13 20:37:03 2018 +0000

    Expose bug in system assignment when deleting groups

    Project and domain role assignment are cleaned up when deleting
    groups. This commit introduces a test case that shows this isn't the
    case for system role assignments. A subsequent patch will implement
    a fix to make sure system role assignments are removed when groups
    are deleted, to be consistent with project and domain assignments.

    Change-Id: I9b452aff144fd8867cdac2f44cbcaa0d1de63a12
    Partial-Bug: 1749267
    (cherry picked from commit 3fa997531f757a832aab209d585bb98503e72cc2)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/544101
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=8646f40a4080eddb5f9cc58df2ce478ccfd38a77
Submitter: Zuul
Branch: stable/queens

commit 8646f40a4080eddb5f9cc58df2ce478ccfd38a77
Author: Lance Bragstad <email address hidden>
Date: Tue Feb 13 20:47:54 2018 +0000

    Delete system role assignments when deleting groups

    Keystone removes role assignments that groups have on projects and
    domains when deleting groups. This should apply to system role
    assignments, too.

    Change-Id: Iebedfcae0b77e350e5359b97fa87894af3f1c8ba
    Closes-Bug: 1749267
    (cherry picked from commit 5a24b96d951537fb12deb7050eb2e7dd7d40fc81)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 13.0.0.0rc2 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 14.0.0.0b1 development milestone.