Horizon default policy files not found in ubuntu binary wallaby

[Wenjun Wang]

**Bug Report**
What happened:
  error logs in the horizon log reported by the oslo-policy module,

==> /var/log/kolla/horizon/horizon.log <==
[Fri May 28 13:07:42.174630 2021] [wsgi:error] Failed to open the policy file for identity /etc/opes/keystone.yami: [Errno 2] No such file or directory

the similar logs repeate for cinder.yaml, nova.yaml, glance.yaml, heat.yaml.

This will cause the user can see the admin panels even though they do not have admin role.

What you expected to happen:
  No error logs in the horizon log files, and the member can not see the admin dashboard after the deployment.

How to reproduce it:
1. change the main configs in globals.yaml as followed:
kolla_base_distro: "ubuntu"
kolla_install_type: "binary"
openstack_release: "wallaby"
2. kolla-ansible -i all-in-one deploy
3. login the dashboard with admin credentails
4. create a new project test
5. create a new user tester
6. assign the member role for tester to the test project
7. login the dashboard with the tester credentails

**Environment**:
* OS: Ubuntu 20.04
* Kernel: 5.4.0-73
* Docker version: 20.10.2
* Kolla-Ansible version: 12.0.0.0rc1
* Docker image Install type: binary
* Docker image distribution: ubuntu
* Are you using official images from Docker Hub or self built? official images
* Share your inventory file, globals.yml and other configuration files if relevant
kolla_base_distro: "ubuntu"
kolla_install_type: "binary"
openstack_release: "wallaby"

I solved this problem by manually copying the default policy.

# enter the horizon container
docker exec -it horizon bash
# copy the default policy files in the horizon container
cp -r /usr/share/openstack-dashboard/openstack_dashboard/conf/default_policies/ /etc/openstack-dashboard/
# exit the container
exit
# restart the horizon container to apply the changes
docker restart horizon

[Mark Goddard (mgoddard)]

Possibly due to the switch from JSON to YAML for policy files? I wonder if it affects other type/distro combinations.

[Buddhika Sanjeewa (bsanjeewa)]

Please forgive if this is a dumb question.

Is this a typo or the file extension is really yami?
/etc/opes/keystone.yami

[Mark Goddard (mgoddard)]

Fixed in master & stable/wallaby: https://review.opendev.org/q/I3c6fdcb9b7dd7443a7755599f7e4ee59f67e0a91

[Mark Goddard (mgoddard)]

@Buddhika: I think the filename has been mangled.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 12.0.0.0rc2 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 13.0.0.0rc1 release candidate.