keystone_authtoken: service_type needs to be configured for working access rules

[Marcus Klein]

Otherwise the services can not verify the access rule for application credentials and the following warning is logged:

Oct 21 13:38:58 controller1-nova-api-container-83b33d79 nova-api-wsgi[29012]: 2021-10-21 13:38:58.060 29012 WARNING keystonemiddleware.auth_token [req-17e24efd-9276-4fdb-ac0f-ff49c5808c3b 857436753f545e4f498149602b86484ab34d6c96e5085aaf18ede66f9f3f28c1 2a4a15d2596440e2ba553ce96cddc986 - d2844186365e40d187e33cbc3ead8956 d2844186365e40d187e33cbc3ead8956] Cannot validate request with restricted access rules. Set service_type in [keystone_authtoken] to allow access rule validation.

[Marcus Klein (marcus-klein)]

I will try to provide patches to get this fixed.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/823009

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible-os_placement/+/845708

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/845717

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/845717
Committed: https://opendev.org/openstack/openstack-ansible-os_cinder/commit/f755eadadfddfbea471fe80df66b41f140d9db2e
Submitter: "Zuul (22348)"
Branch: master

commit f755eadadfddfbea471fe80df66b41f140d9db2e
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue Jun 14 11:30:31 2022 +0200

    Support service tokens

    Implement support for service_tokens. For that we convert
    role_name to be a list along with renaming corresponding variable.

    Additionally service_type is defined now for keystone_authtoken which
    enables to validate tokens with restricted access rules

    Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
    Change-Id: I1d0156a2ad829aa730419e1d9dfa1cd49026a6be
    Related-Bug: #1948456

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/823009
Committed: https://opendev.org/openstack/openstack-ansible-os_glance/commit/fc6f34219426594c7c48229e2fe8fdd76511d7cd
Submitter: "Zuul (22348)"
Branch: master

commit fc6f34219426594c7c48229e2fe8fdd76511d7cd
Author: Dmitriy Rabotyagov <email address hidden>
Date: Mon Dec 27 15:05:45 2021 +0200

    Support service tokens

    Implement support for service_tokens. For that we convert
    role_name to be a list along with renaming corresponding variable.

    Additionally service_type is defined now for keystone_authtoken which
    enables to validate tokens with restricted access rules

    Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
    Change-Id: Ib7fd1a80affe0fa8c6b030fdbfdd60693f104cd6
    Related-Bug: #1948456

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-os_placement/+/845708
Committed: https://opendev.org/openstack/openstack-ansible-os_placement/commit/242e17c230651ce4718d839b5d77590a296469a3
Submitter: "Zuul (22348)"
Branch: master

commit 242e17c230651ce4718d839b5d77590a296469a3
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue Jun 14 10:58:05 2022 +0200

    Support service tokens

    Implement support for service_tokens. For that we convert
    role_name to be a list along with renaming corresponding variable.

    Additionally service_type is defined now for keystone_authtoken which
    enables to validate tokens with restricted access rules

    Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/845690
    Change-Id: I4e9fff59bbfa9c8a1ae0236d077ac9ee2881c04b
    Related-Bug: #1948456