Containers: Unable to list all heat stacks as admin

[Yang Liu]

Brief Description
-----------------
Run "openstack stack list --a" as admin is rejected.

Severity
--------
Minor

Steps to Reproduce
------------------
source /etc/nova/openrc
openstack --os-auth-url http://keystone.openstack.svc.cluster.local/v3 stack list --a
ERROR: You are not authorized to use stacks:global_index.

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Any

Branch/Pull Time/Commit
-----------------------
master as of 2019-01-29_20-18-01

Timestamp/Logs
--------------
[wrsroot@controller-1 ~(keystone_admin)]$ helm get osh-openstack-heat | grep global_index
    software_configs:global_index: rule:deny_everybody
    stacks:global_index: rule:deny_everybody

[Ghada Khalil (gkhalil)]

Marking as release gating; related to the containers feature

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: f/stein
Review: https://review.openstack.org/635309

[Al Bailey (albailey1974)]

Review:
https://review.openstack.org/#/c/635309/

Does not show the error:
source /etc/nova/openrc
[wrsroot@controller-0 ~(keystone_admin)]$ openstack --os-auth-url http://keystone.openstack.svc.cluster.local/v3 stack list

 helm get osh-openstack-heat | grep global_index
  policy: {'software_configs:global_index': 'rule:context_is_admin', 'stacks:global_index': 'rule:context_is_admin'}
    software_configs:global_index: rule:context_is_admin
    stacks:global_index: rule:context_is_admin

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/635309
Committed: https://git.openstack.org/cgit/openstack/stx-config/commit/?id=6027b65d66bccfb64d2321469f5131b6a7f40abb
Submitter: Zuul
Branch: f/stein

commit 6027b65d66bccfb64d2321469f5131b6a7f40abb
Author: Al Bailey <email address hidden>
Date: Wed Feb 6 14:54:55 2019 -0600

    Fix the global_index policy settings for containerized heat

    Sets the following in the armada manifest

        software_configs:global_index: rule:context_is_admin
        stacks:global_index: rule:context_is_admin

    Closes-Bug: 1814333
    Change-Id: Ib037b39c320587c0220b432a4198197923396709
    Signed-off-by: Al Bailey <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/640464

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/640464
Committed: https://git.openstack.org/cgit/openstack/stx-config/commit/?id=1b22b5313d0618792732066a8fe47460d8ef06de
Submitter: Zuul
Branch: master

commit 654c05df0e45aa47d18ce72e5ba003195872790f
Author: Al Bailey <email address hidden>
Date: Fri Feb 22 16:35:12 2019 -0600

    The --kubernetes flag no longer has an effect.

    kubernetes mode is always enabled, the flag cannot be used to
    enable or disable it.

    The option in the CLI will be removed completely once the wiki
    and any test tools are updated.

    The code that handles the "else" will also be updated in a
    later commit

    Story: 2004751
    Task: 29756
    Change-Id: I75a81ab852252ee108fefeca5682e5b1a9d7374e
    Signed-off-by: Al Bailey <email address hidden>

commit 03b08b9722e83597797de93abef54f787b93bab5
Author: Mingyuan Qi <email address hidden>
Date: Wed Jan 30 09:41:27 2019 +0800

    Allow user specified registries for config_controller

    Currently docker images were pulled from public registries during
    config_controller. For some users, the connection to the public
    docker registry may be slow such that installing the containerized
    services images may timeout or the system simply does not have
    access to the public internet.

    This change allows users to specify alternative public/private
    registries to replace k8s.gcr.io, gcr.io, quay.io and docker.io.
    Insecure registry is supported if all default registries were
    replaced by one unified registry. It lowers the complexity for
    those who build his own registry without internet access.

    Docker doesn't support ipv6 addr as registry name, instead
    hostname or domain name in ipv6 network is allowed.

    Test:
    AIO-SX/AIO-DX/Standard(2+2):
      Alternative public registry (ipv4/domain) with proxy
        - config_controller pass
      Private registry (ipv4/ipv6/domain) without internet
        - config_controller pass
      Default registry with/without proxy
        - config_controller pass

    Story: 2004711
    Task: 28742

    Change-Id: I4fee3f4e0637863b9b5ef4ef556082ac75f62a1d
    Signed-off-by: Mingyuan Qi <email address hidden>
    (cherry picked from commit 611a68a96ab915dc4e97d39dffa5c379bbffef3d)

commit 7471ef852b7c37c742ef273f0df6b8ccce3bd928
Author: Bin Qian <email address hidden>
Date: Thu Feb 21 14:46:34 2019 -0500

    Boost sm process priority in VBox environment

    There is an instance that sm claimed its main thread ran sluggish
    as some critical timer run behind the scheuled timing.
    The issue could prevent the sm from scheduling services.
    As the result, the controller could fail to enable.

    The issue was found only on vbox labs on AIO-SX, the fix is to boost
    sm process priority to nice value -10 from current -2.

    Closes-Bug: 1816764
    Depends-On: https://review.openstack.org/638664
    Change-Id: Iafa17b1c47d65cc7394552ea1c8e7a78398e4869
    Signed-off-by: Bin Qian <email address hidden>
    (cherry picked from commit a6934ac9d27e0357d0025018077441d989679409)

commit 5e61519ac92822b959dffe63b76956cf0...