openstack/kolla-ansible
Code Issues Proposed changes

Merge "Ironic: enable elevated access for project scoped service role"

Browse Source
This commit is contained in:
Zuul 2024-02-19 12:40:00 +00:00 committed by Gerrit Code Review
commit a6fa564499
2 changed files with 14 additions and 0 deletions
ansible/roles/ironic/templates
ironic.conf.j2
releasenotes/notes
ironic-rbac-elevated-6804dab4061ab236.yaml

2
ansible/roles/ironic/templates/ironic.conf.j2

@ -18,6 +18,8 @@ my_ip = {{ api_interface_address }}
notification_level = info
{% endif %}
rbac_service_role_elevated_access = True
[oslo_messaging_notifications]
transport_url = {{ notify_transport_url }}
{% if ironic_enabled_notification_topics or enable_ironic_prometheus_exporter | bool %}

12
releasenotes/notes/ironic-rbac-elevated-6804dab4061ab236.yaml Normal file

@ -0,0 +1,12 @@
---
features:
- |
Enable elevated access for project scoped service role
in Ironic. Ironic recently started to enforce new policies
and scope. And Ironic is one of the sole openstack project
which need system scope for some admin related api calls.
However Ironic also started to allow project-scope behaviour
for service role with setting
``rbac_service_role_elevated_access``. This change enables
this setting to get similar behaviour of service role as other
openstack projects.