openstack/devstack
Code Issues Proposed changes

Merge "Add RBAC scope and new defaults setting support for Nova & Tempest"

Browse Source
This commit is contained in:
Zuul 2022-11-15 12:17:46 +00:00 committed by Gerrit Code Review
commit 448036a6ad
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/nova
View File

@ -97,6 +97,12 @@ NOVA_SERVICE_LISTEN_ADDRESS=${NOVA_SERVICE_LISTEN_ADDRESS:-$(ipv6_unquote $SERVI
METADATA_SERVICE_PORT=${METADATA_SERVICE_PORT:-8775}
NOVA_ENABLE_CACHE=${NOVA_ENABLE_CACHE:-True}
# Flag to set the oslo_policy.enforce_scope and oslo_policy.enforce_new_defaults.
# This is used to switch the compute API policies enable the scope and new defaults.
# By Default, these flag are False.
# For more detail: https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope
NOVA_ENFORCE_SCOPE=$(trueorfalse False NOVA_ENFORCE_SCOPE)
if [[ $SERVICE_IP_VERSION == 6 ]]; then
NOVA_MY_IP="$HOST_IPV6"
else
@ -481,6 +487,10 @@ function create_nova_conf {
NOVA_ENABLED_APIS=$(echo $NOVA_ENABLED_APIS | sed "s/,metadata//")
fi
iniset $NOVA_CONF DEFAULT enabled_apis "$NOVA_ENABLED_APIS"
if [[ "$NOVA_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
iniset $NOVA_CONF oslo_policy enforce_new_defaults True
iniset $NOVA_CONF oslo_policy enforce_scope True
fi
if is_service_enabled tls-proxy && [ "$NOVA_USE_MOD_WSGI" == "False" ]; then
# Set the service port for a proxy to take the original
iniset $NOVA_CONF DEFAULT osapi_compute_listen_port "$NOVA_SERVICE_PORT_INT"

4
lib/tempest
View File

@ -674,6 +674,10 @@ function configure_tempest {
iniset $TEMPEST_CONFIG auth admin_project_name ''
fi
if [[ "$NOVA_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
iniset $TEMPEST_CONFIG enforce_scope nova true
fi
if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
iniset $TEMPEST_CONFIG enforce_scope glance true
fi