Ghanshyam Mann 283fa242ca Remove system scope token to access services ...

As per the RBAC new direction in Zed cycle, we have dropped the
system scope from API policies and all the policies are hardcoded
to project scoped so that any user accessing APIs using system scope
will get 403 error. It is dropped from all the OpenStack services
except for the Ironic service which will have system scope and to
support ironic only deployment, we are keeping system as well as project
scope in Keystone.

Complete discussion and direction can be found in the below gerrit
change and TC goal direction:

- https://review.opendev.org/c/openstack/governance/+/847418
- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#the-issues-we-are-facing-with-scope-concept

As phase-2 of RBAC goal, services will start enabling the new
defaults and project scope by default. For example: Nova did in
- https://review.opendev.org/c/openstack/nova/+/866218

Kolla who start accessing the services using system scope token
- https://review.opendev.org/c/openstack/kolla-ansible/+/692179

This commit partially revert the above change except keeping
system scope usage for Keystone and Ironic. Rest all services are changed
to use the project scope token.

And enable the scope and new defaults for Nova which was disabled
by https://review.opendev.org/c/openstack/kolla-ansible/+/870804

Change-Id: I0adbe0a6c39e11d7c9542569085fc5d580f26c9d

2023-01-26 17:52:00 -06:00

..

bootstrap_service.yml

Support multiple nova cells

2019-10-16 17:42:36 +00:00

bootstrap_upgrade.yml

Support multiple nova cells

2019-10-16 17:42:36 +00:00

bootstrap.yml

Adding container_engine to kolla_toolbox module

2022-11-04 15:32:30 +01:00

cell_proxy_loadbalancer.yml

Add loadbalancer-config role and wrap haproxy-config role inside

2022-08-09 12:15:49 +02:00

check-containers.yml

Fix var-spacing

2022-07-25 22:15:15 +02:00

check.yml

Copy Nova role as a basis for the Nova cell role

2019-10-01 14:48:19 +01:00

clone.yml

permission denied when enable_kolla_dev_mod

2020-06-07 19:36:42 +08:00

config_bootstrap.yml

Support multiple nova cells

2019-10-16 17:42:36 +00:00

config_validate.yml

Integrate oslo-config-validator

2022-12-21 17:19:09 +00:00

config-host.yml

Remove deprecated sysctl knobs

2022-09-26 11:54:08 +00:00

config-libvirt-tls.yml

Performance: remove one include_tasks in nova-cell

2020-08-28 16:16:56 +00:00

config-nova-fake.yml

Support multiple nova cells

2019-10-16 17:42:36 +00:00

config.yml

Support specifying Nova compute provider config

2022-10-07 12:58:38 +00:00

copy-certs.yml

Refactor copy certificates task

2020-04-14 17:26:19 +00:00

create_cells.yml

Merge "Fix nova cell message queue URL with separate notification queue"

2020-04-26 16:46:35 +00:00

deploy-containers.yml

Copy Nova role as a basis for the Nova cell role

2019-10-01 14:48:19 +01:00

deploy.yml

nova: improve compute service registration failure handling

2022-03-29 11:26:44 +01:00

discover_computes.yml

Usage of kolla_container_engine variable instead of docker

2022-10-28 09:15:55 +02:00

external_ceph.yml

Fix issues introduced by ansible-lint 6.6.0

2022-09-21 14:34:54 +00:00

get_cell_settings.yml

Fix nova compute addition with limit

2020-04-14 19:36:49 +00:00

libvirt-cleanup.yml

Adding container engine to kolla_container_facts

2022-11-02 13:44:45 +01:00

loadbalancer.yml

Add loadbalancer-config role and wrap haproxy-config role inside

2022-08-09 12:15:49 +02:00

main.yml

Revert "Performance: Use import_tasks in the main plays"

2020-12-14 10:36:55 +00:00

online_data_migrations.yml

Support multiple nova cells

2019-10-16 17:42:36 +00:00

precheck.yml

Fix prechecks in check mode

2023-01-12 14:27:36 +00:00

proxy_loadbalancer.yml

Add loadbalancer-config role and wrap haproxy-config role inside

2022-08-09 12:15:49 +02:00

pull.yml

Refactor and optimise image pulling

2021-08-10 11:57:54 +00:00

rabbitmq.yml

Fix nova deployment failure when rabbitmq is disabled

2021-07-27 22:07:08 +08:00

reconfigure.yml

Performance: replace unconditional include_tasks with import_tasks

2020-08-28 16:12:03 +00:00

reload.yml

Fix var-spacing

2022-07-25 22:15:15 +02:00

rolling_upgrade.yml

Performance: optimize genconfig

2020-10-12 19:30:06 +02:00

stop.yml

Use "name:" instead of "role:" for *_role modules

2020-03-02 10:01:17 +01:00

upgrade.yml

Performance: replace unconditional include_tasks with import_tasks

2020-08-28 16:12:03 +00:00

wait_discover_computes.yml

Remove system scope token to access services

2023-01-26 17:52:00 -06:00