yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #80078
[Bug 1844194] Re: Project tags don't use default roles
Reviewed: https://review.opendev.org/682503
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=8e67249d5bfb07b0a236189f62b3f338532f0df0
Submitter: Zuul
Branch: master
commit 8e67249d5bfb07b0a236189f62b3f338532f0df0
Author: Lance Bragstad <lbragstad@xxxxxxxxx>
Date: Mon Sep 16 22:11:06 2019 +0000
Add default roles and scope checking to project tags
This commit makes it so that project tags adhere to system-scope and
also incorporates default roles into the policy checks by default.
Change-Id: Ie36df5677a08d7d95f056f3ea00eda05e1315ea5
Closes-Bug: 1844194
Closes-Bug: 1844193
Related-Bug: 1806762
** Changed in: keystone
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1844194
Title:
Project tags don't use default roles
Status in OpenStack Identity (keystone):
Fix Released
Bug description:
In Rocky, keystone implemented support to ensure at least three
default roles were available [0]. The project tags API or policies
don't incorporate these defaults into its default policies [1], but it
should.
[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html
[1] https://opendev.org/openstack/keystone/src/commit/18e0080af3dcc0a96ff5d98aeb5f517080a35fb2/keystone/common/policies/project.py#L147-L210
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1844194/+subscriptions
References