From b5b236122f5fb41a092fd73bb553ec507fdc7ffb Mon Sep 17 00:00:00 2001 From: Doug Goldstein Date: Tue, 13 Oct 2026 11:43:47 -0500 Subject: [PATCH] site-workflows: don't inherit the DOMAIN.manager role DOMAIN.ROLE entries on automation secrets are granted as inherited domain roles. The manager role should apply to the domain itself rather than being inherited by every project in it, so grant DOMAIN.manager without --inherited. Other roles are unchanged. --- .../site-workflows/files/keystone-automation-user-upsert.sh | 4 ++++ docs/deploy-guide/openstack-automation-users.md | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/charts/site-workflows/files/keystone-automation-user-upsert.sh b/charts/site-workflows/files/keystone-automation-user-upsert.sh index 08d500e90..952ddb026 100644 --- a/charts/site-workflows/files/keystone-automation-user-upsert.sh +++ b/charts/site-workflows/files/keystone-automation-user-upsert.sh @@ -53,6 +53,10 @@ for svc_role in ${SVC_ROLES}; do openstack role add --user "${SVC_ID}" --system all reader openstack role add --user "${SVC_ID}" --system all member ;; + ?*.manager) + # DOMAIN.manager is granted on the domain itself, not inherited by projects + openstack role add --user "${SVC_ID}" --domain "${svc_role%%.*}" manager + ;; ?*.?*) # DOMAIN.ROLE, e.g. a role on every project in the named domain openstack role add --user "${SVC_ID}" --domain "${svc_role%%.*}" --inherited "${svc_role#*.}" diff --git a/docs/deploy-guide/openstack-automation-users.md b/docs/deploy-guide/openstack-automation-users.md index 50ece3a9b..014012c84 100644 --- a/docs/deploy-guide/openstack-automation-users.md +++ b/docs/deploy-guide/openstack-automation-users.md @@ -27,7 +27,8 @@ Possible roles are: A role can also be written as `DOMAIN.ROLE`, which grants the Keystone role `ROLE` on the Keystone domain `DOMAIN`, inherited by every project in that -domain. Both forms can be mixed in one list. +domain. The one exception is `DOMAIN.manager`, which is granted on the domain +only and is not inherited by its projects. Both forms can be mixed in one list. If any entry uses the `DOMAIN.ROLE` form, the account is created in the `machine` Keystone domain, and that domain must already exist. Otherwise it is