Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Discontinue Domain Manager standard once OpenStack 2024.2 lands in SCS #723

Open
markus-hentsch opened this issue Aug 30, 2024 · 1 comment
Labels
question Further information is requested

Comments

@markus-hentsch
Copy link
Contributor

markus-hentsch commented Aug 30, 2024

Current State

Desired State

Once SCS incorporates OpenStack 2024.2 or later, where the Domain Manager functionality is available natively in OpenStack, the following things need to happen:

  1. The SCS Domain Manager standard needs to be deprecated. It needs to either be removed or replaced by a v2 that omits any of the SCS-specific policy configuration, as it will not be necessary anymore and conflict with the native implementation. Explanations about is_domain_managed_role and an Octavia role integration could be remaining parts of a v2 although I think it would better fit in the Role Standard. I see little reason for keeping the standard at all. Update: Stabilize Domain Manager Role Standard #586 now differentiates between pre- and post-2024.2 versions of Keystone. As such, the standard can live on for the time being. In the future, all the pre-2024.2 parts can be removed.
  2. The docs page at docs/05-iam/domain-manager-setup-and-usage.md needs to be updated and reference to the Domain Manager standard be removed or replaced in a way that omits the SCS-specific policy configurations. Only the part about adjusting the is_domain_managed_role rule should stay as this will still be valid and required for the Octavia LBaaS role integration.
  3. SCS operators need to be notified to remove the Keystone policy extensions of the Domain Manager standard when upgrading to the SCS release that incorporates OpenStack 2024.2 or later.
@markus-hentsch markus-hentsch added the question Further information is requested label Aug 30, 2024
@markus-hentsch
Copy link
Contributor Author

2. The docs page at docs/05-iam/domain-manager-setup-and-usage.md needs to be updated and reference to the Domain Manager standard be removed or replaced in a way that omits the SCS-specific policy configurations. Only the part about adjusting the is_domain_managed_role rule should stay as this will still be valid and required for the Octavia LBaaS role integration.

We might be able to greatly shrink this down and simply point to https://docs.openstack.org/keystone/latest/user/index.html depending on how https://review.opendev.org/c/openstack/keystone/+/928135 goes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

1 participant