A system-scoped token implies the user has authorization to act on the
deployment system. These tokens are useful for interacting with
resources that affect the deployment as a whole, or exposes resources
that may otherwise violate project or domain isolation.
Since Queens, the keystone-manage bootstrap command assigns the admin
role to the admin user with system scope, as well as in the admin
project. This patch transitions the Keystone admin user from
authenticating using project scoped tokens to system scoped tokens.
This is a necessary step towards being able to enable the updated oslo
policies in services that allow finer grained access to system-level
resources and APIs.
An etherpad with discussion about the transition to the new oslo
service policies is:
https://etherpad.opendev.org/p/enabling-system-scope-in-kolla-ansible
Change-Id: Ib631e2211682862296cce9ea179f2661c90fa585
Signed-off-by: Niklas Hagman <ubuntu@post.blinkiz.com>
The keepalived_virtual_router_id should be changed from the default in
the case of a multi-region deployment where the VIP of the different
regions resides on the same subnet.
This is not immediately clear - this change should make it more obvious.
Change-Id: Ia4899ba407937d9f27832c9d123701729e89987a
Tweaked some of the language in doc/source/user/multi-regions.rst for
clarity purposes.
TrivialFix
Change-Id: Icdd8da6886d0e39da5da80c37d14d2688431ba8f
Following by https://review.openstack.org/#/c/605097/
These were used by now-dead tooling. We can remove them.
Change-Id: I0953751044f038a3fdd1acd49b3d2b053ac4bec8
`auth_uri` option is deprecated and changed to new option
`www_authenticate_uri` from group keystone_authtoken
please follow below link for reference
https://review.openstack.org/#/c/508522/
Change-Id: I8daa645ff1afab9ca643de2c3beb4d757007b514
We upgrade the rst convention by following Documentation Contributor
Guide[1].
[1] https://docs.openstack.org/doc-contrib-guide
Change-Id: Ieceb3942073512fb10670a48d258c4055909496e
Partially-Implements: blueprint optimize-the-documentation-format
add domain_name for multi-regions. When deploying regiontwo，
nova_compute simple_cell_setup will use domain_name.
Change-Id: I2f4171e1469966140ccccb38540fa5c54258bdfb
