Set service_type in [keystone_authtoken] for access rule validation#933
Conversation
Without service_type configured, keystonemiddleware cannot validate application credentials with custom access rules, causing HTTP 401 for end users. Closes: OSPRH-22365 Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Deydra71, fmount The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| memcache_tls_cafile = {{ .MemcachedAuthCa }} | ||
| memcache_tls_enabled = true | ||
| {{end}} | ||
| service_type = image |
There was a problem hiding this comment.
@Deydra71 before merging I was wondering if it makes sense to propagate [1] via templateParameters.
In addition looks like ServiceType is what we use in the first place to call the keystoneAPI and register a new Service [2].
[1] https://github.com/openstack-k8s-operators/glance-operator/blob/main/internal/glance/const.go#L36
[2] https://github.com/openstack-k8s-operators/glance-operator/blob/main/internal/controller/glance_controller.go#L476
There was a problem hiding this comment.
@Deydra71 I won't paste the same comment everywhere but worth double checking this part for other operators as well.
There was a problem hiding this comment.
Thanks @fmount ! I raised your question in nova --> openstack-k8s-operators/nova-operator#1136 (comment)
With that I think we should keep it hardcoded so it's unified across operators, wdyt?
There was a problem hiding this comment.
ok, let's keep consistency and hardcode it everywhere. we'll folllow up if we really need to!
|
/lgtm |
openshift-merge-bot
Bot
merged commit 45d91b1
into
openstack-k8s-operators:main
|
@Deydra71 at this point main is supposed to be 19: feel free to cherry-pick to FR6 to make sure we get this fix |
|
/cherry-pick 18.0-fr6 |
|
@Deydra71: new pull request created: #937 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Without service_type configured, keystonemiddleware cannot validate application credentials with custom access rules, causing HTTP 401 for end users.
Closes: OSPRH-22365