From a767c6c9650060fb7341594a494f82e36c8a9bb3 Mon Sep 17 00:00:00 2001
From: haseeb <syedhaseebahmed12@gmail.com>
Date: Tue, 25 Aug 2026 19:36:04 +0530
Subject: [PATCH] feat(keystone): system-scope service account
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

automation-infrasetup-system.yaml.tpl — modelled on the existing automation-infrasetup.yaml.tpl: a Password generator plus an ExternalSecret producing Secret infrasetup-system, labelled keystone-role: system-readwrite, whose clouds.yaml sets system_scope: "all" and carries no project keys.

sensor-keystone-automation-user-upsert.yaml — new system-readwrite case granting reader + member on --system all. member is the minimum SYSTEM_MEMBER requires; no cloud-wide admin.
---
 ...ensor-keystone-automation-user-upsert.yaml |  4 ++
 .../automation-infrasetup-system.yaml.tpl     | 46 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 components/openstack/templates/automation-infrasetup-system.yaml.tpl

diff --git a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
index 887e84536..53c074012 100644
--- a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
+++ b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
@@ -75,6 +75,10 @@ spec:
                               infra-readwrite)
                                 openstack role add --user "${SVC_ID}" --project-domain infra --project baremetal admin
                                 ;;
+                              system-readwrite)
+                                openstack role add --user "${SVC_ID}" --system all reader
+                                openstack role add --user "${SVC_ID}" --system all member
+                                ;;
                               *)
                                 echo "Invalid role ${svc_role}"
                                 ;;
diff --git a/components/openstack/templates/automation-infrasetup-system.yaml.tpl b/components/openstack/templates/automation-infrasetup-system.yaml.tpl
new file mode 100644
index 000000000..086216ab9
--- /dev/null
+++ b/components/openstack/templates/automation-infrasetup-system.yaml.tpl
@@ -0,0 +1,46 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: "infrasetup-system-{{ .Values.regionName }}"
+spec:
+  length: 32
+  digits: 6
+  symbols: 6
+  symbolCharacters: "~!@#$%^*()_+-={}[]<>?"
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: "infrasetup-system-{{ .Values.regionName }}"
+spec:
+  refreshInterval: 20160m
+  target:
+    name: infrasetup-system
+    template:
+      engineVersion: v2
+      type: Opaque
+      metadata:
+        labels:
+          understack.rackspace.com/keystone-role: system-readwrite
+          understack.rackspace.com/keystone-user: "infrasetup-system-{{ .Values.regionName }}"
+      data:
+        password: "{{ `{{ .password }}` }}"
+        clouds.yaml: |
+          clouds:
+            understack:
+              auth:
+                auth_url: "{{ .Values.keystoneUrl }}"
+                user_domain_name: "service"
+                username: "infrasetup-system-{{ .Values.regionName }}"
+                password: "{{ `{{ .password }}` }}"
+                system_scope: "all"
+              region_name: "{{ .Values.regionName }}"
+              interface: "public"
+              identity_api_version: 3
+  dataFrom:
+  - sourceRef:
+      generatorRef:
+        apiVersion: generators.external-secrets.io/v1alpha1
+        kind: Password
+        name: "infrasetup-system-{{ .Values.regionName }}"