Fix certs ops as trustee for existing clusters

Change I249942a355577c4f1ef51b3988f0cc4979959d0b updated the domain_id
field in context from domain_id to user_domain_id.  Update the detection
code here according.

Without this, existing clusters will not be able to do some operations
like resize. New clusters are OK because of the subsequent Change
If5b31951959c7a141dc1cae5fefcabe4ebf438b3.

[1] https://opendev.org/openstack/magnum/commit/5971243169c5df863ebe81cff7ebd07f190b840a#diff-145868d956788eb211486eb4de153c9db680ac16

Closes-Bug: #2076052
Change-Id: Ibefb9bc35c85e30d2e1ccff252217bb4905eb1af

Author: waipeng

magnum/db/sqlalchemy/api.py

@@ -131,13 +131,16 @@ def _add_tenant_filters(self, context, query):
         kst = osc.keystone()
 
         # User in a regular project (not in the trustee domain)
-        if context.project_id and context.domain_id != kst.trustee_domain_id:
+        if (
+            context.project_id
+            and context.user_domain_id != kst.trustee_domain_id
+        ):
             query = query.filter_by(project_id=context.project_id)
         # Match project ID component in trustee user's user name against
         # cluster's project_id to associate per-cluster trustee users who have
         # no project information with the project their clusters/cluster models
         # reside in. This is equivalent to the project filtering above.
-        elif context.domain_id == kst.trustee_domain_id:
+        elif context.user_domain_id == kst.trustee_domain_id:
             user_name = kst.client.users.get(context.user_id).name
             user_project = user_name.split('_', 2)[1]
             query = query.filter_by(project_id=user_project)