Merge pull request openstack-k8s-operators#346 from dmendiza/enable-secure-rbac

Enable Secure RBAC by default

Author: openshift-merge-bot[bot]

api/bases/keystone.openstack.org_keystoneapis.yaml

@@ -86,6 +86,11 @@ spec:
                   files. Those get added to the service config dir in /etc/<service>
                   . TODO: -> implement'
                 type: object
+              enableSecureRBAC:
+                default: true
+                description: EnableSecureRBAC - Enable Consistent and Secure RBAC
+                  policies
+                type: boolean
               memcachedInstance:
                 default: memcached
                 description: Memcached instance name.

api/v1beta1/keystoneapi_types.go

@@ -96,6 +96,11 @@ type KeystoneAPISpec struct {
 	// Secret containing OpenStack password information for keystone KeystoneDatabasePassword, AdminPassword
 	Secret string `json:"secret"`
 
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default=true
+	// EnableSecureRBAC - Enable Consistent and Secure RBAC policies
+	EnableSecureRBAC bool `json:"enableSecureRBAC"`
+
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default=""
 	// TrustFlushArgs - Arguments added to keystone-manage trust_flush command

config/crd/bases/keystone.openstack.org_keystoneapis.yaml

@@ -86,6 +86,11 @@ spec:
                   files. Those get added to the service config dir in /etc/<service>
                   . TODO: -> implement'
                 type: object
+              enableSecureRBAC:
+                default: true
+                description: EnableSecureRBAC - Enable Consistent and Secure RBAC
+                  policies
+                type: boolean
               memcachedInstance:
                 default: memcached
                 description: Memcached instance name.

controllers/keystoneapi_controller.go

@@ -1198,6 +1198,7 @@ func (r *KeystoneAPIReconciler) generateServiceConfigMaps(
 			instance.Status.DatabaseHostname,
 			keystone.DatabaseName,
 		),
+		"enableSecureRBAC": instance.Spec.EnableSecureRBAC,
 	}
 
 	// create httpd  vhost template parameters

templates/keystoneapi/config/keystone.conf

@@ -11,6 +11,10 @@ max_retries=-1
 db_max_retries=-1
 connection={{ .DatabaseConnection }}
 
+[oslo_policy]
+enforce_new_defaults = {{ .enableSecureRBAC }}
+enforce_scope = {{ .enableSecureRBAC }}
+
 [fernet_tokens]
 key_repository=/etc/keystone/fernet-keys
 max_active_keys=2