Open markus-hentsch opened 2 months ago
2. The docs page at docs/05-iam/domain-manager-setup-and-usage.md needs to be updated and reference to the Domain Manager standard be removed or replaced in a way that omits the SCS-specific policy configurations. Only the part about adjusting the
is_domain_managed_role
rule should stay as this will still be valid and required for the Octavia LBaaS role integration.
We might be able to greatly shrink this down and simply point to https://docs.openstack.org/keystone/latest/user/index.html depending on how https://review.opendev.org/c/openstack/keystone/+/928135 goes.
Current State
Desired State
Once SCS incorporates OpenStack 2024.2 or later, where the Domain Manager functionality is available natively in OpenStack, the following things need to happen:
It needs to either be removed or replaced by a v2 that omits any of the SCS-specific policy configuration, as it will not be necessary anymore and conflict with the native implementation. Explanations aboutUpdate: #586 now differentiates between pre- and post-2024.2 versions of Keystone. As such, the standard can live on for the time being. In the future, all the pre-2024.2 parts can be removed.is_domain_managed_role
and an Octavia role integration could be remaining parts of a v2 although I think it would better fit in the Role Standard. I see little reason for keeping the standard at all.is_domain_managed_role
rule should stay as this will still be valid and required for the Octavia LBaaS role integration.