Nuke _member_ role requirement

yankcrime commented 4 months ago

The _member_ role is a vestige from OpenStack days of yore and no longer exists on recent versions by default. Do as the TODO suggests and remove it.

yankcrime commented 4 months ago

If it's broke then it's because of Sausage Cloud's policies that need bringing into line - let me know how you fare.

spjmurray commented 4 months ago

Okay so, as expected, provisioning with the new defaults results in:

{"ts":1721636294055.5776,"caller":"controller/controller.go:329","msg":"Reconciler error","controller":"openstackcluster","controllerGroup":"infrastructure.cluster.x-k8s.io","controllerKind":"OpenStackCluster","OpenStackCluster":{"name":"cluster-cd0eae95","namespace":"f8cdef7d-d5dc-41a3-94ec-2b30802b70ef"},"namespace":"f8cdef7d-d5dc-41a3-94ec-2b30802b70ef","name":"cluster-cd0eae95","reconcileID":"6e360044-5b83-4907-91c1-34f48d568cb1","err":"failed to reconcile load balancer: Request forbidden: [GET https://compute.sausage.cloud:9876/v2.0/lbaas/loadbalancers?name=k8s-clusterapi-cluster-f8cdef7d-d5dc-41a3-94ec-2b30802b70ef-cluster-cd0eae95-kubeapi], error message: {\"faultcode\": \"Client\", \"faultstring\": \"Policy does not allow this request to be performed.\", \"debuginfo\": null}"}

And trying to delete the cluster leads to a deadlock as it cannot read loadbalancers to delete loadbalancers 😸

Setting to the following restores functionality (and actually tests it works):

regions:
- name: gb-north-1
  provider: openstack
  openstack:
    endpoint: https://compute.sausage.cloud:5000
    serviceAccountSecret:
      name: gb-north-1-credentials
    identity:
      clusterRoles:
      - _member_
      - member
      - load-balancer_member

unikorn-cloud / region

Nuke _member_ role requirement #37