Stabilize Domain Manager Role Standard #586

markus-hentsch · 2024-05-07T11:23:37Z

Moves Domain Manager Standard from Draft to Stable

markus-hentsch · 2024-05-07T11:23:59Z

~~Currently blocked by #585~~ (obsolete)

Currently blocked by:

figure out which Keystone release is the earliest that supports enforce_scope/enforce_new_defaults in conjunction with the Domain Manager implementation of this standard
- if it is 2024.2, wait until it is released and couple the standard to this version
- if it is a version already released for the next SCS release, stabilize this standard

markus-hentsch · 2024-08-30T13:49:37Z

~~Currently blocked by #585~~ (obsolete)

Currently blocked by:

figure out which Keystone release is the earliest that supports enforce_scope/enforce_new_defaults in conjunction with the Domain Manager implementation of this standard

if it is 2024.2, wait until it is released and couple the standard to this version

if it is a version already released for the next SCS release, stabilize this standard

Since the upcoming SCS release R7 will be based on 2024.1 ("Caracal"), I tested the stable/2024.1 branch of Keystone with the enforce_scope/enforce_new_defaults options on my DevStack together with the Domain Manager standard policy rules and can confirm it works without issue. Hence:

the limitation about Domain Managers being able to see all domains will not be an issue anymore in R7 (2024.1 contains the bugfix for that)
we do not need to require disabling enforce_scope/enforce_new_defaults for the SCS Domain Manager implementation to work
the transition from SCS implementation to native Domain Manager in future OpenStack releases will be seamless for users (same behavior)

Since the native integration of Domain Manager in upstream OpenStack won't be available before 2024.2 ("Dalmatian"), we should stabilize this standard for SCS R7 to have a transitional solution and feature availability until an SCS release will be based on 2024.2 or later.

I adjusted the standard accordingly and added a note about the upcoming native integration.

Moves Domain Manager Standard from Draft to Stable Signed-off-by: Markus Hentsch <[email protected]>

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch · 2024-09-11T09:28:29Z

Moving this PR back to draft as a result of today's IaaS community call discussion:

Standard is still relevant with respect to the concept, as this does not change. Our implementation with policy.yaml will become obsolete with 2024.2 -- move the description of implementation and a note that the downstrweam implementation should be dropped with the upgrade to 2024.2 to the "test and implementation notes" document. Merge this standard as stable as soon as this is done. Could be included as a recommended requirement in SCS-compatible IaaS-v5 (late Oct/early Nov).

Split standard into standard document and implementation notes. Move the downstream policy-based implementation into the implementation notes and differentiate instructions based on the Keystone release used. Add the upstream spec to related documents and update the standard according to the latest changes. Signed-off-by: Markus Hentsch <[email protected]>

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch · 2024-09-17T12:12:41Z

Moving this PR back to draft as a result of today's IaaS community call discussion:

Standard is still relevant with respect to the concept, as this does not change. Our implementation with policy.yaml will become obsolete with 2024.2 -- move the description of implementation and a note that the downstrweam implementation should be dropped with the upgrade to 2024.2 to the "test and implementation notes" document. Merge this standard as stable as soon as this is done. Could be included as a recommended requirement in SCS-compatible IaaS-v5 (late Oct/early Nov).

I split the standard into standard and implementation notes and moved the SCS downstream implementation using API policies into the implementation notes. I rewrote the standard section and implementation notes' introduction to differentiate between OpenStack Keystone releases and also integrated some upgrade instructions about dropping the old policies.

With this, the standard should now be fully agnostic concerning the Keystone version and can be applied universally.

Removing the draft marker.

josephineSei · 2024-09-18T06:44:18Z

Standards/scs-0302-v1-domain-manager-role.md

@@ -1,17 +1,27 @@
 ---
 title: Domain Manager configuration for Keystone
 type: Standard
-status: Draft
+status: Stable
+stabilized_at: 2024-08-30


Please do not forget to update the date, when merging :)

Oh and did we discuss to stabilize this?

Here: https://github.com/SovereignCloudStack/minutes/blob/main/iaas/20240911.md#domain-manager-standard-markus-hentsch

josephineSei

Overall a good split. I have made a few comments inline.

Standards/scs-0302-v1-domain-manager-role.md

josephineSei · 2024-09-18T10:28:08Z

Standards/scs-0302-v1-domain-manager-role.md


-The "`is_domain_managed_role`" rule of the above policy template may be adjusted according to the requirements of the CSP and infrastructure architecture to specify different or multiple roles as manageable by Domain Managers as long as the policy rule adheres to the following:
+In case the Identity API was upgraded from an older version where the policy-based Domain Manager implementation of SCS described in the [implementation notes for this standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0302-w1-domain-manager-implementation-notes.md) was still in use, the policies described there MUST be removed (except for the "`is_domain_managed_role`" rule).


Is that 'is_domain_managed_role' not added by upstream? or do you mean to include ONLY adjustments, that have been mage to that rule?
In the latter case could you state this more clear in the standard?

Good point. I rephrased this. Can you recheck please?

josephineSei · 2024-09-18T10:29:16Z

Standards/scs-0302-v1-domain-manager-role.md

@@ -1,17 +1,27 @@
 ---
 title: Domain Manager configuration for Keystone
 type: Standard
-status: Draft
+status: Stable
+stabilized_at: 2024-08-30


Oh and did we discuss to stabilize this?

josephineSei · 2024-09-18T10:36:21Z

Standards/scs-0302-w1-domain-manager-implementation-notes.md

+"identity:add_user_to_group": "(rule:is_domain_manager and token.domain.id:%(target.group.domain_id)s and token.domain.id:%(target.user.domain_id)s) or rule:base_add_user_to_group or rule:admin_required"
+```
+
+Note that the policy file begins with a list of "`base_*`" rule definitions ("Section A").


Something seems to be wrong with the text here - it shows up like it is still part of the code block. On the first sight I don'T see why this is happening - but this may lead to problems displaying this document.

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch and others added 2 commits August 30, 2024 15:50

Stabilize Domain Manager Role Standard

13844eb

Moves Domain Manager Standard from Draft to Stable Signed-off-by: Markus Hentsch <[email protected]>

Restructure standard to align with updated template

14e80c0

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch force-pushed the domain-manager-stabilize branch 2 times, most recently from 93e8aee to 1df5d77 Compare August 30, 2024 13:58

markus-hentsch added 3 commits August 30, 2024 16:47

Remove outdated limitation not applicable to 2024.1

41acde3

Signed-off-by: Markus Hentsch <[email protected]>

Add info admonition banner for upcoming native integration

0c9df2f

Signed-off-by: Markus Hentsch <[email protected]>

Add stabilization date

c93a237

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch force-pushed the domain-manager-stabilize branch from 1df5d77 to c93a237 Compare August 30, 2024 14:47

markus-hentsch added the SCS-VP10 Related to tender lot SCS-VP10 label Aug 30, 2024

markus-hentsch marked this pull request as ready for review August 30, 2024 15:00

This was referenced Aug 30, 2024

Update Domain Manager instructions to reflect latest changes SovereignCloudStack/docs#238

Draft

Discontinue Domain Manager standard once OpenStack 2024.2 lands in SCS #723

Open

markus-hentsch added 2 commits September 10, 2024 11:45

Merge branch 'main' into domain-manager-stabilize

c7b744d

Merge branch 'main' into domain-manager-stabilize

c80cc1c

markus-hentsch marked this pull request as draft September 11, 2024 09:23

markus-hentsch and others added 3 commits September 17, 2024 10:36

Merge branch 'main' into domain-manager-stabilize

39912fe

Be more explicit about upgrade to native integration

158fda6

Signed-off-by: Markus Hentsch <[email protected]>

markus-hentsch marked this pull request as ready for review September 17, 2024 12:12

markus-hentsch requested a review from josephineSei September 17, 2024 12:12

josephineSei reviewed Sep 18, 2024

View reviewed changes

Address review comments

f4d2f0d

Signed-off-by: Markus Hentsch <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Stabilize Domain Manager Role Standard #586

Stabilize Domain Manager Role Standard #586

markus-hentsch commented May 7, 2024

markus-hentsch commented May 7, 2024 •

edited

Loading

markus-hentsch commented Aug 30, 2024

markus-hentsch commented Sep 11, 2024

markus-hentsch commented Sep 17, 2024

josephineSei Sep 18, 2024

josephineSei Sep 18, 2024

markus-hentsch Sep 20, 2024

josephineSei left a comment

josephineSei Sep 18, 2024

markus-hentsch Sep 20, 2024

josephineSei Sep 18, 2024

josephineSei Sep 18, 2024


		The "`is_domain_managed_role`" rule of the above policy template may be adjusted according to the requirements of the CSP and infrastructure architecture to specify different or multiple roles as manageable by Domain Managers as long as the policy rule adheres to the following:
		In case the Identity API was upgraded from an older version where the policy-based Domain Manager implementation of SCS described in the [implementation notes for this standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0302-w1-domain-manager-implementation-notes.md) was still in use, the policies described there MUST be removed (except for the "`is_domain_managed_role`" rule).

Stabilize Domain Manager Role Standard #586

Are you sure you want to change the base?

Stabilize Domain Manager Role Standard #586

Conversation

markus-hentsch commented May 7, 2024

markus-hentsch commented May 7, 2024 • edited Loading

markus-hentsch commented Aug 30, 2024

markus-hentsch commented Sep 11, 2024

markus-hentsch commented Sep 17, 2024

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

markus-hentsch Sep 20, 2024

Choose a reason for hiding this comment

josephineSei left a comment

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

markus-hentsch Sep 20, 2024

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

markus-hentsch commented May 7, 2024 •

edited

Loading