From a7a9ee7d52cb399d1bd71eb0f1a96725cd24703b Mon Sep 17 00:00:00 2001 From: Veronika Fisarova Date: Tue, 15 Sep 2026 08:42:13 +0200 Subject: [PATCH] [SKMO] Wire leaf KeystoneAPI to admin-two identity Leaf and central regions share one Keystone but get different passwords when ci-framework randomizes per-namespace osp-secret keys. The leaf OSCP must register region-prefixed service users (regionTwo_nova, etc.) in central Keystone; default names (nova, placement) collide with the central region's users and cause HTTP 401 at runtime. `skmo-values.yaml` already defined `serviceUser*` keys but kustomize never applied them to the OpenStackControlPlane. Add replacements for all enabled leaf services, including octavia and swift which were omitted from the original six AC-enabled services but are deployed in this VA. Also fix Glance's Swift backend config to use service:{{ .ServiceUser }} instead of hardcoded service:glance so object-store auth matches the renamed leaf glance service user. Signed-off-by: Veronika Fisarova --- examples/va/multi-namespace-skmo/README.md | 9 +- .../va/multi-namespace-skmo/control-plane.md | 15 ++- .../control-plane2/kustomization.yaml | 121 ++++++++++++++++++ .../control-plane2/service-values.yaml | 2 +- .../control-plane2/skmo-values.yaml | 2 + 5 files changed, 140 insertions(+), 9 deletions(-) diff --git a/examples/va/multi-namespace-skmo/README.md b/examples/va/multi-namespace-skmo/README.md index a2219bbd5..d62670cad 100644 --- a/examples/va/multi-namespace-skmo/README.md +++ b/examples/va/multi-namespace-skmo/README.md @@ -73,8 +73,13 @@ Before deploying, update the following files: - `leafRegion`: The region name for the leaf control plane (e.g. `regionTwo`) - `keystoneInternalURL` / `keystonePublicURL`: The central Keystone endpoint URLs reachable from the leaf region - - `leafAdminUser` / `leafAdminProject`: Admin credentials for the leaf - region in the central Keystone + - `leafAdminUser` / `leafAdminProject` / `leafAdminPasswordKey`: Leaf admin + identity in the central Keystone (`admin-two` / `admin` / `AdminPassword` + by default). Wired into the leaf OSCP `KeystoneAPI` via kustomize + replacements (`adminUser`, `adminProject`, `passwordSelectors.admin`). + - `serviceUser*`: Leaf service user names in central Keystone (e.g. + `regionTwo_nova`). Wired into each service's `serviceUser` field so leaf + `osp-secret` passwords do not collide with the central region's users. ## Stages diff --git a/examples/va/multi-namespace-skmo/control-plane.md b/examples/va/multi-namespace-skmo/control-plane.md index cc4d7efd8..49b2c4d7f 100644 --- a/examples/va/multi-namespace-skmo/control-plane.md +++ b/examples/va/multi-namespace-skmo/control-plane.md @@ -165,17 +165,20 @@ oc -n openstack rsh openstackclient \ openstack endpoint create --region regionTwo identity internal ``` -Create the leaf admin project and user in the central Keystone. Replace -`` with the value of the `leafAdminPasswordKey` entry from -`osp-secret` in the `openstack2` namespace: +Create the leaf admin user in the central Keystone. Replace the placeholders +from `control-plane2/skmo-values.yaml` (`leafAdminUser`, `leafAdminProject`; +defaults: `admin-two`, `admin`). Replace `` with the value +of the `leafAdminPasswordKey` entry from `osp-secret` in the `openstack2` +namespace: ``` -oc -n openstack rsh openstackclient openstack project create leafadmin +oc -n openstack rsh openstackclient \ + openstack user create --domain Default --password oc -n openstack rsh openstackclient \ - openstack user create --domain Default --password leafadmin + openstack role add --project --user admin oc -n openstack rsh openstackclient \ - openstack role add --project leafadmin --user leafadmin admin + openstack role add --system all --user --user-domain Default admin ``` Add the central region's root CA certificates to the leaf CA bundle secret so diff --git a/examples/va/multi-namespace-skmo/control-plane2/kustomization.yaml b/examples/va/multi-namespace-skmo/control-plane2/kustomization.yaml index 246749062..46ac3d387 100644 --- a/examples/va/multi-namespace-skmo/control-plane2/kustomization.yaml +++ b/examples/va/multi-namespace-skmo/control-plane2/kustomization.yaml @@ -91,6 +91,127 @@ replacements: - spec.keystone.template.region options: create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.leafAdminUser + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.keystone.template.adminUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.leafAdminProject + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.keystone.template.adminProject + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.leafAdminPasswordKey + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.keystone.template.passwordSelectors.admin + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserBarbican + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.barbican.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserCinder + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.cinder.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserGlance + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.glance.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserNeutron + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.neutron.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserNova + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.nova.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserOctavia + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.octavia.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserPlacement + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.placement.template.serviceUser + options: + create: true + - source: + kind: ConfigMap + name: skmo-values + fieldPath: data.serviceUserSwift + targets: + - select: + kind: OpenStackControlPlane + fieldPaths: + - spec.swift.template.swiftProxy.serviceUser + options: + create: true - source: kind: ConfigMap name: skmo-values diff --git a/examples/va/multi-namespace-skmo/control-plane2/service-values.yaml b/examples/va/multi-namespace-skmo/control-plane2/service-values.yaml index 2f914c3a1..15e00adae 100644 --- a/examples/va/multi-namespace-skmo/control-plane2/service-values.yaml +++ b/examples/va/multi-namespace-skmo/control-plane2/service-values.yaml @@ -32,7 +32,7 @@ data: swift_store_auth_version = 3 swift_store_auth_address = {{ .KeystoneInternalURL }} swift_store_endpoint_type = internalURL - swift_store_user = service:glance + swift_store_user = service:{{ .ServiceUser }} swift_store_key = {{ .ServicePassword }} swift_store_region = regionTwo cinderBackup: diff --git a/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml b/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml index 0875804e7..6d3ef2443 100644 --- a/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml +++ b/examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml @@ -39,4 +39,6 @@ data: serviceUserGlance: regionTwo_glance serviceUserNeutron: regionTwo_neutron serviceUserNova: regionTwo_nova + serviceUserOctavia: regionTwo_octavia serviceUserPlacement: regionTwo_placement + serviceUserSwift: regionTwo_swift