[SKMO] Wire leaf KeystoneAPI to admin-two identity

examples/va/multi-namespace-skmo/README.md

@@ -73,8 +73,13 @@ Before deploying, update the following files:
   - `leafRegion`: The region name for the leaf control plane (e.g. `regionTwo`)
   - `keystoneInternalURL` / `keystonePublicURL`: The central Keystone
     endpoint URLs reachable from the leaf region
-  - `leafAdminUser` / `leafAdminProject`: Admin credentials for the leaf
-    region in the central Keystone
+  - `leafAdminUser` / `leafAdminProject` / `leafAdminPasswordKey`: Leaf admin
+    identity in the central Keystone (`admin-two` / `admin` / `AdminPassword`
+    by default). Wired into the leaf OSCP `KeystoneAPI` via kustomize
+    replacements (`adminUser`, `adminProject`, `passwordSelectors.admin`).
+  - `serviceUser*`: Leaf service user names in central Keystone (e.g.
+    `regionTwo_nova`). Wired into each service's `serviceUser` field so leaf
+    `osp-secret` passwords do not collide with the central region's users.
 
 ## Stages
 

examples/va/multi-namespace-skmo/control-plane.md

@@ -165,17 +165,20 @@ oc -n openstack rsh openstackclient \
   openstack endpoint create --region regionTwo identity internal <keystoneInternalURL>
 ```
 
-Create the leaf admin project and user in the central Keystone. Replace
-`<leafAdminPassword>` with the value of the `leafAdminPasswordKey` entry from
-`osp-secret` in the `openstack2` namespace:
+Create the leaf admin user in the central Keystone. Replace the placeholders
+from `control-plane2/skmo-values.yaml` (`leafAdminUser`, `leafAdminProject`;
+defaults: `admin-two`, `admin`). Replace `<leafAdminPassword>` with the value
+of the `leafAdminPasswordKey` entry from `osp-secret` in the `openstack2`
+namespace:
 ```
-oc -n openstack rsh openstackclient openstack project create leafadmin
+oc -n openstack rsh openstackclient \
+  openstack user create --domain Default --password <leafAdminPassword> <leafAdminUser>
 
 oc -n openstack rsh openstackclient \
-  openstack user create --domain Default --password <leafAdminPassword> leafadmin
+  openstack role add --project <leafAdminProject> --user <leafAdminUser> admin
 
 oc -n openstack rsh openstackclient \
-  openstack role add --project leafadmin --user leafadmin admin
+  openstack role add --system all --user <leafAdminUser> --user-domain Default admin
 ```
 
 Add the central region's root CA certificates to the leaf CA bundle secret so

examples/va/multi-namespace-skmo/control-plane2/kustomization.yaml

@@ -91,6 +91,127 @@ replacements:
           - spec.keystone.template.region
         options:
           create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.leafAdminUser
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.keystone.template.adminUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.leafAdminProject
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.keystone.template.adminProject
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.leafAdminPasswordKey
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.keystone.template.passwordSelectors.admin
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserBarbican
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.barbican.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserCinder
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.cinder.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserGlance
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.glance.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserNeutron
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.neutron.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserNova
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.nova.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserOctavia
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.octavia.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserPlacement
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.placement.template.serviceUser
+        options:
+          create: true
+  - source:
+      kind: ConfigMap
+      name: skmo-values
+      fieldPath: data.serviceUserSwift
+    targets:
+      - select:
+          kind: OpenStackControlPlane
+        fieldPaths:
+          - spec.swift.template.swiftProxy.serviceUser
+        options:
+          create: true
   - source:
       kind: ConfigMap
       name: skmo-values

examples/va/multi-namespace-skmo/control-plane2/service-values.yaml

@@ -32,7 +32,7 @@ data:
       swift_store_auth_version = 3
       swift_store_auth_address = {{ .KeystoneInternalURL }}
       swift_store_endpoint_type = internalURL
-      swift_store_user = service:glance
+      swift_store_user = service:{{ .ServiceUser }}
       swift_store_key = {{ .ServicePassword }}
       swift_store_region = regionTwo
   cinderBackup:

examples/va/multi-namespace-skmo/control-plane2/skmo-values.yaml

@@ -39,4 +39,6 @@ data:
   serviceUserGlance: regionTwo_glance
   serviceUserNeutron: regionTwo_neutron
   serviceUserNova: regionTwo_nova
+  serviceUserOctavia: regionTwo_octavia
   serviceUserPlacement: regionTwo_placement
+  serviceUserSwift: regionTwo_swift