From 3fe3315b7c1d3f2eb7290579080b1097eebabad3 Mon Sep 17 00:00:00 2001 From: Benjamin Ludwig Date: Wed, 2 Sep 2026 12:25:23 +0200 Subject: [PATCH 1/2] [octavia] Override CPBMU endpoint policy with new role --- openstack/octavia/templates/etc/_policy.json.tpl | 4 +++- openstack/octavia/templates/octavia-seed.yaml | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/openstack/octavia/templates/etc/_policy.json.tpl b/openstack/octavia/templates/etc/_policy.json.tpl index ac75c6da6d7..88f6de46fe4 100644 --- a/openstack/octavia/templates/etc/_policy.json.tpl +++ b/openstack/octavia/templates/etc/_policy.json.tpl @@ -101,5 +101,7 @@ "os_load-balancer_api:amphora:get_stats": "rule:context_is_admin", "os_load-balancer_api:provider-flavor:get_all": "rule:context_is_admin", - "os_load-balancer_api:provider-availability-zone:get_all": "rule:context_is_admin" + "os_load-balancer_api:provider-availability-zone:get_all": "rule:context_is_admin", + + "os_load-balancer_api:member:put_cross_pool_members": "role:lbaas_cpbmu and rule:owner" } diff --git a/openstack/octavia/templates/octavia-seed.yaml b/openstack/octavia/templates/octavia-seed.yaml index b5d2a03c791..a4b9e02caf5 100644 --- a/openstack/octavia/templates/octavia-seed.yaml +++ b/openstack/octavia/templates/octavia-seed.yaml @@ -19,6 +19,7 @@ spec: - name: loadbalancer_poolmemberadmin - name: cloud_network_admin - name: cloud_keymanager_admin + - name: lbaas_cpbmu services: - name: octavia From 162ba42dfc27afe12966f210a83caa272753dc97 Mon Sep 17 00:00:00 2001 From: Benjamin Ludwig Date: Wed, 2 Sep 2026 12:26:07 +0200 Subject: [PATCH 2/2] [keystone] Blocklist Octavia's CPBMU endpoint role --- openstack/keystone/templates/etc/_policy.yaml.tpl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openstack/keystone/templates/etc/_policy.yaml.tpl b/openstack/keystone/templates/etc/_policy.yaml.tpl index 41c7f729b5c..bb03c7ecdae 100644 --- a/openstack/keystone/templates/etc/_policy.yaml.tpl +++ b/openstack/keystone/templates/etc/_policy.yaml.tpl @@ -59,7 +59,8 @@ 'cloud_identity_viewer':%(target.role.name)s or 'cloud_support_tools_viewer':%(target.role.name)s or 'cloud_email_admin':%(target.role.name)s or - 'cloud_inventory_viewer':%(target.role.name)s" + 'cloud_inventory_viewer':%(target.role.name)s or + 'lbaas_cpbmu':%(target.role.name)s" "blocklist_projects": "'{{required ".Values.api.cloudAdminProjectId is missing" .Values.api.cloudAdminProjectId}}':%(target.project.id)s"