[octavia] Override CPBMU endpoint policy with new role - #12709
[octavia] Override CPBMU endpoint policy with new role#12709BenjaminLudwigSAP wants to merge 2 commits into
Conversation
| 'cloud_email_admin':%(target.role.name)s or | ||
| 'cloud_inventory_viewer':%(target.role.name)s" | ||
| 'cloud_inventory_viewer':%(target.role.name)s or | ||
| 'lbaas_cpbmu':%(target.role.name)s" |
There was a problem hiding this comment.
In our today's setup, adding the role to the list of blocklisted roles means that only users from domain ccadmin and Default will be able to get an assignment with it. Is it what you want to do?
If you are wondering why - before it was not the case, but then September 1 happened.
There was a problem hiding this comment.
I want all users to be able to have the role, but only us cloud admins should be able to give the role to them (so not even their project admins). I was told this is how to implement that behavior. Did I misunderstand?
There was a problem hiding this comment.
Context: This is for enabling usage of the CPBMU endpoint project by project.
There was a problem hiding this comment.
I want all users to be able to have the role, but only us cloud admins should be able to give the role to them (so not even their project admins). I was told this is how to implement that behavior. Did I misunderstand?
You understanding was correct until September 1, became incorrect after September 1.
We currently don't do what you describe. We can start doing it again, for that we need "restricted_roles" or something.
5 participants
No description provided.