Public bug reported:
Since Wallaby, you don't need to give Horizon the full set of policy
rules you are using for cinder (etc). Just the non-default rules, the
same as you have configured for cinder (etc) itself, is enough. See
https://docs.openstack.org/releasenotes/horizon/wallaby.html under
19.1.0 New Features.
It is also mentioned that "they are synced with registered defaults of
back-end services before the horizon release." So they are present in
Horizon out of the box.
Then I would expect that Horizon knows where these default policies are,
and would use them. As of the Yoga version, which I'm using, this
doesn't seem to be the case, however.
One needs to include something like this in local_settings.py:
DEFAULT_POLICY_FILES = {
'identity':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/keystone.yaml',
'compute':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/nova.yaml',
'volume':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/cinder.yaml',
'image':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/glance.yaml',
'orchestration':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/heat.yaml',
'network':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/neutron.yaml',
}
This looks totally like it can't have been meant this way. So, how
should it be done?
There is a further issue. The defaults built into the yoga version of
Horizon match those of the yoga services. What if you're using, say,
cinder of a different version? How do you get the default policies then?
There is a mention of
To update these files, run the following command:
python manage.py dump_default_policies \
--namespace <service> \
--output-file openstack_dashboard/conf/default_policies/<service>.yaml
<service> must be a namespace under oslo.policy.policies to query and
we use "keystone", "nova", "cinder", "neutron" and "glance".
This manage.py script seems to be part of the horizon source only, and not of
the installed Horizon. So you cannot run this command in the actual openstack
installation.
Furthermore, even if it was installed, it requires that nova, cinder, glance,
neutron etc, are installed into the same container where horizon is, because it
needs access to the python code of these services.
So this is not really workable.
So how should I get the default policies for horizon, given separate
containers in which nova, cinder etc are installed?
This can be considered a feature request, since I suspect that currently
the answer should be "this is not possible".
** Affects: horizon
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/2039265
Title:
Insufficient support for creating default policy rules
Status in OpenStack Dashboard (Horizon):
New
Bug description:
Since Wallaby, you don't need to give Horizon the full set of policy
rules you are using for cinder (etc). Just the non-default rules, the
same as you have configured for cinder (etc) itself, is enough. See
https://docs.openstack.org/releasenotes/horizon/wallaby.html under
19.1.0 New Features.
It is also mentioned that "they are synced with registered defaults of
back-end services before the horizon release." So they are present in
Horizon out of the box.
Then I would expect that Horizon knows where these default policies
are, and would use them. As of the Yoga version, which I'm using, this
doesn't seem to be the case, however.
One needs to include something like this in local_settings.py:
DEFAULT_POLICY_FILES = {
'identity':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/keystone.yaml',
'compute':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/nova.yaml',
'volume':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/cinder.yaml',
'image':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/glance.yaml',
'orchestration':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/heat.yaml',
'network':
'/usr/lib/python3/dist-packages/openstack_dashboard/conf/default_policies/neutron.yaml',
}
This looks totally like it can't have been meant this way. So, how
should it be done?
There is a further issue. The defaults built into the yoga version of
Horizon match those of the yoga services. What if you're using, say,
cinder of a different version? How do you get the default policies
then?
There is a mention of
To update these files, run the following command:
python manage.py dump_default_policies \
--namespace <service> \
--output-file openstack_dashboard/conf/default_policies/<service>.yaml
<service> must be a namespace under oslo.policy.policies to query and
we use "keystone", "nova", "cinder", "neutron" and "glance".
This manage.py script seems to be part of the horizon source only, and not of
the installed Horizon. So you cannot run this command in the actual openstack
installation.
Furthermore, even if it was installed, it requires that nova, cinder, glance,
neutron etc, are installed into the same container where horizon is, because it
needs access to the python code of these services.
So this is not really workable.
So how should I get the default policies for horizon, given separate
containers in which nova, cinder etc are installed?
This can be considered a feature request, since I suspect that
currently the answer should be "this is not possible".
To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/2039265/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
