commit 608b85f8617e1040a738bcecb6dbef26ed73cab1
author Ghanshyam <gmann@ghanshyammann.com> Wed Oct 25 20:05:39 2023 +0000
committer Ghanshyam <gmann@ghanshyammann.com> Wed Oct 25 20:05:39 2023 +0000
tree 7d57f229806e5caa7ff15a2f2d3d5e1ab058633a
parent 2f1856baf89618c799d0956c95335f3b47460b52

Revert "Revert "[S-RBAC] Switch to new policies by default""

This reverts commit 2f1856baf89618c799d0956c95335f3b47460b52.

Reason for revert:

Neutron bobcat (enabled new RBAC by default) is released now and devstack enabling the same in depends on change. This means every job will be tested with Neutron new RBAC by default. So now we can have a job disable the new default and test old default until they are being removed.

Change-Id: Iec97cba15e5bf5b973a0cdf5c24f47b99e31a276
Depends-On: https://review.opendev.org/c/openstack/devstack/+/899306

zuul.d/master_jobs.yaml

diff --git a/zuul.d/master_jobs.yaml b/zuul.d/master_jobs.yaml
index 39d1d89..dacf3d5 100644
--- a/zuul.d/master_jobs.yaml
+++ b/zuul.d/master_jobs.yaml
@@ -409,20 +409,15 @@
       - ^zuul.d/(?!(project)).*\.yaml
 
 - job:
-    name: neutron-tempest-plugin-openvswitch-enforce-scope-new-defaults
+    name: neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
     parent: neutron-tempest-plugin-openvswitch
     vars:
       devstack_localrc:
-        # Enabeling the scope and new defaults for services.
-        # NOTE: (gmann) We need to keep keystone scope check disable as
-        # services (except ironic) does not support the system scope and
-        # they need keystone to continue working with project scope. Until
-        # Keystone policies are changed to work for both system as well as
-        # for project scoped, we need to keep scope check disable for
-        # keystone.
-        NOVA_ENFORCE_SCOPE: true
-        GLANCE_ENFORCE_SCOPE: true
-        NEUTRON_ENFORCE_SCOPE: true
+        # Disabling the scope and new defaults for services to use old,
+        # deprecated policies
+        NOVA_ENFORCE_SCOPE: false
+        GLANCE_ENFORCE_SCOPE: false
+        NEUTRON_ENFORCE_SCOPE: false
 
 
 # TODO(slaweq): remove that job's definition as soon as new job

zuul.d/project.yaml

diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 2347c1b..d1d9717 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -5,7 +5,7 @@
         - neutron-tempest-plugin-linuxbridge
         - neutron-tempest-plugin-openvswitch
         - neutron-tempest-plugin-openvswitch-iptables_hybrid
-        - neutron-tempest-plugin-openvswitch-enforce-scope-new-defaults
+        - neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
         - neutron-tempest-plugin-ovn
         - neutron-tempest-plugin-designate-scenario
     gate:
@@ -14,7 +14,7 @@
         - neutron-tempest-plugin-openvswitch
         - neutron-tempest-plugin-ovn
         - neutron-tempest-plugin-openvswitch-iptables_hybrid
-        - neutron-tempest-plugin-openvswitch-enforce-scope-new-defaults
+        - neutron-tempest-plugin-openvswitch-enforce-scope-old-defaults
     #TODO(slaweq): Move neutron-tempest-plugin-dvr-multinode-scenario out of
     #              the experimental queue when it will be more stable
     experimental: