From 3fe3315b7c1d3f2eb7290579080b1097eebabad3 Mon Sep 17 00:00:00 2001 From: Benjamin Ludwig Date: Wed, 2 Sep 2026 12:25:23 +0200 Subject: [PATCH 1/4] [octavia] Override CPBMU endpoint policy with new role --- openstack/octavia/templates/etc/_policy.json.tpl | 4 +++- openstack/octavia/templates/octavia-seed.yaml | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/openstack/octavia/templates/etc/_policy.json.tpl b/openstack/octavia/templates/etc/_policy.json.tpl index ac75c6da6d7..88f6de46fe4 100644 --- a/openstack/octavia/templates/etc/_policy.json.tpl +++ b/openstack/octavia/templates/etc/_policy.json.tpl @@ -101,5 +101,7 @@ "os_load-balancer_api:amphora:get_stats": "rule:context_is_admin", "os_load-balancer_api:provider-flavor:get_all": "rule:context_is_admin", - "os_load-balancer_api:provider-availability-zone:get_all": "rule:context_is_admin" + "os_load-balancer_api:provider-availability-zone:get_all": "rule:context_is_admin", + + "os_load-balancer_api:member:put_cross_pool_members": "role:lbaas_cpbmu and rule:owner" } diff --git a/openstack/octavia/templates/octavia-seed.yaml b/openstack/octavia/templates/octavia-seed.yaml index b5d2a03c791..a4b9e02caf5 100644 --- a/openstack/octavia/templates/octavia-seed.yaml +++ b/openstack/octavia/templates/octavia-seed.yaml @@ -19,6 +19,7 @@ spec: - name: loadbalancer_poolmemberadmin - name: cloud_network_admin - name: cloud_keymanager_admin + - name: lbaas_cpbmu services: - name: octavia From 162ba42dfc27afe12966f210a83caa272753dc97 Mon Sep 17 00:00:00 2001 From: Benjamin Ludwig Date: Wed, 2 Sep 2026 12:26:07 +0200 Subject: [PATCH 2/4] [keystone] Blocklist Octavia's CPBMU endpoint role --- openstack/keystone/templates/etc/_policy.yaml.tpl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openstack/keystone/templates/etc/_policy.yaml.tpl b/openstack/keystone/templates/etc/_policy.yaml.tpl index 41c7f729b5c..bb03c7ecdae 100644 --- a/openstack/keystone/templates/etc/_policy.yaml.tpl +++ b/openstack/keystone/templates/etc/_policy.yaml.tpl @@ -59,7 +59,8 @@ 'cloud_identity_viewer':%(target.role.name)s or 'cloud_support_tools_viewer':%(target.role.name)s or 'cloud_email_admin':%(target.role.name)s or - 'cloud_inventory_viewer':%(target.role.name)s" + 'cloud_inventory_viewer':%(target.role.name)s or + 'lbaas_cpbmu':%(target.role.name)s" "blocklist_projects": "'{{required ".Values.api.cloudAdminProjectId is missing" .Values.api.cloudAdminProjectId}}':%(target.project.id)s" From 373b5a9b4970de4bc833c67cf1b06633bfbf0fd5 Mon Sep 17 00:00:00 2001 From: Maurice Escher Date: Tue, 15 Sep 2026 17:05:47 +0200 Subject: [PATCH 3/4] Revert "[keystone] Blocklist Octavia's CPBMU endpoint role" This reverts commit 162ba42dfc27afe12966f210a83caa272753dc97. --- openstack/keystone/templates/etc/_policy.yaml.tpl | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/openstack/keystone/templates/etc/_policy.yaml.tpl b/openstack/keystone/templates/etc/_policy.yaml.tpl index bb03c7ecdae..41c7f729b5c 100644 --- a/openstack/keystone/templates/etc/_policy.yaml.tpl +++ b/openstack/keystone/templates/etc/_policy.yaml.tpl @@ -59,8 +59,7 @@ 'cloud_identity_viewer':%(target.role.name)s or 'cloud_support_tools_viewer':%(target.role.name)s or 'cloud_email_admin':%(target.role.name)s or - 'cloud_inventory_viewer':%(target.role.name)s or - 'lbaas_cpbmu':%(target.role.name)s" + 'cloud_inventory_viewer':%(target.role.name)s" "blocklist_projects": "'{{required ".Values.api.cloudAdminProjectId is missing" .Values.api.cloudAdminProjectId}}':%(target.project.id)s" From e3c3da7fc31f7bc8818a612b30abe702adec6567 Mon Sep 17 00:00:00 2001 From: Maurice Escher Date: Tue, 15 Sep 2026 17:01:09 +0200 Subject: [PATCH 4/4] [octavia] make lbaas CPBMU access project-ID based Replace the role-based CPBMU access (introduced for os_load-balancer_api:member:put_cross_pool_members) with a configurable list of project IDs, reverting the Octavia seed role additions. - Add early_lbaas_cpbmu_access_project_ids (default: []) to openstack/octavia/values.yaml. - Render os_load-balancer_api:member:put_cross_pool_members as an OR of project_id: for each configured ID, or an explicit deny ("!") when the list is empty/unset. - Add representative multi-ID fixture values to openstack/octavia/ci/test-values.yaml. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- openstack/octavia/ci/test-values.yaml | 4 ++++ openstack/octavia/templates/etc/_policy.json.tpl | 3 +-- openstack/octavia/templates/octavia-seed.yaml | 1 - openstack/octavia/values.yaml | 3 +++ 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/openstack/octavia/ci/test-values.yaml b/openstack/octavia/ci/test-values.yaml index cb02f7c80f8..42c970d4095 100644 --- a/openstack/octavia/ci/test-values.yaml +++ b/openstack/octavia/ci/test-values.yaml @@ -13,6 +13,10 @@ global: imageVersion: train +early_lbaas_cpbmu_access_project_ids: + - project-a + - project-b + mariadb: root_password: topSecret users: diff --git a/openstack/octavia/templates/etc/_policy.json.tpl b/openstack/octavia/templates/etc/_policy.json.tpl index 88f6de46fe4..d55721bf1d1 100644 --- a/openstack/octavia/templates/etc/_policy.json.tpl +++ b/openstack/octavia/templates/etc/_policy.json.tpl @@ -102,6 +102,5 @@ "os_load-balancer_api:provider-flavor:get_all": "rule:context_is_admin", "os_load-balancer_api:provider-availability-zone:get_all": "rule:context_is_admin", - - "os_load-balancer_api:member:put_cross_pool_members": "role:lbaas_cpbmu and rule:owner" + "os_load-balancer_api:member:put_cross_pool_members": "{{- if .Values.early_lbaas_cpbmu_access_project_ids }}{{ range $i, $projectID := .Values.early_lbaas_cpbmu_access_project_ids }}{{ if $i }} or {{ end }}project_id:{{ $projectID }}{{ end }}{{- else }}!{{- end }}" } diff --git a/openstack/octavia/templates/octavia-seed.yaml b/openstack/octavia/templates/octavia-seed.yaml index a4b9e02caf5..b5d2a03c791 100644 --- a/openstack/octavia/templates/octavia-seed.yaml +++ b/openstack/octavia/templates/octavia-seed.yaml @@ -19,7 +19,6 @@ spec: - name: loadbalancer_poolmemberadmin - name: cloud_network_admin - name: cloud_keymanager_admin - - name: lbaas_cpbmu services: - name: octavia diff --git a/openstack/octavia/values.yaml b/openstack/octavia/values.yaml index 7f05c712b07..d70a4f10968 100644 --- a/openstack/octavia/values.yaml +++ b/openstack/octavia/values.yaml @@ -13,6 +13,9 @@ owner-info: api_port_internal: 9876 api_backdoor: false +# Project IDs allowed to use the early LBaaS CPBMU API. +early_lbaas_cpbmu_access_project_ids: [] + rbac: enabled: true