Stabilize Domain Manager Role Standard #586

markus-hentsch · 2024-05-07T11:23:37Z

Moves Domain Manager Standard from Draft to Stable

markus-hentsch · 2024-05-07T11:23:59Z

~~Currently blocked by #585~~ (obsolete)

Currently blocked by:

figure out which Keystone release is the earliest that supports enforce_scope/enforce_new_defaults in conjunction with the Domain Manager implementation of this standard
- if it is 2024.2, wait until it is released and couple the standard to this version
- if it is a version already released for the next SCS release, stabilize this standard

markus-hentsch · 2024-08-30T13:49:37Z

~~Currently blocked by #585~~ (obsolete)

Currently blocked by:

figure out which Keystone release is the earliest that supports enforce_scope/enforce_new_defaults in conjunction with the Domain Manager implementation of this standard

if it is 2024.2, wait until it is released and couple the standard to this version

if it is a version already released for the next SCS release, stabilize this standard

Since the upcoming SCS release R7 will be based on 2024.1 ("Caracal"), I tested the stable/2024.1 branch of Keystone with the enforce_scope/enforce_new_defaults options on my DevStack together with the Domain Manager standard policy rules and can confirm it works without issue. Hence:

the limitation about Domain Managers being able to see all domains will not be an issue anymore in R7 (2024.1 contains the bugfix for that)
we do not need to require disabling enforce_scope/enforce_new_defaults for the SCS Domain Manager implementation to work
the transition from SCS implementation to native Domain Manager in future OpenStack releases will be seamless for users (same behavior)

Since the native integration of Domain Manager in upstream OpenStack won't be available before 2024.2 ("Dalmatian"), we should stabilize this standard for SCS R7 to have a transitional solution and feature availability until an SCS release will be based on 2024.2 or later.

I adjusted the standard accordingly and added a note about the upcoming native integration.

markus-hentsch · 2024-09-11T09:28:29Z

Moving this PR back to draft as a result of today's IaaS community call discussion:

Standard is still relevant with respect to the concept, as this does not change. Our implementation with policy.yaml will become obsolete with 2024.2 -- move the description of implementation and a note that the downstrweam implementation should be dropped with the upgrade to 2024.2 to the "test and implementation notes" document. Merge this standard as stable as soon as this is done. Could be included as a recommended requirement in SCS-compatible IaaS-v5 (late Oct/early Nov).

markus-hentsch · 2024-09-17T12:12:41Z

Moving this PR back to draft as a result of today's IaaS community call discussion:

Standard is still relevant with respect to the concept, as this does not change. Our implementation with policy.yaml will become obsolete with 2024.2 -- move the description of implementation and a note that the downstrweam implementation should be dropped with the upgrade to 2024.2 to the "test and implementation notes" document. Merge this standard as stable as soon as this is done. Could be included as a recommended requirement in SCS-compatible IaaS-v5 (late Oct/early Nov).

I split the standard into standard and implementation notes and moved the SCS downstream implementation using API policies into the implementation notes. I rewrote the standard section and implementation notes' introduction to differentiate between OpenStack Keystone releases and also integrated some upgrade instructions about dropping the old policies.

With this, the standard should now be fully agnostic concerning the Keystone version and can be applied universally.

Removing the draft marker.

josephineSei · 2024-09-18T06:44:18Z

Standards/scs-0302-v1-domain-manager-role.md

@@ -1,17 +1,27 @@
 ---
 title: Domain Manager configuration for Keystone
 type: Standard
-status: Draft
+status: Stable
+stabilized_at: 2024-08-30


Please do not forget to update the date, when merging :)

Oh and did we discuss to stabilize this?

Here: https://github.com/SovereignCloudStack/minutes/blob/main/iaas/20240911.md#domain-manager-standard-markus-hentsch

josephineSei

Overall a good split. I have made a few comments inline.

Standards/scs-0302-v1-domain-manager-role.md

josephineSei · 2024-09-18T10:29:16Z

Standards/scs-0302-v1-domain-manager-role.md

@@ -1,17 +1,27 @@
 ---
 title: Domain Manager configuration for Keystone
 type: Standard
-status: Draft
+status: Stable
+stabilized_at: 2024-08-30


Oh and did we discuss to stabilize this?

Standards/scs-0302-w1-domain-manager-implementation-notes.md

josephineSei

Overall I think this is in a good shape. Just that one line removal please ;)

Standards/scs-0302-w1-domain-manager-implementation-notes.md

mbuechse · 2024-11-06T19:20:26Z

Note that the link check only fails because this isn't yet merged...

Moves Domain Manager Standard from Draft to Stable Signed-off-by: Markus Hentsch <[email protected]>

Signed-off-by: Markus Hentsch <[email protected]>

Split standard into standard document and implementation notes. Move the downstream policy-based implementation into the implementation notes and differentiate instructions based on the Keystone release used. Add the upstream spec to related documents and update the standard according to the latest changes. Signed-off-by: Markus Hentsch <[email protected]>

Signed-off-by: Markus Hentsch <[email protected]>

Co-authored-by: josephineSei <[email protected]> Signed-off-by: Markus Hentsch <[email protected]>

Signed-off-by: Matthias Büchse <[email protected]>

markus-hentsch force-pushed the domain-manager-stabilize branch 3 times, most recently from 1df5d77 to c93a237 Compare August 30, 2024 14:47

markus-hentsch added the SCS-VP10 Related to tender lot SCS-VP10 label Aug 30, 2024

markus-hentsch marked this pull request as ready for review August 30, 2024 15:00

This was referenced Aug 30, 2024

Update Domain Manager instructions to reflect latest changes SovereignCloudStack/docs#238

Draft

Discontinue Domain Manager standard once OpenStack 2024.2 lands in SCS #723

Open

markus-hentsch marked this pull request as draft September 11, 2024 09:23

markus-hentsch marked this pull request as ready for review September 17, 2024 12:12

markus-hentsch requested a review from josephineSei September 17, 2024 12:12

josephineSei reviewed Sep 18, 2024

View reviewed changes

josephineSei approved these changes Sep 23, 2024

View reviewed changes

Standards/scs-0302-w1-domain-manager-implementation-notes.md Show resolved Hide resolved

mbuechse mentioned this pull request Nov 6, 2024

Stabilize standards for SCS-compatible IaaS v5 #807

Open

gtema force-pushed the domain-manager-stabilize branch from 84b1938 to ea52a73 Compare November 6, 2024 14:56

gtema approved these changes Nov 6, 2024

View reviewed changes

markus-hentsch and others added 9 commits November 13, 2024 09:40

Stabilize Domain Manager Role Standard

3a085b5

Moves Domain Manager Standard from Draft to Stable Signed-off-by: Markus Hentsch <[email protected]>

Restructure standard to align with updated template

2deeeb0

Signed-off-by: Markus Hentsch <[email protected]>

Remove outdated limitation not applicable to 2024.1

8972b9e

Signed-off-by: Markus Hentsch <[email protected]>

Add info admonition banner for upcoming native integration

cfd4815

Signed-off-by: Markus Hentsch <[email protected]>

Add stabilization date

0589e42

Signed-off-by: Markus Hentsch <[email protected]>

Be more explicit about upgrade to native integration

5fbf13c

Signed-off-by: Markus Hentsch <[email protected]>

Address review comments

be64f62

Signed-off-by: Markus Hentsch <[email protected]>

Update Standards/scs-0302-w1-domain-manager-implementation-notes.md

c67d6e5

Co-authored-by: josephineSei <[email protected]> Signed-off-by: Markus Hentsch <[email protected]>

mbuechse added 2 commits November 13, 2024 09:40

Change stabilized_at to a closer date (not in the past)

90400d2

Signed-off-by: Matthias Büchse <[email protected]>

update date again, harmonize with others

56d6354

Signed-off-by: Matthias Büchse <[email protected]>

mbuechse force-pushed the domain-manager-stabilize branch from 6c8dc2a to 56d6354 Compare November 13, 2024 09:40

mbuechse merged commit 0cccea1 into main Nov 13, 2024
7 of 8 checks passed

mbuechse deleted the domain-manager-stabilize branch November 13, 2024 09:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Stabilize Domain Manager Role Standard #586

Stabilize Domain Manager Role Standard #586

markus-hentsch commented May 7, 2024

markus-hentsch commented May 7, 2024 •

edited

Loading

markus-hentsch commented Aug 30, 2024

markus-hentsch commented Sep 11, 2024

markus-hentsch commented Sep 17, 2024

josephineSei Sep 18, 2024

josephineSei Sep 18, 2024

markus-hentsch Sep 20, 2024

josephineSei left a comment

josephineSei Sep 18, 2024

josephineSei left a comment

mbuechse commented Nov 6, 2024

Stabilize Domain Manager Role Standard #586

Stabilize Domain Manager Role Standard #586

Conversation

markus-hentsch commented May 7, 2024

markus-hentsch commented May 7, 2024 • edited Loading

markus-hentsch commented Aug 30, 2024

markus-hentsch commented Sep 11, 2024

markus-hentsch commented Sep 17, 2024

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

markus-hentsch Sep 20, 2024

Choose a reason for hiding this comment

josephineSei left a comment

Choose a reason for hiding this comment

josephineSei Sep 18, 2024

Choose a reason for hiding this comment

josephineSei left a comment

Choose a reason for hiding this comment

mbuechse commented Nov 6, 2024

markus-hentsch commented May 7, 2024 •

edited

Loading