Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add command for adding member role to trusts to the docs #1063

Merged
merged 2 commits into from
May 13, 2024
Merged

Add command for adding member role to trusts to the docs #1063

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f2ba3cc
Add command for adding member role to trusts
technowhizz May 9, 2024
b055171
Update doc/source/operations/upgrading.rst
technowhizz May 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions doc/source/operations/upgrading.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,21 @@ Some things to watch out for:
mysql -u root -p keystone
# Enter the database password when prompted.
SELECT * FROM trust_role WHERE trust_id = '<trust-id>' AND role_id = '<_member_-role-id>';

If you have trusts that need updating, you can add the required role to the trust with the following SQL command:

.. code-block:: sql

UPDATE trust_role
SET role_id = '<MEMBER-ROLE-ID>'
WHERE role_id = '<OLD-ROLE-ID>'
AND NOT EXISTS (
SELECT 1
FROM trust_role
WHERE trust_id = trust_role.trust_id
AND role_id = '<MEMBER-ROLE-ID>'
);
technowhizz marked this conversation as resolved.
Show resolved Hide resolved

* Policies may require the ``reader`` role rather than the non-standardised
``observer`` role. The following error was observed in Horizon: ``Policy doesn’t allow os_compute_api:os-simple-tenant-usage:show to be performed``,
when the user only had the observer role in the project. It is best to keep the observer role until all projects have the ``enforce_new_defaults``
Expand Down