Re: [openstack-dev] [all] Policy rules for APIs based on "domain_id"

2017-06-20 Thread Lance Bragstad
Domain support hasn't really been adopted across various OpenStack projects, yet. Ocata was the first release where we had a v3-only jenkins job set up for projects to run against (domains are a v3-only concept in keystone and don't really exist in v2.0). I think it would be great to push on some

Re: [openstack-dev] [all] Policy rules for APIs based on "domain_id"

2017-06-20 Thread Valeriy Ponomaryov
Also, one more additional kind of "feature-request" is to be able to filter each project's entities per domain as well as we can do it with project/tenant now. So, as a result, we will be able to configure different "list" APIs to return objects grouped by either domain or project. Thoughts? On

Re: [openstack-dev] [all] Policy rules for APIs based on "domain_id"

2017-06-20 Thread Adam Heczko
Hello Valeriy, agree, that would be very useful. I think that this deserves attention and cross project discussion. Maybe a community goal process [2] is a valid path forward in this regard. [2] https://governance.openstack.org/tc/goals/ On Tue, Jun 20, 2017 at 11:15 AM, Valeriy Ponomaryov <

[openstack-dev] [all] Policy rules for APIs based on "domain_id"

2017-06-20 Thread Valeriy Ponomaryov
Hello OpenStackers, Wanted to pay some attention to one of restrictions in OpenStack. It came out, that it is impossible to define policy rules for API services based on "domain_id". As far as I know, only Keystone supports it. So, it is unclear whether it is intended or it is just technical