override nova reader role to also accept member

msherman64 · msherman64 · commit dab346ed518a · 2025-05-30T15:37:01.000-05:00
diff --git a/site-config/node_custom_config/nova/policy.yaml b/site-config/node_custom_config/nova/policy.yaml
@@ -0,0 +1,3 @@
+# Original: #"project_reader_api": "role:reader and project_id:%(project_id)s"
+# replace due to keystone app credential not honoring implicit roles
+"project_reader_api": "(role:reader or role:member) and project_id:%(project_id)s"

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# Original: #"project_reader_api": "role:reader and project_id:%(project_id)s"`
	`2`	`+# replace due to keystone app credential not honoring implicit roles`
	`3`	`+"project_reader_api": "(role:reader or role:member) and project_id:%(project_id)s"`