---
# System prepended metadata

title: Deployment SRBAC Implementation Details

---

# Deployment SRBAC Implementation Details

This document serves as a reference for teams to better understand what is needed to implement SRBAC within their deployment capabilities.

### Deployment Backlog

Work items for the deployment side of the SRBAC initiative, as it pertains to the TripelO, can be found [here](https://trello.com/b/UX3Rmy9A/srbac-hackfest). The aforementioned trello board covers all of our puppet and heat template integrations.

 
##### All changes will need to land in master, then be cherry-picked to Wallaby.

#### Puppet Integration Work

In the `policy.pp` file. We add the new parameter for `enforce_new_defaults` and `enforce_scope`. 

> While the `policy.pp` file is the typical policy configuration file, this may be different based on a given service implementation. 

**Step 1** Ensure the section comment is added:

``` ruby
# [*enforce_scope*]
#  (Optional) Whether or not to enforce scope when evaluating policies.
#  Defaults to $::os_service_default.
#  
# [*enforce_new_defaults*]
#  (Optional) Whether or not to use old deprecated defaults when evaluating
#  policies.
#  Defaults to $::os_service_default.
```

**Step 2** Add the new options to the policy class:

``` ruby
class ${SERVICE}::policy (
  $enforce_scope        = $::os_service_default,
  $enforce_new_defaults = $::os_service_default,
  $policies             = {},
  $policy_path          = '/etc/${SERVICE}/policy.yaml',
)
```

**Step 3** Ensure the oslo policy configuration section supports the new options:

``` ruby
oslo::policy { '${SERVICE}_config':
  enforce_scope        => $enforce_scope,
  enforce_new_defaults => $enforce_new_defaults,
  policy_file          => $policy_path
}
```

**Step 4** Add a release note:

``` yaml
---
features:
  - |
    Added `enforce_secure_rbac` and `enforce_scope` parameters
    to enable enforcing authorization based on common RBAC
    `personas <https://docs.openstack.org/keystone/latest/admin/service-api-protection.html#roles-definitions>`_.
```

**Step 5** Propose your change for review

**Step 6** Update the change topic to `secure-rbac`.

This helps us track the effort [holistically](https://review.opendev.org/q/topic:secure-rbac).


#### Examples

- [puppet/keystone](https://review.opendev.org/c/openstack/puppet-keystone/+/781429)
- [puppet/glance](https://review.opendev.org/c/openstack/puppet-glance/+/783605)

### TripleO Heat Template Integration Work

**Step 7** Checkout the change for adding the secure RBAC global parameter:

``` 
$ git review -d 806449
```

**Step 8** Update the service configuration settings to enable secure RBAC when `EnforceSecureRbac` is `true`:

``` yaml
config_settings:
  map_merge:
  - if:
    - {get_param: EnforceSecureRbac}
    - ${SERVICE}::policy::enforce_new_defaults: true
      ${SERVICE}::policy::enforce_scope: true
```

**Step 9** Add a release note for the changes:

``` yaml
---
features:
  - |
    ${SERVICE} can now be configured to support secure RBAC using
    ``EnforceSecureRbac``. Note, you may not be able to use this until
    ${SERVICE} upstream has support for common RBAC `personas <https://docs.openstack.org/keystone/latest/admin/service-api-protection.html#roles-definitions>`_.
```

**Step 10** Propose your change for review

**Step 11** Update the change topic to `secure-rbac`.

This helps us track the effort [holistically](https://review.opendev.org/q/topic:secure-rbac).

#### Examples

- [tripleo-heat-templates keystone](https://review.opendev.org/c/openstack/tripleo-heat-templates/+/804257)
- [tripleo-heat-templates glance](https://review.opendev.org/c/openstack/tripleo-heat-templates/+/783623)
- [tripleo-heat-templates nova](https://review.opendev.org/c/openstack/tripleo-heat-templates/+/804254)