<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi!</div>
<div> </div>
<div>There was a new ’domain’ property added to OS::Keystone::Role (<a href="https://storyboard.openstack.org/#!/story/1684558"><font color="#0563C1"><u>https://storyboard.openstack.org/#!/story/1684558</u></font></a>, <a href="https://review.openstack.org/#/c/459033/"><font color="#0563C1"><u>https://review.openstack.org/#/c/459033/</u></font></a>).</div>
<div> </div>
<div>With “openstack role create” CLI command it is still possible to create roles with no associated domains; but it seems that the same cannot be done with heat templates.</div>
<div> </div>
<div>An example: if I create two roles, CliRole (with “openstack role create CliRole” command) and SimpleRole with the following heat template:</div>
<div> </div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">heat_template_version: 2015-04-30</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">description: Creates a role</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">resources:</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;"> role_resource:</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;"> type: OS::Keystone::Role</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;"> properties:</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;"> name: SimpleRole</span></font></div>
<div> </div>
<div>the result in the keystone database will be:</div>
<div> </div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">MariaDB [keystone]> select * from role;</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">+----------------------------------+------------------+-------+-----------+</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| id | name | extra | domain_id |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">+----------------------------------+------------------+-------+-----------+</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| 5de0eee4990e4a59b83dae93af9c0951 | SimpleRole | {} | default |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| 79472e6e1bf341208bd88e1c2dcf7f85 | CliRole | {} | <<null>> |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| 7dd5e4ea87e54a13897eb465fdd0e950 | heat_stack_owner | {} | <<null>> |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| 80fd61edbe8842a7abb47fd7c91ba9d7 | heat_stack_user | {} | <<null>> |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | {} | <<null>> |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">| e174c27e79b84ea392d28224eb0af7c9 | admin | {} | <<null>> |</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">+----------------------------------+------------------+-------+-----------+</span></font></div>
<div> </div>
<div>Should it be possible to create a role without associated domain with a heat template?</div>
<div> </div>
<div>-V.</div>
<div> </div>
</span></font>
</body>
</html>