After updating to Train from rocky (on stein we just performed the db-sync), we tried the new "keystone-status update check" command which says that the admin role is not immutable [*].

As far as I understand this is something that was done to prevent deleting/modifying the default roles (that could cause major problems).

But how am I supposed to fix this?

The "--immutable" option for the "openstack role set" command, documented at:

https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/role-v3.html

is not available in Train.

Thanks, Massimo

[*]