---- On Fri, 06 Sep 2024 18:13:03 -0700 melanie witt wrote ---

Hey everyone,

I noticed that the cyborg-tempest (non-voting) CI job began failing on the master branch sometime on 2024-09-03:

https://zuul.opendev.org/t/openstack/builds?job_name=cyborg-tempest&project=openstack/nova

The errors I see in the test result report are policy related, for example:

Details: {'error_message': '{"faultcode": "Server", "faultstring": "\\"cyborg:device_profile:create\\": \\"rule:system_admin_api\\" requires a scope of [\'system\'], request was made with project scope.", "debuginfo": null}'}

I'm guessing this is related to the recent "oslo.policy 4.4.0 enable the RBAC new defaults by default" change [1]:

https://review.opendev.org/c/openstack/requirements/+/925464

The job is non-voting so it's not blocking anything, but it would be great if someone knows the best way to fix it.

Thanks, melwitt, for reporting. Yes this is related to oslo.policy 4.4.0 which unhides the bug in cyborg RBAC where we need to drop the system scope from cyborg policies. I am fixing the same in below change (this might need more test updates which I will fix soon) - https://review.opendev.org/c/openstack/cyborg/+/928711 -gmann

-melwitt

[1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack....