)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"change_message_id":"f6e014e3517cd7b9fb529d10e03123bb244c81c0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"c42aec6f_554019f9","updated":"2025-06-26 09:16:01.000000000","message":"so looks like indeed is_cloud_admin check is always True simply because there\u0027s neither \u0027cloud_admin\u0027, nor \u0027default\u0027 rule in identity policies.\nhttps://opendev.org/openstack/horizon/src/commit/fd47470d36d4242e7db1b02190faee62551e1f38/openstack_auth/policy.py#L252-L283\n\nsame is for \n```\n2025-06-25 17:24:01.619343 DEBUG oslo_policy.policy enforce: rule\u003d\"cloud_admin\" creds\u003d{\"domain_id\": \"default\", \"is_admin\": true, \"project_id\": null, \"project_name\": null, \"roles\": [\"manager\", \"member\", \"admin\", \"reader\"], \"tenant_id\": null, \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\", \"username\": \"admin\"} target\u003d{\"domain_id\": \"default\", \"group.domain_id\": \"default\", \"project.domain_id\": \"default\", \"project.id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user.domain_id\": \"default\", \"user.id\": \"893450730d2e4ef2b869e3ad983f066c\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\"}\n\n2025-06-25 17:24:01.619465 DEBUG oslo_policy.policy Rule [cloud_admin] does not exist\n\n2025-06-25 17:24:01.619927 DEBUG oslo_policy.policy enforce: rule\u003d\"default\" creds\u003d{\"domain_id\": \"default\", \"is_admin\": true, \"project_id\": null, \"project_name\": null, \"roles\": [\"manager\", \"member\", \"admin\", \"reader\"], \"tenant_id\": null, \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\", \"username\": \"admin\"} target\u003d{\"domain_id\": \"default\", \"group.domain_id\": \"default\", \"project.domain_id\": \"default\", \"project.id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user.domain_id\": \"default\", \"user.id\": \"893450730d2e4ef2b869e3ad983f066c\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\"}\n\n2025-06-25 17:24:01.620065 DEBUG oslo_policy.policy Rule [default] does not exist\n\n2025-06-25 17:24:01.620544 DEBUG oslo_policy.policy enforce: rule\u003d\"cloud_admin\" creds\u003d{\"domain_id\": \"default\", \"is_admin\": true, \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_name\": \"admin\", \"roles\": [\"manager\", \"member\", \"admin\", \"reader\"], \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\", \"username\": \"admin\"} target\u003d{\"domain_id\": \"default\", \"group.domain_id\": \"default\", \"project.domain_id\": \"default\", \"project.id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user.domain_id\": \"default\", \"user.id\": \"893450730d2e4ef2b869e3ad983f066c\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\"}\n\n2025-06-25 17:24:01.620655 DEBUG oslo_policy.policy Rule [cloud_admin] does not exist\n\n2025-06-25 17:24:01.621125 DEBUG oslo_policy.policy enforce: rule\u003d\"default\" creds\u003d{\"domain_id\": \"default\", \"is_admin\": true, \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_name\": \"admin\", \"roles\": [\"manager\", \"member\", \"admin\", \"reader\"], \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\", \"username\": \"admin\"} target\u003d{\"domain_id\": \"default\", \"group.domain_id\": \"default\", \"project.domain_id\": \"default\", \"project.id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"project_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"tenant_id\": \"0a15f1c8be2642d6a73cb923a5e17e56\", \"user.domain_id\": \"default\", \"user.id\": \"893450730d2e4ef2b869e3ad983f066c\", \"user_id\": \"893450730d2e4ef2b869e3ad983f066c\"}\n\n2025-06-25 17:24:01.621263 DEBUG oslo_policy.policy Rule [default] does not exist\n\n2025-06-25 17:24:01.621369 DEBUG openstack_dashboard.api.keystone IDENTITY: is_cloud_admin check is True\n```","commit_id":"14a03786ebb38a29c7e29409eaf9924323a82a27"},{"author":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"change_message_id":"42446ab61b69d7a666f4ddd83f6a2692cfad9ba8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"ce92826d_a2942b5d","in_reply_to":"c42aec6f_554019f9","updated":"2025-06-26 09:16:56.000000000","message":"obviously same should apply for is_domain_admin check that relies on non-existent `admin_or_matching_domain_id` rule.","commit_id":"14a03786ebb38a29c7e29409eaf9924323a82a27"}]}