Merge "Ironic: enable elevated access for project scoped service role"

ansible/roles/ironic/templates/ironic.conf.j2

@@ -18,6 +18,8 @@ my_ip = {{ api_interface_address }}
 notification_level = info
 {% endif %}
 
+rbac_service_role_elevated_access = True
+
 [oslo_messaging_notifications]
 transport_url = {{ notify_transport_url }}
 {% if ironic_enabled_notification_topics or enable_ironic_prometheus_exporter | bool %}

releasenotes/notes/ironic-rbac-elevated-6804dab4061ab236.yaml

+---
+features:
+  - |
+    Enable elevated access for project scoped service role
+    in Ironic.  Ironic recently started to enforce new policies
+    and scope. And Ironic is one of the sole openstack project
+    which need system scope for some admin related api calls.
+    However Ironic also started to allow project-scope behaviour
+    for service role with setting
+    ``rbac_service_role_elevated_access``. This change enables
+    this setting to get similar behaviour of service role as other
+    openstack projects.