Since we have a very old system that has continuously operated for some time and a variety of assumptions and existing policies around access, we have depended on diverging from the upstream OpenStack practice of using random hash IDs for projects instead of assigning a specific value as the project ID (we use the project name). Over time this ended up requiring us to patch the actual code files (with a very small change) to keep doing what was abandoned upstream.
It's about time we started to actually remove dependencies on this in our code and the setup in the environment to not require that. This should include trying to make it so that we can still use project names and not have to manually look up ids, hopefully. Most code that lists out things should be capable of doing this anyway. It may require us to look into setting up more implied roles/policies, TLS on keystone, etc.
The low hanging fruit should be tasks for reviewing openstack-focused scripts for dependency on the equivalency. Please update a list of these below:
- nfs-exportd
- wmcs-wikireplica-dns
- wmfkeystonehooks
- maintain-dbusers