One manual step that bites us many times when dealing with openstack is DB grants

As of today, per-component DB grants are written to a file in the filesystem that should be loaded by hand (via https://github.com/wikimedia/operations-puppet/blob/production/modules/openstack/manifests/db/project_grants.pp )

Maybe we could improve the workflow by telling puppet to load the grants itself, maybe using https://github.com/wikimedia/operations-puppet/blob/production/modules/dbutils/manifests/statement.pp or similar.

Or we may just ignore if we consider that T342750: cloud: introduce a kubernetes undercloud to run openstack (via openstack-helm) is around the corner.