Allow Zuul API access from keycloak server
This allows users in our test keycloak server to have admin API
access to Zuul.
name: local-admin
conditions:
- iss: zuul.opendev.org
+- admin-rule:
+ name: tenant-group
+ conditions:
+ - groups: "{tenant.name}"
+- admin-rule:
+ name: infra-root
+ conditions:
+ - groups: "infra-root"
- tenant:
name: opendev
- admin-rules:
+ admin-rules: &admin_rules
- local-admin
+ - infra-root
+ - tenant-group
max-nodes-per-job: 10
source:
gerrit:
- tenant:
name: openstack
- admin-rules:
- - local-admin
+ admin-rules: *admin_rules
max-nodes-per-job: 10
source:
gerrit:
- tenant:
name: vexxhost
- admin-rules:
- - local-admin
+ admin-rules: *admin_rules
max-nodes-per-job: 10
source:
gerrit:
- tenant:
name: zuul
- admin-rules:
- - local-admin
+ admin-rules: *admin_rules
default-ansible-version: 2.9
max-nodes-per-job: 10
source:
# https://github.com/pyca
- tenant:
name: pyca
- admin-rules:
- - local-admin
+ admin-rules: *admin_rules
max-nodes-per-job: 1
source:
gerrit:
# https://github.com/pypa
- tenant:
name: pypa
- admin-rules:
- - local-admin
+ admin-rules: *admin_rules
max-nodes-per-job: 1
source:
gerrit:
