Scope various client requests to a project

The default API policies for OpenStack were amended almost unversally
(across projects) with the 2023.1 release to limit information returned
from client requests that are not scoped to a project, see the Glance
release notes for example:

https://docs.openstack.org/releasenotes/glance/2023.1.html#upgrade-notes

This commit introduces a new client that is scoped to a project and
updates the onboarding docs with the new OpenStack pre-reqs.

pkg/providers/openstack/README.md

@@ -17,10 +17,11 @@ Start by selecting a unique name that will be used for the deployment's name, pr
 ```bash
 export USER=unikorn-staging
 export DOMAIN=unikorn-staging
+export PROJECT=unikorn-default
 export PASSWORD=$(apg -n 1 -m 24)
 ```
 
-Create the domain.
+#### Create the domain.
 The use of project domains for projects deployed to provision Kubernetes cluster achieves a few aims.
 First namespace isolation.
 Second is a security consideration.
@@ -32,21 +33,34 @@ A domain may also aid in simplifying operations like auditing and capacity plann
 DOMAIN_ID=$(openstack domain create ${DOMAIN} -f json | jq -r .id)
 ```
 
-Crete the user.
+#### Create the project.
+As the OpenStack provider for the region controller also functions as a client in order to retrieve information such as available images, flavors, and so on it also needs to be associated with a project so that the default policy for various API requests is correctly satisfied:
+
+```bash
+openstack project create $PROJECT --domain $DOMAIN
+```
+
+#### Create the user.
 
 ```bash
 USER_ID=$(openstack user create --domain ${DOMAIN_ID} --password ${PASSWORD} ${USER} -f json | jq -r .id)
 ```
 
-Grant any roles to the user.
+### Grant any roles to the user.
 When a Kubernetes cluster is provisioned, it will be done using application credentials, so ensure any required application credentials as configured for the region are explicitly associated with the user here.
 
 ```bash
-for role in _member_ member load-balancer_member manager; do
+for role in member load-balancer_member manager; do
 	openstack role add --user ${USER_ID} --domain ${DOMAIN_ID} ${role}
 done
 ```
 
+And also grant the `member` role on the project we created in a previous step:
+
+```bash
+openstack role add --user ${USER_ID} --domain ${DOMAIN_ID} --project ${PROJECT} member
+```
+
 ### Unikorn Configuration
 
 When we create a `Region` of type `openstack`, it will require a secret that contains credentials.
@@ -55,6 +69,7 @@ This can be configured as follows.
 ```bash
 kubectl create secret generic -n unikorn-region gb-north-1-credentials \
 	--from-literal=domain-id=${DOMAIN_ID} \
+  --from-literal=project-name=${PROJECT} \
 	--from-literal=user-id=${USER_ID} \
 	--from-literal=password=${PASSWORD}
 ```
@@ -87,5 +102,6 @@ unset DOMAIN_ID
 unset USER_ID
 unset PASSWORD
 unset DOMAIN
+unset PROJECT
 unset USER
 ```

pkg/providers/openstack/client.go

@@ -118,10 +118,20 @@ type DomainScopedPasswordProvider struct {
 	domainID string
 }
 
+// ProjectScopedPasswordProvider allows use of an application credential.
+type ProjectScopedPasswordProvider struct {
+	endpoint    string
+	userID      string
+	password    string
+	projectName string
+	domainID    string
+}
+
 // Ensure the interface is implemented.
 var _ CredentialProvider = &DomainScopedPasswordProvider{}
+var _ CredentialProvider = &ProjectScopedPasswordProvider{}
 
-// NewDomainScopedPasswordProvider creates a client that comsumes passwords
+// NewDomainScopedPasswordProvider creates a client that consumes passwords
 // for authentication.
 func NewDomainScopedPasswordProvider(endpoint, userID, password, domainID string) *DomainScopedPasswordProvider {
 	return &DomainScopedPasswordProvider{
@@ -147,6 +157,34 @@ func (p *DomainScopedPasswordProvider) Client(ctx context.Context) (*gophercloud
 	return authenticatedClient(ctx, options)
 }
 
+// NewProjectScopedPasswordProvider creates a project-scoped client that consumes passwords
+// for authentication.
+func NewProjectScopedPasswordProvider(endpoint, userID, password, projectName, domainID string) *ProjectScopedPasswordProvider {
+	return &ProjectScopedPasswordProvider{
+		endpoint:    endpoint,
+		userID:      userID,
+		password:    password,
+		projectName: projectName,
+		domainID:    domainID,
+	}
+}
+
+// Client implements the Provider interface.
+func (p *ProjectScopedPasswordProvider) Client(ctx context.Context) (*gophercloud.ProviderClient, error) {
+	options := gophercloud.AuthOptions{
+		IdentityEndpoint: p.endpoint,
+		UserID:           p.userID,
+		Password:         p.password,
+		Scope: &gophercloud.AuthScope{
+			DomainID:    p.domainID,
+			ProjectName: p.projectName,
+		},
+		AllowReauth: true,
+	}
+
+	return authenticatedClient(ctx, options)
+}
+
 // TokenProvider creates a client from an endpoint and token.
 type TokenProvider struct {
 	// endpoint is the Keystone endpoint to hit to get access to tokens

pkg/providers/openstack/provider.go

@@ -61,9 +61,10 @@ type Provider struct {
 	// secret is the current region secret.
 	secret *corev1.Secret
 
-	domainID string
-	userID   string
-	password string
+	domainID    string
+	projectName string
+	userID      string
+	password    string
 
 	// DO NOT USE DIRECTLY, CALL AN ACCESSOR.
 	_identity *IdentityClient
@@ -141,11 +142,16 @@ func (p *Provider) serviceClientRefresh(ctx context.Context) error {
 		return fmt.Errorf("%w: password", ErrKeyUndefined)
 	}
 
+	projectName, ok := secret.Data["project-name"]
+	if !ok {
+		return fmt.Errorf("%w: project-id", ErrKeyUndefined)
+	}
+
 	// Pass in an empty string to use the default project.
-	providerClient := NewDomainScopedPasswordProvider(region.Spec.Openstack.Endpoint, string(userID), string(password), string(domainID))
+	providerClient := NewProjectScopedPasswordProvider(region.Spec.Openstack.Endpoint, string(userID), string(password), string(projectName), string(domainID))
 
 	// Create the clients.
-	identity, err := NewIdentityClient(ctx, providerClient)
+	identity, err := NewIdentityClient(ctx, NewDomainScopedPasswordProvider(region.Spec.Openstack.Endpoint, string(userID), string(password), string(domainID)))
 	if err != nil {
 		return err
 	}
@@ -170,6 +176,8 @@ func (p *Provider) serviceClientRefresh(ctx context.Context) error {
 	p.secret = secret
 
 	p.domainID = string(domainID)
+	p.projectName = string(projectName)
+
 	p.userID = string(userID)
 	p.password = string(password)