Write Decision Record for desired domain-manager role

[garloff]

Decisions that led to the current Domain Manager standard draft, its limitations and specifics need to be documented as a Decision Record in the standards repository.

[markus-hentsch]

I have marked

As a SCS Customer I have rights to manage my resources to define roles and map them to access privileges.

in the issue description for removal because it is technically impossible to achieve this.

Defining roles (along with access privileges) is only possible via each OpenStack service's policy.yaml configuration file. The RBAC privilege mappings of APIs (as per oslo.policy's policy.yaml) are not exposed via APIs and thus cannot be modified by customers. Creating and assigning roles via Keystone API has no effect unless a matching role mapping is properly included in the oslo.policy files.

[markus-hentsch]

As agreed upon with @fkr the decision record history was integrated into the standard document itself as an appendix. It was merged together with the draft in #343.

Closing.