keystone: create k8s service account group and roles

Author: skrobul

ansible/roles/keystone_bootstrap/defaults/main.yml

@@ -68,3 +68,22 @@ keystone_bootstrap_groups:
     #     role: member
     #   - project: shared-services
     #     role: reader
+
+# k8s service account groups and their project role assignments
+# Each group can have project_roles with an optional domain to scope the project lookup
+keystone_bootstrap_k8s_groups:
+  - name: k8s-serviceaccounts
+    desc: 'Kubernetes Service Accounts'
+    project_roles:
+      - project: service
+        domain: service
+        role: admin
+      - project: service
+        domain: service
+        role: service
+      - project: baremetal
+        domain: infra
+        role: admin
+      - project: baremetal
+        domain: infra
+        role: service

ansible/roles/keystone_bootstrap/tasks/k8s.yml

@@ -0,0 +1,20 @@
+---
+# Copyright (c) 2026 Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Create k8s service account group mappings
+  ansible.builtin.include_tasks: k8s_group.yml
+  loop: "{{ keystone_bootstrap_k8s_groups }}"
+  loop_control:
+    loop_var: group_item

ansible/roles/keystone_bootstrap/tasks/k8s_group.yml

@@ -0,0 +1,33 @@
+---
+# Copyright (c) 2026 Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Create k8s group
+  openstack.cloud.identity_group:
+    name: "{{ group_item.name }}"
+    description: "{{ group_item.desc }}"
+    state: present
+  register: _k8s_group
+
+- name: Assign role to k8s group for project
+  openstack.cloud.role_assignment:
+    group: "{{ _k8s_group.group.id }}"
+    project: "{{ role_item.project }}"
+    project_domain: "{{ role_item.domain | default(omit) }}"
+    role: "{{ role_item.role }}"
+    state: present
+  loop: "{{ group_item.project_roles | default([]) }}"
+  loop_control:
+    loop_var: role_item
+  when: dont_set_roles is not defined

ansible/roles/keystone_bootstrap/tasks/main.yml

@@ -10,5 +10,8 @@
 - name: Define SSO
   ansible.builtin.include_tasks: sso.yml
 
+- name: Define k8s service account groups
+  ansible.builtin.include_tasks: k8s.yml
+
 - name: Define misc keystone
   ansible.builtin.include_tasks: misc.yml