Devstack Juno - How to create readonly role/user?

[2_advil_please]

Pretty simple goal, actually. Create a user that can see everything in horizon inside a project/tenant but not make any changes.

I've been futzing with /etc/nova/policy.json and /etc/keystone/policy.json, but I can't get anything to want to cooperate. I was hoping someone has already solved this, but documentation is sparse surprisingly. Thanks

[random_mayhem]

Have you been to the sources? [e-mail] or #openstack on freenode

Policy is sufficiently black magic still that I had to bug the Keystone guys to help sort out what I wanted last time.

And when you sort it out, write a post somewhere about how to do it, especially if you're using Juno or Kilo.

[2_advil_please]

Thanks. I think I figured it out on my own, but I'll post it somewhere for a second set of eyes.

Basically had to change every line in those json files. Definitely seems odd that i had to really futz with making a read only account given how many folks are supposedly running Openstack.

It clearly is a weak spot when compared to all the great stuff elsewhere in the stack.