make prodel URL conditional for global region

[tz3]

Problem

Prodel is being deployed to the global region to support project deletion in the global Keystone domain (see cc/prodel#159).

However, Keystone's policy template currently uses a hardcoded Prodel URL that assumes the prodel namespace:

http://prodel.prodel.svc/check-delete_project/%(project_id)s

This doesn't work for global Keystone, which runs in the monsoon3global namespace and needs to call Prodel at:

http://prodel.monsoon3global.svc/check-delete_project/%(project_id)s

---

Solution

Make the Prodel URL conditional based on the global.is_global_region flag that's already set in secrets/global/values/globals.yaml.

When global.is_global_region=true

helm template -n keystone . --values ci/test-values.yaml --set global.is_global_region=true -s templates/configmap-etc.yaml

the URL of prodel in the rule changes like below:

- "identity:delete_project": "(rule:cloud_admin or (rule:admin_required and (project_id:%(project_id)s or project_id:%(target.project.parent_id)s))) and (http://prodel.prodel.svc/check-delete_project/%(project_id)s)"
+ "identity:delete_project": "(rule:cloud_admin or (rule:admin_required and (project_id:%(project_id)s or project_id:%(target.project.parent_id)s))) and (http://prodel.keystone-namespace.svc/check-delete_project/%(project_id)s)"

[stanislav-zaprudskiy]

I've pushed the update to use a named template for URL calculation to make it more readable, and also relying on global:globals values that the pipeline should supply when deploying in global region.